From dd932802f4935cc231a76246914e852c000aaaa6 Mon Sep 17 00:00:00 2001
From: Ludovic Marcotte <lmarcotte@inverse.ca>
Date: Wed, 28 Dec 2016 14:11:25 -0500
Subject: [PATCH] (fix) properly escape values (fixes #3241)

---
 UI/Templates/MailerUI/UIxMailEditor.wox | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/UI/Templates/MailerUI/UIxMailEditor.wox b/UI/Templates/MailerUI/UIxMailEditor.wox
index 76f3a9f8f..32f760125 100644
--- a/UI/Templates/MailerUI/UIxMailEditor.wox
+++ b/UI/Templates/MailerUI/UIxMailEditor.wox
@@ -70,11 +70,11 @@
 
       <var:foreach list="personalContactInfos" item="currentContact">
         <tr var:class="currentContactClasses"
-          var:categories="currentContact.c_categories"
-          var:id="currentContact.c_name"
-          var:contactname="currentContact.c_cn">
-          <td class="displayName" var:title="currentContact.c_cn"><var:string value="currentContact.c_cn" const:escapeHTML="YES" /></td>
-          <td var:title="currentContact.c_mail"><var:string value="currentContact.c_mail"/></td>
+          var:categories="currentContact.c_categories.safeStringByEscapingXMLString"
+          var:id="currentContact.c_name.asCSSIdentifier"
+          var:contactname="currentContact.c_cn.safeStringByEscapingXMLString">
+          <td class="displayName" var:title="currentContact.c_cn.safeStringByEscapingXMLString"><var:string value="currentContact.c_cn" const:escapeHTML="YES" /></td>
+          <td var:title="currentContact.c_mail.safeStringByEscapingXMLString"><var:string value="currentContact.c_mail"/></td>
         </tr>
       </var:foreach>