Fixed XSS issue with file based dashboards, was really casued by an issue with…

Fixed XSS issue with file based dashboards, was really casued by an issue with alertSrv accepting html in message alerts

public/app/routes/dashLoadControllers.js

@@ -76,7 +76,7 @@ function (angular, _, kbn, moment, $) {
         }
         }
         return result.data;
         return result.data;
       },function() {
       },function() {
-        $scope.appEvent('alert-error', ["Dashboard load failed", "Could not load <i>dashboards/"+file+"</i>. Please make sure it exists"]);
+        $scope.appEvent('alert-error', ["Dashboard load failed", "Could not load "+file+". Please make sure it exists"]);
         return false;
         return false;
       });
       });
     };
     };

public/app/services/alertSrv.js

@@ -29,7 +29,7 @@ function (angular, _) {
     this.set = function(title,text,severity,timeout) {
     this.set = function(title,text,severity,timeout) {
       var newAlert = {
       var newAlert = {
         title: title || '',
         title: title || '',
-        text: $sce.trustAsHtml(text || ''),
+        text: text || '',
         severity: severity || 'info',
         severity: severity || 'info',
       };
       };
 
 

public/views/index.html

@@ -35,7 +35,7 @@
 						<i class="fa fa-times-circle"></i>
 						<i class="fa fa-times-circle"></i>
 					</button>
 					</button>
 					<div class="alert-title">{{alert.title}}</div>
 					<div class="alert-title">{{alert.title}}</div>
-					<div ng-bind-html='alert.text'></div>
+					<div ng-bind='alert.text'></div>
 				</div>
 				</div>
 			</div>
 			</div>