Escape filenames to not break HTML views

[jirafeau.git] / lib / functions.php

diff --git a/lib/functions.php b/lib/functions.php
index 18002314ca841697eb58a6e8c230eee5744d9726..0f42e217d7ba380c16e1940333fa85807fcd415e 100644 (file)
--- a/lib/functions.php
+++ b/lib/functions.php
@@ -614,7 +614,7 @@ jirafeau_admin_list ($name, $file_hash, $link_hash)
                     continue;
 
                 /* Filter. */
                     continue;
 
                 /* Filter. */

-                if (!empty ($name) && !preg_match ("/$name/i", $l['file_name']))
+                if (!empty ($name) && !preg_match ("/$name/i", htmlspecialchars($l['file_name'])))

                     continue;
                 if (!empty ($file_hash) && $file_hash != $l['md5'])
                     continue;
                     continue;
                 if (!empty ($file_hash) && $file_hash != $l['md5'])
                     continue;


@@ -626,7 +626,7 @@ jirafeau_admin_list ($name, $file_hash, $link_hash)
                 '<form action = "admin.php" method = "post">' .
                 '<input type = "hidden" name = "action" value = "download"/>' .
                 '<input type = "hidden" name = "link" value = "' . $node . '"/>' .
                 '<form action = "admin.php" method = "post">' .
                 '<input type = "hidden" name = "action" value = "download"/>' .
                 '<input type = "hidden" name = "link" value = "' . $node . '"/>' .

-                '<input type = "submit" value = "' . $l['file_name'] . '" />' .
+                '<input type = "submit" value = "' . htmlspecialchars($l['file_name']) . '" />' .

                 '</form>';
                 echo '</td>';
                 echo '<td>' . $l['mime_type'] . '</td>';
                 '</form>';
                 echo '</td>';
                 echo '<td>' . $l['mime_type'] . '</td>';