From d4c866cb5544e26ea2a23b196790340a36f24464 Mon Sep 17 00:00:00 2001
From: Karson <karsonzhang@163.com>
Date: Tue, 2 Apr 2024 17:50:19 +0800
Subject: [PATCH] =?UTF-8?q?=E4=BC=98=E5=8C=96=E6=A0=BC=E5=BC=8F=E5=8C=96?=
 =?UTF-8?q?=E8=BE=93=E5=87=BA=E6=97=B6=E6=96=87=E6=9C=AC=E7=BC=96=E7=A0=81?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 public/assets/js/require-table.js | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/public/assets/js/require-table.js b/public/assets/js/require-table.js
index 19aec6bd..7705943e 100755
--- a/public/assets/js/require-table.js
+++ b/public/assets/js/require-table.js
@@ -837,7 +837,7 @@ define(['jquery', 'bootstrap'], function ($, undefined) {
                         var customValue = this.customField.split('.').reduce(function (obj, key) {
                             return obj === null || obj === undefined ? '' : obj[key];
                         }, row);
-                        value = customValue;
+                        value = Fast.api.escape(customValue);
                         field = this.customField;
                     }
                     return '<a href="javascript:;" class="searchit" data-toggle="tooltip" title="' + __('Click to search %s', value) + '" data-field="' + field + '" data-value="' + value + '">' + value + '</a>';
@@ -865,7 +865,7 @@ define(['jquery', 'bootstrap'], function ($, undefined) {
                         var customValue = this.customField.split('.').reduce(function (obj, key) {
                             return obj === null || obj === undefined ? '' : obj[key];
                         }, row);
-                        value = customValue;
+                        value = Fast.api.escape(customValue);
                         field = this.customField;
                     }
                     if (typeof that.searchList === 'object' && typeof that.custom === 'undefined') {
@@ -1020,6 +1020,7 @@ define(['jquery', 'bootstrap'], function ($, undefined) {
                     var temp = matched.split('.').reduce(function (obj, key) {
                         return obj === null || obj === undefined ? '' : obj[key];
                     }, row);
+                    temp = Fast.api.escape(temp);
                     return temp;
                 });
                 return url;