From 45c860797ace0ea50958d978a4aeb7496daed30e Mon Sep 17 00:00:00 2001
From: ibuler <ibuler@qq.com>
Date: Tue, 8 Aug 2023 11:07:34 +0800
Subject: [PATCH] =?UTF-8?q?fix:=20=E4=BF=AE=E5=A4=8D=E7=B3=BB=E7=BB=9F?=
 =?UTF-8?q?=E8=AE=BE=E7=BD=AE=20>=20=E6=B6=88=E6=81=AF=E8=AE=A2=E9=98=85?=
 =?UTF-8?q?=20>=20=E4=BF=AE=E6=94=B9=E8=AE=A2=E9=98=85=E4=BA=BA=20?=
 =?UTF-8?q?=E5=9B=A0=E4=B8=BA=E7=94=A8=E6=88=B7=E5=90=8D=E5=AF=BC=E8=87=B4?=
 =?UTF-8?q?=E7=9A=84=20xss?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 src/views/settings/Message/SelectDialog.vue | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/src/views/settings/Message/SelectDialog.vue b/src/views/settings/Message/SelectDialog.vue
index 706341665..02d2f1201 100644
--- a/src/views/settings/Message/SelectDialog.vue
+++ b/src/views/settings/Message/SelectDialog.vue
@@ -2,13 +2,13 @@
   <Dialog
     ref="myDialog"
     :destroy-on-close="true"
-    width="790px"
     height="720px"
     v-bind="$attrs"
+    width="790px"
     @confirm="submit"
     v-on="$listeners"
   >
-    <krryPaging ref="pageTransfer" v-bind="pagingTransfer" class="transfer" />
+    <krryPaging ref="pageTransfer" class="transfer" v-bind="pagingTransfer" />
   </Dialog>
 </template>
 
@@ -16,6 +16,7 @@
 import Dialog from '@/components/Dialog'
 import { krryPaging } from 'krry-transfer'
 import { getUserList } from '@/api/users'
+
 export default {
   name: 'ListSelect',
   components: {
@@ -47,7 +48,7 @@ export default {
           }
           const data = await getUserList(params)
           const results = data['results'].map(item => {
-            return { id: item.id, label: `${item.name}(${item.username})` }
+            return { id: item.id, label: _.escape(`${item.name}(${item.username})`) }
           })
           return results
         },
@@ -62,7 +63,7 @@ export default {
           }
           const data = await getUserList(params)
           const results = data['results'].map(item => {
-            return { id: item.id, label: `${item.name}(${item.username})` }
+            return { id: item.id, label: _.escape(`${item.name}(${item.username})`) }
           })
           return results
         },