From c3469bd5453874cc813bbf24e46c86979eea6f7e Mon Sep 17 00:00:00 2001
From: n1474335 <n1474335@gmail.com>
Date: Tue, 27 Jun 2017 14:04:30 +0000
Subject: [PATCH] Correctly escape filenames in displayFilesAsHTML

---
 src/core/Utils.js | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/core/Utils.js b/src/core/Utils.js
index d8e91619..64d536cc 100755
--- a/src/core/Utils.js
+++ b/src/core/Utils.js
@@ -945,12 +945,12 @@ const Utils = {
      * @param {Object[]} files
      * @returns {html}
      */
-    displayFilesAsHTML: function(files){
+    displayFilesAsHTML: function(files) {
         const formatDirectory = function(file) {
             const html = "<div class='panel panel-default'>" +
                    "<div class='panel-heading' role='tab'>" +
                    "<h4 class='panel-title'>" +
-                   file.fileName +
+                   Utils.escapeHtml(file.fileName) +
                    // The following line is for formatting when HTML is stripped
                    "<span style='display: none'>\n0 bytes\n</span>" +
                    "</h4>" +