From cd81687a38c4f46c6665e640a352ba7adcd1f243 Mon Sep 17 00:00:00 2001
From: Jan-Christoph Borchardt <hey@jancborchardt.net>
Date: Thu, 18 Dec 2014 17:19:23 +0100
Subject: [PATCH] properly escape variable

---
 apps/files/js/file-upload.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/apps/files/js/file-upload.js b/apps/files/js/file-upload.js
index a67a3598820..c8b3a150caa 100644
--- a/apps/files/js/file-upload.js
+++ b/apps/files/js/file-upload.js
@@ -579,7 +579,7 @@ OC.Upload = {
 				input.val(newName);
 				input.attr('id', fileType);
 			}
-			var label = $('<label class="hidden-visually" for="">' + newName + '</label>');
+			var label = $('<label class="hidden-visually" for="">' + escapeHTML(newName) + '</label>');
 			label.attr('for', fileType);
 
 			form.append(label).append(input);