From ca94bd3958e0fc62bb94ea4cf3c317ecadf9703a Mon Sep 17 00:00:00 2001
From: Ryan Cramer <ryan@processwire.com>
Date: Fri, 12 Apr 2019 06:19:54 -0400
Subject: [PATCH] Additional fix for processwire/processwire-issues#587

---
 .../AdminTheme/AdminThemeDefault/AdminThemeDefaultHelpers.php   | 1 +
 wire/modules/AdminTheme/AdminThemeUikit/AdminThemeUikit.module  | 2 ++
 2 files changed, 3 insertions(+)

diff --git a/wire/modules/AdminTheme/AdminThemeDefault/AdminThemeDefaultHelpers.php b/wire/modules/AdminTheme/AdminThemeDefault/AdminThemeDefaultHelpers.php
index c9b72056..8b1918d4 100644
--- a/wire/modules/AdminTheme/AdminThemeDefault/AdminThemeDefaultHelpers.php
+++ b/wire/modules/AdminTheme/AdminThemeDefault/AdminThemeDefaultHelpers.php
@@ -404,6 +404,7 @@ class AdminThemeDefaultHelpers extends WireData {
 			if(empty($item['navJSON'])) {
 				$out .= "<li><a href='{$p->url}$item[url]'>$icon$label</a></li>";
 			} else {
+				$item['navJSON'] = $this->wire('sanitizer')->entities($item['navJSON']);
 				$out .= 
 					"<li>" . 
 						"<a class='pw-has-items pw-has-ajax-items' " . 
diff --git a/wire/modules/AdminTheme/AdminThemeUikit/AdminThemeUikit.module b/wire/modules/AdminTheme/AdminThemeUikit/AdminThemeUikit.module
index 588013e6..9cdd3cf8 100644
--- a/wire/modules/AdminTheme/AdminThemeUikit/AdminThemeUikit.module
+++ b/wire/modules/AdminTheme/AdminThemeUikit/AdminThemeUikit.module
@@ -681,6 +681,7 @@ class AdminThemeUikit extends AdminThemeFramework implements Module, Configurabl
 					"<ul>" . $this->renderPrimaryNavItemChildren($item['children']) . "</ul>";
 
 			} else if(!empty($item['navJSON'])) {
+				$item['navJSON'] = $this->wire('sanitizer')->entities($item['navJSON']); 
 				$out .=
 					"<a class='pw-has-items pw-has-ajax-items' " .
 						"data-from='prnav-page-$item[parent_id]' " .
@@ -781,6 +782,7 @@ class AdminThemeUikit extends AdminThemeFramework implements Module, Configurabl
 							$childNavList .
 						"</ul>";
 				} else if($child['navJSON']) {
+					$child['navJSON'] = $this->wire('sanitizer')->entities($child['navJSON']); 
 					$childClass .= ' uk-parent';
 					$childAttr = " class='pw-has-items pw-has-ajax-items' data-json='$child[navJSON]'";
 					$childNav = "<ul $ulAttrs></ul>";