[1.9.x] Fixed XSS in admin's add/change related popup.

This is a security fix.

2 files changed, 3 insertions, 3 deletions

diff --git a/django/contrib/admin/static/admin/js/admin/RelatedObjectLookups.js b/django/contrib/admin/static/admin/js/admin/RelatedObjectLookups.js
index 4ac9baa8ee..76cc952239 100644
--- a/django/contrib/admin/static/admin/js/admin/RelatedObjectLookups.js
+++ b/django/contrib/admin/static/admin/js/admin/RelatedObjectLookups.js
@@ -120,7 +120,7 @@
         var selects = django.jQuery(selectsSelector);
         selects.find('option').each(function() {
             if (this.value === objId) {
-                this.innerHTML = newRepr;
+                this.textContent = newRepr;
                 this.value = newId;
             }
         });
diff --git a/django/views/debug.py b/django/views/debug.py
index 7cff3eface..2629d345eb 100644
--- a/django/views/debug.py
+++ b/django/views/debug.py
@@ -631,13 +631,13 @@ TECHNICAL_500_TEMPLATE = ("""
       var s = link.getElementsByTagName('span')[0];
       var uarr = String.fromCharCode(0x25b6);
       var darr = String.fromCharCode(0x25bc);
-      s.innerHTML = s.innerHTML == uarr ? darr : uarr;
+      s.textContent = s.textContent == uarr ? darr : uarr;
       return false;
     }
     function switchPastebinFriendly(link) {
       s1 = "Switch to copy-and-paste view";
       s2 = "Switch back to interactive view";
-      link.innerHTML = link.innerHTML.trim() == s1 ? s2: s1;
+      link.textContent = link.textContent.trim() == s1 ? s2: s1;
       toggle('browserTraceback', 'pastebinTraceback');
       return false;
     }