From ded1def8e2e7ea1a4fd0f849cc7a3f1f97cd8242 Mon Sep 17 00:00:00 2001
From: Shannon <sdeminick@gmail.com>
Date: Fri, 27 Feb 2015 16:50:33 +1100
Subject: [PATCH] Fixes: U4-6333 - but should fix this better (i.e. centralize
 the code to clean for xss in JS like we have in c#)

---
 .../src/views/common/legacy.controller.js                 | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/src/Umbraco.Web.UI.Client/src/views/common/legacy.controller.js b/src/Umbraco.Web.UI.Client/src/views/common/legacy.controller.js
index 81a601f531..46114042b5 100644
--- a/src/Umbraco.Web.UI.Client/src/views/common/legacy.controller.js
+++ b/src/Umbraco.Web.UI.Client/src/views/common/legacy.controller.js
@@ -8,7 +8,13 @@
  * 
 */
 function LegacyController($scope, $routeParams, $element) {
-	$scope.legacyPath = decodeURIComponent($routeParams.url);
+
+    var url = $routeParams.url;
+    var toClean = "*?(){}[];:%<>/\\|&'\"";
+    for (var i = 0; i < toClean.length; i++) {
+        url = url.replace(toClean[i], "");
+    }
+    $scope.legacyPath = decodeURIComponent(url);
 }
 
 angular.module("umbraco").controller('Umbraco.LegacyController', LegacyController);
\ No newline at end of file