Escape HTML

src/controllers/user/menu/index.js

@@ -55,7 +55,7 @@ export default function (view, params) {
                 console.debug('Failed to get QuickConnect status');
             });
         ApiClient.getUser(userId).then(function (user) {
-            page.querySelector('.headerUsername').innerHTML = user.Name;
+            page.querySelector('.headerUsername').innerText = user.Name;
             if (user.Policy.IsAdministrator && !layoutManager.tv) {
                 page.querySelector('.adminSection').classList.remove('hide');
             }

src/controllers/user/profile/index.js

@@ -12,7 +12,7 @@ function reloadUser(page) {
     const userId = getParameterByName('userId');
     loading.show();
     ApiClient.getUser(userId).then(function (user) {
-        page.querySelector('.username').innerHTML = user.Name;
+        page.querySelector('.username').innerText = user.Name;
         libraryMenu.setTitle(user.Name);
 
         let imageUrl = 'assets/img/avatar.png';