Neissi / Duda - Escaping recipients on mail view

1 files changed, 3 insertions, 1 deletions

diff --git a/web-ui/app/js/views/recipientListFormatter.js b/web-ui/app/js/views/recipientListFormatter.js
index 20afc6ed..68e6dbe1 100644
--- a/web-ui/app/js/views/recipientListFormatter.js
+++ b/web-ui/app/js/views/recipientListFormatter.js
@@ -20,7 +20,9 @@ define(function() {
   'use strict';
   Handlebars.registerHelper('formatRecipients', function (header) {
     function wrapWith(begin, end) {
-      return function (x) { return begin + x + end; };
+      return function (x) {
+        return begin + Handlebars.Utils.escapeExpression(x) + end;
+      };
     }
 
     var to = _.map(header.to, wrapWith('<span class="to">', '</span>'));