From de9739118e90328c01b2fbc07fd769d02669c878 Mon Sep 17 00:00:00 2001
From: Alex Novgorodov <krom@bk.ru>
Date: Tue, 4 Apr 2017 18:11:48 +0300
Subject: [PATCH] Add basic xss prevention logic

---
 src/Umbraco.Web.UI/umbraco/users/PermissionEditor.aspx | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/Umbraco.Web.UI/umbraco/users/PermissionEditor.aspx b/src/Umbraco.Web.UI/umbraco/users/PermissionEditor.aspx
index 815a420f88..d80a60c92c 100644
--- a/src/Umbraco.Web.UI/umbraco/users/PermissionEditor.aspx
+++ b/src/Umbraco.Web.UI/umbraco/users/PermissionEditor.aspx
@@ -27,7 +27,7 @@
 			<script type="text/javascript" language="javascript">				
 				jQuery(document).ready(function() {
 					jQuery("#<%=JTree.ClientID%>").PermissionsEditor({
-						userId: <%=Request.QueryString["id"] %>,
+						userId: <%=Request.CleanForXss("id") %>,
 						pPanelSelector: "#permissionsPanel",
 						replacePChkBoxSelector: "#chkChildPermissions"});						
 				});