From 198c940a80748200f05930954eee3d4172d9c881 Mon Sep 17 00:00:00 2001
From: Jens Langhammer <jens.langhammer@beryju.org>
Date: Thu, 18 Aug 2022 13:53:22 +0200
Subject: [PATCH] core: fix pre-hydrated config not being escaped properly

closes #3442

Signed-off-by: Jens Langhammer <jens.langhammer@beryju.org>
---
 authentik/core/templates/if/admin.html | 4 ++--
 authentik/core/templates/if/flow.html  | 4 ++--
 authentik/core/templates/if/user.html  | 4 ++--
 3 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/authentik/core/templates/if/admin.html b/authentik/core/templates/if/admin.html
index 33c980b7e..f60333538 100644
--- a/authentik/core/templates/if/admin.html
+++ b/authentik/core/templates/if/admin.html
@@ -10,8 +10,8 @@
 <script>
 window.authentik = {};
 window.authentik.locale = "{{ tenant.default_locale }}";
-window.authentik.config = JSON.parse('{{ config_json|safe }}');
-window.authentik.tenant = JSON.parse('{{ tenant_json|safe }}');
+window.authentik.config = JSON.parse('{{ config_json|escapejs }}');
+window.authentik.tenant = JSON.parse('{{ tenant_json|escapejs }}');
 </script>
 {% endblock %}
 
diff --git a/authentik/core/templates/if/flow.html b/authentik/core/templates/if/flow.html
index 6183417bf..59a4b78f5 100644
--- a/authentik/core/templates/if/flow.html
+++ b/authentik/core/templates/if/flow.html
@@ -12,8 +12,8 @@
 <script>
 window.authentik = {};
 window.authentik.locale = "{{ tenant.default_locale }}";
-window.authentik.config = JSON.parse( '{{ config_json|safe }}');
-window.authentik.tenant = JSON.parse('{{ tenant_json|safe }}');
+window.authentik.config = JSON.parse('{{ config_json|escapejs }}');
+window.authentik.tenant = JSON.parse('{{ tenant_json|escapejs }}');
 window.authentik.flow = {
     "layout": "{{ flow.layout }}",
 };
diff --git a/authentik/core/templates/if/user.html b/authentik/core/templates/if/user.html
index dd9353154..59a10db9b 100644
--- a/authentik/core/templates/if/user.html
+++ b/authentik/core/templates/if/user.html
@@ -10,8 +10,8 @@
 <script>
 window.authentik = {};
 window.authentik.locale = "{{ tenant.default_locale }}";
-window.authentik.config = JSON.parse('{{ config_json|safe }}');
-window.authentik.tenant = JSON.parse('{{ tenant_json|safe }}');
+window.authentik.config = JSON.parse('{{ config_json|escapejs }}');
+window.authentik.tenant = JSON.parse('{{ tenant_json|escapejs }}');
 </script>
 {% endblock %}