From: dongsheng <dongsheng>
Date: Wed, 14 May 2008 05:22:53 +0000 (+0000)
Subject: "MDL-14820, escape filename, merged from mOODLE_119_STABLE"
X-Git-Url: http://git.mjollnir.org/gw?a=commitdiff_plain;h=320061de60ccc7c9f9d4ab192809620220ce69cd;p=moodle.git

"MDL-14820, escape filename, merged from mOODLE_119_STABLE"
---

diff --git a/files/index.php b/files/index.php
index 3ff0190c7b..8e3ec42920 100644
--- a/files/index.php
+++ b/files/index.php
@@ -667,7 +667,7 @@ function printfilelist($filelist) {
 
     foreach ($filelist as $file) {
         if (is_dir($basedir.'/'.$file)) {
-            echo "<img src=\"$CFG->pixpath/f/folder.gif\" class=\"icon\" alt=\"$strfolder\" /> $file<br />";
+            echo '<img src="'. $CFG->pixpath .'/f/folder.gif" class="icon" alt="'. $strfolder .'" /> '. htmlspecialchars($file) .'<br />';
             $subfilelist = array();
             $currdir = opendir($basedir.'/'.$file);
             while (false !== ($subfile = readdir($currdir))) {
@@ -679,7 +679,7 @@ function printfilelist($filelist) {
 
         } else {
             $icon = mimeinfo("icon", $file);
-            echo "<img src=\"$CFG->pixpath/f/$icon\"  class=\"icon\" alt=\"$strfile\" /> $file<br />";
+            echo '<img src="'. $CFG->pixpath .'/f/'. $icon .'" class="icon" alt="'. $strfile .'" /> '. htmlspecialchars($file) .'<br />';
         }
     }
 }