filebrowser arbitrary js injection

[tablatronix]

reported by tc.coen

XSS
Risk
Medium-High; arbitrary javascript execution, which can lead to cookie stealing, key logging, and CSRF protection bypass, which in this case leads to arbitrary code execution via eg the theme editor

[tablatronix]

Adding basic filtering for plugin compatibility, this is deprecated in 3.4 already which uses events binding.