Correctly escape filenames in displayFilesAsHTML

2017-06-27 14:04:30 +00:00 · 2017-06-27 14:04:30 +00:00 · c3469bd545
parent 92018b761d
commit c3469bd545
1 changed files with 2 additions and 2 deletions
--- a/src/core/Utils.js
+++ b/src/core/Utils.js
@ -950,7 +950,7 @@ const Utils = {
            const html = "<div class='panel panel-default'>" +
                   "<div class='panel-heading' role='tab'>" +
                   "<h4 class='panel-title'>" +
-                   file.fileName +
+                   Utils.escapeHtml(file.fileName) +
                   // The following line is for formatting when HTML is stripped
                   "<span style='display: none'>\n0 bytes\n</span>" +
                   "</h4>" +