From cc9d09bd54220152163dbca55c52eebfeedb446b Mon Sep 17 00:00:00 2001
From: Tim <timvdwest@gmail.com>
Date: Sun, 6 Dec 2015 20:49:00 +0200
Subject: [PATCH 1/2] Allow HTML encoded content to be displayed in
 notification setting descriptions.

---
 data/interfaces/default/notification_config.html | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/data/interfaces/default/notification_config.html b/data/interfaces/default/notification_config.html
index 7d420259..9d8ab9a1 100644
--- a/data/interfaces/default/notification_config.html
+++ b/data/interfaces/default/notification_config.html
@@ -25,7 +25,7 @@ from plexpy import helpers
                                     % endif
                                 </div>
                             </div>
-                            <p class="help-block">${item['description']}</p>
+                            <p class="help-block">${item['description'] | n}</p>
                         </div>
                         % elif item['input_type'] == 'button':
                         <div class="form-group">
@@ -34,14 +34,14 @@ from plexpy import helpers
                                     <input type="${item['input_type']}" class="btn btn-bright" id="${item['name']}" name="${item['name']}" value="${item['value']}">
                                 </div>
                             </div>
-                            <p class="help-block">${item['description']}</p>
+                            <p class="help-block">${item['description'] | n}</p>
                         </div>
                         % elif item['input_type'] == 'checkbox':
                         <div class="checkbox">
                             <label>
                                 <input type="checkbox" data-id="${item['name']}" class="checkboxes" value="1" ${helpers.checked(item['value'])}> ${item['label']}
                             </label>
-                            <p class="help-block">${item['description']}</p>
+                            <p class="help-block">${item['description'] | n}</p>
                             <input type="hidden" id="${item['name']}" name="${item['name']}" value="${item['value']}">
                         </div>
                         % elif item['input_type'] == 'select':
@@ -60,7 +60,7 @@ from plexpy import helpers
                                     </select>
                                 </div>
                             </div>
-                            <p class="help-block">${item['description']}</p>
+                            <p class="help-block">${item['description'] | n}</p>
                         </div>
                         % endif
                     % endfor

From 1fb7473dc5b60178e4013d88303f938412bafad0 Mon Sep 17 00:00:00 2001
From: Tim <timvdwest@gmail.com>
Date: Sun, 6 Dec 2015 21:04:33 +0200
Subject: [PATCH 2/2] Sanitize sync row items.

---
 plexpy/plextv.py | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/plexpy/plextv.py b/plexpy/plextv.py
index 1c6682a1..8d4796c6 100644
--- a/plexpy/plextv.py
+++ b/plexpy/plextv.py
@@ -342,13 +342,13 @@ class PlexTV(object):
 
                         rating_key = clean_uri.rpartition('%2F')[-1]
 
-                        sync_details = {"device_name": device_name,
-                                        "platform": device_platform,
-                                        "username": device_username,
-                                        "friendly_name": device_friendly_name,
+                        sync_details = {"device_name": helpers.sanitize(device_name),
+                                        "platform": helpers.sanitize(device_platform),
+                                        "username": helpers.sanitize(device_username),
+                                        "friendly_name": helpers.sanitize(device_friendly_name),
                                         "user_id": device_user_id,
-                                        "root_title": sync_root_title,
-                                        "title": sync_title,
+                                        "root_title": helpers.sanitize(sync_root_title),
+                                        "title": helpers.sanitize(sync_title),
                                         "metadata_type": sync_metadata_type,
                                         "content_type": sync_content_type,
                                         "rating_key": rating_key,