From 869bdf89e05de797f046c6c10db0fcf89589e349 Mon Sep 17 00:00:00 2001
From: Alf Eaton <75253002+aeaton-overleaf@users.noreply.github.com>
Date: Thu, 4 Mar 2021 11:31:30 +0000
Subject: [PATCH] Merge pull request #3722 from
 overleaf/as-fix-project-invite-xss

Prevent stored XSS on project invite page

GitOrigin-RevId: ada89c46d62e64d794edacc9be3c08b622ce433c
---
 services/web/app/views/project/invite/show.pug | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/services/web/app/views/project/invite/show.pug b/services/web/app/views/project/invite/show.pug
index bb5b64ff92..567e8f1f2c 100644
--- a/services/web/app/views/project/invite/show.pug
+++ b/services/web/app/views/project/invite/show.pug
@@ -7,7 +7,7 @@ block content
 				.col-md-8.col-md-offset-2
 					.card.project-invite-accept
 						.page-header.text-centered
-							h1 #{translate("user_wants_you_to_see_project", {username:owner.first_name, projectname:""})}
+							h1(ng-non-bindable) #{translate("user_wants_you_to_see_project", {username:owner.first_name, projectname:""})}
 								br
 								em(ng-non-bindable) #{project.name}
 						.row.text-center