@@ -15,9 +15,9 @@ var FileList={
1515 extension = false ;
1616 }
1717 html += '<td class="filename" style="background-image:url(' + img + ')"><input type="checkbox" />' ;
18- html += '<a class="name" href="download.php?file=' + $ ( '#dir' ) . val ( ) . replace ( / < / , '<' ) . replace ( / > / , '>' ) + '/' + name + '"><span class="nametext">' + basename ;
18+ html += '<a class="name" href="download.php?file=' + $ ( '#dir' ) . val ( ) . replace ( / < / , '<' ) . replace ( / > / , '>' ) + '/' + escapeHTML ( name ) + '"><span class="nametext">' + escapeHTML ( basename ) ;
1919 if ( extension ) {
20- html += '<span class="extension">' + extension + '</span>' ;
20+ html += '<span class="extension">' + escapeHTML ( extension ) + '</span>' ;
2121 }
2222 html += '</span></a></td>' ;
2323 if ( size != 'Pending' ) {
@@ -189,9 +189,9 @@ var FileList={
189189 checkName :function ( oldName , newName , isNewFile ) {
190190 if ( isNewFile || $ ( 'tr' ) . filterAttr ( 'data-file' , newName ) . length > 0 ) {
191191 if ( isNewFile ) {
192- $ ( '#notification' ) . html ( newName + ' ' + t ( 'files' , 'already exists' ) + '<span class="replace">' + t ( 'files' , 'replace' ) + '</span><span class="suggest">' + t ( 'files' , 'suggest name' ) + '</span><span class="cancel">' + t ( 'files' , 'cancel' ) + '</span>' ) ;
192+ $ ( '#notification' ) . html ( escapeHTML ( newName ) + ' ' + t ( 'files' , 'already exists' ) + '<span class="replace">' + t ( 'files' , 'replace' ) + '</span><span class="suggest">' + t ( 'files' , 'suggest name' ) + '</span><span class="cancel">' + t ( 'files' , 'cancel' ) + '</span>' ) ;
193193 } else {
194- $ ( '#notification' ) . html ( newName + ' ' + t ( 'files' , 'already exists' ) + '<span class="replace">' + t ( 'files' , 'replace' ) + '</span><span class="cancel">' + t ( 'files' , 'cancel' ) + '</span>' ) ;
194+ $ ( '#notification' ) . html ( escapeHTML ( newName ) + ' ' + t ( 'files' , 'already exists' ) + '<span class="replace">' + t ( 'files' , 'replace' ) + '</span><span class="cancel">' + t ( 'files' , 'cancel' ) + '</span>' ) ;
195195 }
196196 $ ( '#notification' ) . data ( 'oldName' , oldName ) ;
197197 $ ( '#notification' ) . data ( 'newName' , newName ) ;
@@ -272,9 +272,9 @@ var FileList={
272272 } else {
273273 // NOTE: Temporary fix to change the text to unshared for files in root of Shared folder
274274 if ( $ ( '#dir' ) . val ( ) == '/Shared' ) {
275- $ ( '#notification' ) . html ( t ( 'files' , 'unshared' ) + ' ' + files + '<span class="undo">' + t ( 'files' , 'undo' ) + '</span>' ) ;
275+ $ ( '#notification' ) . html ( t ( 'files' , 'unshared' ) + ' ' + escapeHTML ( files ) + '<span class="undo">' + t ( 'files' , 'undo' ) + '</span>' ) ;
276276 } else {
277- $ ( '#notification' ) . html ( t ( 'files' , 'deleted' ) + ' ' + files + '<span class="undo">' + t ( 'files' , 'undo' ) + '</span>' ) ;
277+ $ ( '#notification' ) . html ( t ( 'files' , 'deleted' ) + ' ' + escapeHTML ( files ) + '<span class="undo">' + t ( 'files' , 'undo' ) + '</span>' ) ;
278278 }
279279 $ ( '#notification' ) . fadeIn ( ) ;
280280 }
0 commit comments