[BUGFIX] Fix mime_type escaping

[jirafeau.git] / lib / functions.php

diff --git a/lib/functions.php b/lib/functions.php
index eaedfac321ef27a93a8b3ce2c23044430ec449d5..3a50eac828cc42fa58cb46e6c53d910371dbd3eb 100644 (file)
--- a/lib/functions.php
+++ b/lib/functions.php
@@ -597,7 +597,7 @@ function jirafeau_admin_list($name, $file_hash, $link_hash)
                 }
 
                 /* Filter. */
-                if (!empty($name) && !preg_match("/$name/i", htmlspecialchars($l['file_name']))) {
+                if (!empty($name) && !preg_match("/$name/i", jirafeau_escape($l['file_name']))) {
                     continue;
                 }
                 if (!empty($file_hash) && $file_hash != $l['md5']) {
@@ -609,10 +609,10 @@ function jirafeau_admin_list($name, $file_hash, $link_hash)
                 /* Print link informations. */
                 echo '<tr>';
                 echo '<td>' .
-                '<strong><a id="upload_link" href="f.php?h='. htmlspecialchars($node) .'" title="' .
-                    t('DL_PAGE') . '">' . htmlspecialchars($l['file_name']) . '</a></strong>';
+                '<strong><a id="upload_link" href="f.php?h='. jirafeau_escape($node) .'" title="' .
+                    t('DL_PAGE') . '">' . jirafeau_escape($l['file_name']) . '</a></strong>';
                 echo '</td>';
-                echo '<td>' . $l['mime_type'] . '</td>';
+                echo '<td>' . jirafeau_escape($l['mime_type']) . '</td>';
                 echo '<td>' . jirafeau_human_size($l['file_size']) . '</td>';
                 echo '<td>' . ($l['time'] == -1 ? '∞' : jirafeau_get_datetimefield($l['time'])) . '</td>';
                 echo '<td>';
@@ -1243,3 +1243,8 @@ function jirafeau_replace_markers($content, $htmllinebreaks = false)
 
     return $content;
 }
+
+function jirafeau_escape($string)
+{
+    return htmlspecialchars($string, ENT_QUOTES);
+}