From 5605450820edf76d97676d34bee52c080baa27f1 Mon Sep 17 00:00:00 2001
From: Carsten Schmitz <carsten.schmitz@limesurvey.org>
Date: Thu, 12 Oct 2017 10:51:17 +0200
Subject: [PATCH] Fixed issue #12739: File upload question format: Title and
 comment may be  garbled when going back and forth

---
 application/helpers/qanda_helper.php                      | 7 +++----
 application/views/survey/questions/file_upload/answer.php | 6 ++++--
 scripts/modaldialog.js                                    | 2 +-
 3 files changed, 8 insertions(+), 7 deletions(-)

diff --git a/application/helpers/qanda_helper.php b/application/helpers/qanda_helper.php
index 5bf8df05567..cb86632be27 100644
--- a/application/helpers/qanda_helper.php
+++ b/application/helpers/qanda_helper.php
@@ -2511,13 +2511,12 @@ function upload_$ia[1]() {
             $filecountvalue = $tempval;
         }
     }
-    $value = htmlspecialchars($_SESSION['survey_'.Yii::app()->getConfig('surveyID')][$ia[1]],ENT_QUOTES,'utf-8');
-    $fileuploadDatas = array(
+    $fileuploadData = array(
         'fileid' => $ia[1],
-        'value' => $value,
+        'value' => $_SESSION['survey_'.Yii::app()->getConfig('surveyID')][$ia[1]],
         'filecountvalue'=>$filecountvalue,
     );
-    $answer .= doRender('/survey/questions/file_upload/answer', $fileuploadDatas, true);
+    $answer .= doRender('/survey/questions/file_upload/answer', $fileuploadData, true);
 
     $answer .= '<script type="text/javascript">
     var surveyid = '.Yii::app()->getConfig('surveyID').';
diff --git a/application/views/survey/questions/file_upload/answer.php b/application/views/survey/questions/file_upload/answer.php
index 87674e73dad..b2b4b612422 100644
--- a/application/views/survey/questions/file_upload/answer.php
+++ b/application/views/survey/questions/file_upload/answer.php
@@ -20,8 +20,10 @@ class='btn btn-default upload'
         <span class='fa fa-upload'></span>&nbsp;<?php eT('Upload files'); ?>
     </a>
 </div>
-<input type='hidden' id='<?php echo $fileid;?>' name='<?php echo $fileid;?>' value='<?php echo $value;?>' />
-<input type='hidden' id='<?php echo $fileid;?>_filecount' name='<?php echo $fileid;?>_filecount' value="<?php echo $filecountvalue?>" />
+<?php 
+    echo CHtml::hiddenField($fileid, $value, array('name'=>$fileid));
+    echo CHtml::hiddenField($fileid.'_filecount', $filecountvalue, array('name'=>$fileid.'_filecount'));
+?>
 <div id='<?php echo $fileid;?>_uploadedfiles'>
 </div>
 <!-- end of answer -->
diff --git a/scripts/modaldialog.js b/scripts/modaldialog.js
index 1dcb9ae1534..0eb3020b17c 100644
--- a/scripts/modaldialog.js
+++ b/scripts/modaldialog.js
@@ -82,7 +82,7 @@ function displayUploadedFiles(jsonstring, filecount, fieldname, show_title, show
 
     if (jsonstring !== '')
     {
-        jsonobj = eval('(' + jsonstring + ')');
+        jsonobj = JSON.parse(jsonstring);
         display = '<table width="100%" class="question uploadedfiles"><thead><tr><td width="20%">&nbsp;</td>';
         if (show_title != 0)
             display += '<th>'+uploadLang.headTitle+'</th>';