dialog-6016.patch

diff --git a/ui/jquery.ui.dialog.js b/ui/jquery.ui.dialog.js
index b998c25..271d64e 100644
--- a/ui/jquery.ui.dialog.js
+++ b/ui/jquery.ui.dialog.js
@@ -347,14 +347,21 @@ $.widget("ui.dialog", {
         uiDialogTitle = $( "<span>" )
             .uniqueId()
             .addClass( "ui-dialog-title" )
-            .html( this.options.title || "&#160;" )
             .prependTo( this.uiDialogTitlebar );
+        this._title( uiDialogTitle );
 
         this.uiDialog.attr({
             "aria-labelledby": uiDialogTitle.attr( "id" )
         });
     },
 
+    _title: function( title ) {
+        if ( !this.options.title ) {
+            title.html( "&#160;" );
+        }
+        title.text( this.options.title );
+    },
+
     _createButtonPane: function() {
         var uiDialogButtonPane = ( this.uiDialogButtonPane = $( "<div>" ) )
             .addClass( "ui-dialog-buttonpane ui-widget-content ui-helper-clearfix" );
@@ -612,9 +619,7 @@ $.widget("ui.dialog", {
         }
 
         if ( key === "title" ) {
-            // convert whatever was passed in to a string, for html() to not throw up
-            $( ".ui-dialog-title", this.uiDialogTitlebar )
-                .html( "" + ( value || "&#160;" ) );
+            this._title( $( ".ui-dialog-title", this.uiDialogTitlebar ) );
         }
     },

On Line 35... where did value go? Looks like this._title needs two params, title and titleText. Am I wrong?

_setOption used to pass along its value argument. That's not necessary any more, as the option is updated before calling _title. Leftover from previous refactorings.

On line 35, use .find() instead of passing a context. Otherwise, this looks good.

hi, i found this page by http://stackoverflow.com/questions/21830980/vulnerable-javascript-library-jquery-ui-1-8-16-custom-min-js. I have a similar problem with jquery-ui-1.8.14.js when i was using Acunetix scan. I will be grateful if you can help me out here, maybe a patch file? thank you in advance