From e58e07ff5f25a71dea01a06836ccf8aa8f3eb7e7 Mon Sep 17 00:00:00 2001
From: Coto <rodrigo.augosto@gmail.com>
Date: Mon, 27 Jan 2014 03:05:39 -0300
Subject: [PATCH] fix security issue in admin

---
 bp_admin/templates/admin_users_list.html | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/bp_admin/templates/admin_users_list.html b/bp_admin/templates/admin_users_list.html
index bb4507d4..8048ddb2 100644
--- a/bp_admin/templates/admin_users_list.html
+++ b/bp_admin/templates/admin_users_list.html
@@ -9,7 +9,7 @@
   <div class="navbar-inner">
     <form method="GET" class="navbar-search">
         <span class="badge"> {{ count }}&nbsp</span>
-        <input type="text" name="q" value="{{ q or '' }}" class="input-medium search-query" placeholder="{{ _('Search User') }}" />
+        <input type="text" name="q" value="{{ q|e }}" class="input-medium search-query" placeholder="{{ _('Search User') }}" />
         <button type="submit" title="Search"><i class="icon-search"></i></button>
         {% if q %}
         <a href="{{ uri_for('admin-users-list') }}" class="clear">×</a>