From 826b3fa81708a6b16a5dcc2d4f913010f347ff40 Mon Sep 17 00:00:00 2001
From: Dries Buytaert <dries@buytaert.net>
Date: Sat, 5 Sep 2009 10:05:38 +0000
Subject: - Patch #565994 by mfb: src attribute for external javascript should
 be HTML-encoded.

---
 includes/common.inc | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'includes')

diff --git a/includes/common.inc b/includes/common.inc
index 2cc735049..848bd667c 100644
--- a/includes/common.inc
+++ b/includes/common.inc
@@ -3157,7 +3157,7 @@ function drupal_get_js($scope = 'header', $javascript = NULL) {
 
       case 'external':
         // Preprocessing for external JavaScript files is ignored.
-        $output .= '<script type="text/javascript"' . ($item['defer'] ? ' defer="defer"' : '') . ' src="' . $item['data'] . "\"></script>\n";
+        $output .= '<script type="text/javascript"' . ($item['defer'] ? ' defer="defer"' : '') . ' src="' . check_plain($item['data']) . "\"></script>\n";
         break;
     }
   }
-- 
cgit v1.2.3