From a3ebeb5c69ee99f20f6b5daf755218b461e59da2 Mon Sep 17 00:00:00 2001
From: Kegan Dougal <kegan@matrix.org>
Date: Wed, 31 May 2017 16:38:51 +0100
Subject: [PATCH] Sanitize translated HTML

---
 src/components/views/login/VectorCustomServerDialog.js | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/components/views/login/VectorCustomServerDialog.js b/src/components/views/login/VectorCustomServerDialog.js
index d7fe545a0a..80cd68006f 100644
--- a/src/components/views/login/VectorCustomServerDialog.js
+++ b/src/components/views/login/VectorCustomServerDialog.js
@@ -15,6 +15,7 @@ limitations under the License.
 */
 
 var React = require("react");
+var sanitizeHtml = require("sanitize-html");
 import { _t } from 'matrix-react-sdk/lib/languageHandler';
 
 module.exports = React.createClass({
@@ -30,7 +31,7 @@ module.exports = React.createClass({
                     { _t('Custom Server Options') }
                 </div>
                 <div className="mx_Dialog_content">
-                    <span dangerouslySetInnerHTML={{__html: _t('customServer_text')}} />
+                    <span dangerouslySetInnerHTML={{__html: sanitizeHtml(_t('customServer_text'))}} />
                 </div>
                 <div className="mx_Dialog_buttons">
                     <button onClick={this.props.onFinished} autoFocus={true}>