properly escape variable

12 years ago · cd81687a38
parent 96ae18db59
commit cd81687a38
1 changed files with 1 additions and 1 deletions
--- a/apps/files/js/file-upload.js
+++ b/apps/files/js/file-upload.js
@ -579,7 +579,7 @@ OC.Upload = {
 				input.val(newName);
 				input.attr('id', fileType);
 			}
-			var label = $('<label class="hidden-visually" for="">' + newName + '</label>');
+			var label = $('<label class="hidden-visually" for="">' + escapeHTML(newName) + '</label>');
 			label.attr('for', fileType);

 			form.append(label).append(input);