From 8a4ac533e5cd6b8f92e9ef19fbfbb2f505dc7a9a Mon Sep 17 00:00:00 2001
From: Samuel Georges <sam@daftspunk.com>
Date: Wed, 22 Jul 2015 17:52:02 +1000
Subject: [PATCH] Escape file title - Fixes #1302

---
 modules/backend/formwidgets/fileupload/partials/_file_multi.htm | 2 +-
 .../backend/formwidgets/fileupload/partials/_file_single.htm    | 2 +-
 .../backend/formwidgets/fileupload/partials/_image_multi.htm    | 2 +-
 .../backend/formwidgets/fileupload/partials/_image_single.htm   | 2 +-
 4 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/modules/backend/formwidgets/fileupload/partials/_file_multi.htm b/modules/backend/formwidgets/fileupload/partials/_file_multi.htm
index 7b062ad00..f4baf3050 100644
--- a/modules/backend/formwidgets/fileupload/partials/_file_multi.htm
+++ b/modules/backend/formwidgets/fileupload/partials/_file_multi.htm
@@ -24,7 +24,7 @@
                 </div>
                 <div class="info">
                     <h4 class="filename">
-                        <span data-dz-name><?= $file->title ?: $file->file_name ?></span>
+                        <span data-dz-name><?= e($file->title ?: $file->file_name) ?></span>
                         <a
                             href="javascript:;"
                             class="upload-remove-button"
diff --git a/modules/backend/formwidgets/fileupload/partials/_file_single.htm b/modules/backend/formwidgets/fileupload/partials/_file_single.htm
index 8830773c8..ecc7225c2 100644
--- a/modules/backend/formwidgets/fileupload/partials/_file_single.htm
+++ b/modules/backend/formwidgets/fileupload/partials/_file_single.htm
@@ -23,7 +23,7 @@
                 </div>
                 <div class="info">
                     <h4 class="filename">
-                        <span data-dz-name><?= $singleFile->title ?: $singleFile->file_name ?></span>
+                        <span data-dz-name><?= e($singleFile->title ?: $singleFile->file_name) ?></span>
                     </h4>
                     <p class="size"><?= e($singleFile->sizeToString()) ?></p>
                 </div>
diff --git a/modules/backend/formwidgets/fileupload/partials/_image_multi.htm b/modules/backend/formwidgets/fileupload/partials/_image_multi.htm
index 27001789d..5b9e76f00 100644
--- a/modules/backend/formwidgets/fileupload/partials/_image_multi.htm
+++ b/modules/backend/formwidgets/fileupload/partials/_image_multi.htm
@@ -24,7 +24,7 @@
                 </div>
                 <div class="info">
                     <h4 class="filename">
-                        <span data-dz-name><?= $file->title ?: $file->file_name ?></span>
+                        <span data-dz-name><?= e($file->title ?: $file->file_name) ?></span>
                         <a
                             href="javascript:;"
                             class="upload-remove-button"
diff --git a/modules/backend/formwidgets/fileupload/partials/_image_single.htm b/modules/backend/formwidgets/fileupload/partials/_image_single.htm
index 7b62c194c..78f88bd8c 100644
--- a/modules/backend/formwidgets/fileupload/partials/_image_single.htm
+++ b/modules/backend/formwidgets/fileupload/partials/_image_single.htm
@@ -28,7 +28,7 @@
                 </div>
                 <div class="info">
                     <h4 class="filename">
-                        <span data-dz-name><?= $singleFile->title ?: $singleFile->file_name ?></span>
+                        <span data-dz-name><?= e($singleFile->title ?: $singleFile->file_name) ?></span>
                         <a
                             href="javascript:;"
                             class="upload-remove-button"