From: Lukas Reschke <lukas@statuscode.ch>
Date: Wed, 11 Jul 2012 17:14:04 +0000 (+0200)
Subject: Sanitizing file names
X-Git-Tag: v4.0.5~18
X-Git-Url: https://source.dussan.org/?a=commitdiff_plain;h=d203fa2c50f4b2791e68e2b8ab9a0f8b94f9c9f8;p=nextcloud-server.git

Sanitizing file names
---

diff --git a/apps/files/js/filelist.js b/apps/files/js/filelist.js
index e6a9a6883af..3645258f98f 100644
--- a/apps/files/js/filelist.js
+++ b/apps/files/js/filelist.js
@@ -14,7 +14,7 @@ FileList={
 			var extension=false;
 		}
 		html+='<td class="filename" style="background-image:url('+img+')"><input type="checkbox" />';
-		html+='<a class="name" href="download.php?file='+$('#dir').val()+'/'+name+'"><span class="nametext">'+basename
+		html+='<a class="name" href="download.php?file='+$('#dir').val().replace(/</, '&lt;').replace(/>/, '&gt;')+'/'+name+'"><span class="nametext">'+basename
 		if(extension){
 			html+='<span class="extension">'+extension+'</span>';
 		}