Sanitize filename in import message

Signed-off-by: Michal Čihař <michal@cihar.com>

import.php

@@ -568,9 +568,9 @@
             $message->addString($import_notice);
         }
         if (isset($local_import_file)) {
-            $message->addString('(' . $local_import_file . ')');
+            $message->addString('(' . htmlspecialchars($local_import_file) . ')');
         } else {
-            $message->addString('(' . $_FILES['import_file']['name'] . ')');
+            $message->addString('(' . htmlspecialchars($_FILES['import_file']['name']) . ')');
         }
     }
 }