Escape data attributes in template.

This fixes a bug whereby a double quote in an item would not be JSON-escaped
due to being HTML-escaped first, meaning it would not parse as JSON on the
client.

1 files changed, 6 insertions, 0 deletions

diff --git a/web/cobrands/fixmystreet/staff.js b/web/cobrands/fixmystreet/staff.js
index 134f57a7f..0dd635437 100644
--- a/web/cobrands/fixmystreet/staff.js
+++ b/web/cobrands/fixmystreet/staff.js
@@ -232,6 +232,9 @@ $.extend(fixmystreet.set_up, {
         opts.state = opts.state || $inspect_form.find('[name=state]').val();
         var selector = "[data-category='" + opts.category + "']";
         var data = $inspect_form.find(selector).data('templates') || [];
+        if (data.constructor !== Array) {
+          return;
+        }
         data = $.grep(data, function(d, i) {
             if (!d.state || d.state == opts.state) {
                 return true;
@@ -243,6 +246,9 @@ $.extend(fixmystreet.set_up, {
 
     function populateSelect($select, data, label_formatter) {
       $select.find('option:gt(0)').remove();
+      if (data.constructor !== Array) {
+        return;
+      }
       $.each(data, function(k,v) {
         var label = window.fixmystreet.utils[label_formatter](v);
         var $opt = $('<option></option>').attr('value', v.id).text(label);