1 files changed, 3 insertions, 2 deletions
diff --git a/qpid/java/broker-plugins/management-http/src/main/java/resources/js/qpid/management/accesscontrolprovider/AclFile.js b/qpid/java/broker-plugins/management-http/src/main/java/resources/js/qpid/management/accesscontrolprovider/AclFile.js
index 56f92c2025..3aa9d0baee 100644
--- a/qpid/java/broker-plugins/management-http/src/main/java/resources/js/qpid/management/accesscontrolprovider/AclFile.js
+++ b/qpid/java/broker-plugins/management-http/src/main/java/resources/js/qpid/management/accesscontrolprovider/AclFile.js
@@ -28,6 +28,7 @@ define(["dojo/_base/xhr",
         "dojo/_base/event",
         "dojo/_base/json",
         "dijit/registry",
+        "dojox/html/entities",
         "qpid/common/util",
         "qpid/common/properties",
         "qpid/common/updater",
@@ -43,7 +44,7 @@ define(["dojo/_base/xhr",
         "dijit/form/Form",
         "dijit/form/DateTextBox",
         "dojo/domReady!"],
-    function (xhr, dom, parser, query, construct, connect, win, event, json, registry, util, properties, updater, UpdatableStore, EnhancedGrid) {
+    function (xhr, dom, parser, query, construct, connect, win, event, json, registry, entities, util, properties, updater, UpdatableStore, EnhancedGrid) {
         function AclFile(containerNode, aclProviderObj, controller) {
             var node = construct.create("div", null, containerNode, "last");
             var that = this;
@@ -85,7 +86,7 @@ define(["dojo/_base/xhr",
                   if (data[0])
                   {
                     that.aclProviderData = data[0];
-                    that.path.innerHTML = that.aclProviderData.path;
+                    that.path.innerHTML = entities.encode(String(that.aclProviderData.path));
                   }
                 });