From eccbe8e018ae9535eadda7e6ca795c6fcdf95bf0 Mon Sep 17 00:00:00 2001
From: "nicolas.dorier" <nicolas.dorier@gmail.com>
Date: Sun, 12 Sep 2021 20:33:51 +0900
Subject: [PATCH] Sanitize UrlRoot in PayButton

---
 BTCPayServer/Views/Stores/PayButton.cshtml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/BTCPayServer/Views/Stores/PayButton.cshtml b/BTCPayServer/Views/Stores/PayButton.cshtml
index fd8089c6e..1ee8af870 100644
--- a/BTCPayServer/Views/Stores/PayButton.cshtml
+++ b/BTCPayServer/Views/Stores/PayButton.cshtml
@@ -19,7 +19,7 @@
     <template id="template-get-scripts" csp-allow>
         if (!window.btcpay) {
             var script = document.createElement('script');
-            script.src='@(Model.UrlRoot)modal/btcpay.js';
+            script.src=@(Safe.Json(Model.UrlRoot + "modal/btcpay.js"));
             document.getElementsByTagName('head')[0].append(script);
         }
         function onBTCPayFormSubmit(event) {