Clean file names before displaying metadata modal

getgrav · Jan 21, 2022 · 4e6e5c3 · 4e6e5c3
1 parent d610d6c
commit 4e6e5c3
Show file tree

Hide file tree

Showing 3 changed files with 12 additions and 6 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -7,6 +7,8 @@
    * Requires Grav `v1.7.27` and Login `v3.6.2`
 2. [](#improved)
    * Added new asset language strings
+3. [](#bugfix)
+   * Clean file names before displaying errors/metadata modals
 
 # v1.10.26.1
 ## 01/03/2022

diff --git a/themes/grav/app/pages/page/media.js b/themes/grav/app/pages/page/media.js
@@ -155,6 +155,7 @@ export default class PageMedia extends FilesField {
             const target = $(e.currentTarget);
             const file = target.parent('.dz-preview').find('.dz-filename');
             const filename = encodeURI(file.text());
+            const cleanName = file.text().replace('<', '&lt;').replace('>', '&gt;');
 
             let fileObj = this.dropzone.files.filter((file) => file.name === global.decodeURI(filename)).shift() || {};
 
@@ -163,22 +164,23 @@ export default class PageMedia extends FilesField {
             }
 
             if (Array.isArray(fileObj.extras.metadata) && !fileObj.extras.metadata.length) {
-                fileObj.extras.metadata = { '': `${global.decodeURI(filename)}.meta.yaml doesn't exist` };
+                fileObj.extras.metadata = { '': `${cleanName}.meta.yaml doesn't exist` };
             }
 
             fileObj = fileObj.extras;
 
             const modal_element = $('body').find('[data-remodal-id="metadata"]');
             const modal = $.remodal.lookup[modal_element.data('remodal')];
 
-            modal_element.find('h1 strong').html(filename);
+            modal_element.find('h1 strong').html(cleanName);
             if (fileObj.url) {
                 modal_element.find('.meta-preview').html(`<img src="${fileObj.url}" />`);
             }
 
             const container = modal_element.find('.meta-content').html('<ul />').find('ul');
             Object.keys(fileObj.metadata).forEach((meta) => {
-                container.append(`<li><strong>${meta ? meta + ':' : ''}</strong> ${fileObj.metadata[meta]}</li>`);
+                const cleanMeta = fileObj.metadata[meta].replace('<', '&lt;').replace('>', '&gt;');
+                container.append(`<li><strong>${meta ? meta + ':' : ''}</strong> ${cleanMeta}</li>`);
             });
 
             modal.open();

diff --git a/themes/grav/js/admin.min.js b/themes/grav/js/admin.min.js
@@ -4250,6 +4250,7 @@ var PageMedia = /*#__PURE__*/function (_FilesField) {
         var target = external_jQuery_default()(e.currentTarget);
         var file = target.parent('.dz-preview').find('.dz-filename');
         var filename = encodeURI(file.text());
+        var cleanName = file.text().replace('<', '&lt;').replace('>', '&gt;');
         var fileObj = _this3.dropzone.files.filter(function (file) {
           return file.name === __webpack_require__.g.decodeURI(filename);
         }).shift() || {};
@@ -4262,22 +4263,23 @@ var PageMedia = /*#__PURE__*/function (_FilesField) {
 
         if (Array.isArray(fileObj.extras.metadata) && !fileObj.extras.metadata.length) {
           fileObj.extras.metadata = {
-            '': "".concat(__webpack_require__.g.decodeURI(filename), ".meta.yaml doesn't exist")
+            '': "".concat(cleanName, ".meta.yaml doesn't exist")
           };
         }
 
         fileObj = fileObj.extras;
         var modal_element = external_jQuery_default()('body').find('[data-remodal-id="metadata"]');
         var modal = (external_jQuery_default()).remodal.lookup[modal_element.data('remodal')];
-        modal_element.find('h1 strong').html(filename);
+        modal_element.find('h1 strong').html(cleanName);
 
         if (fileObj.url) {
           modal_element.find('.meta-preview').html("<img src=\"".concat(fileObj.url, "\" />"));
         }
 
         var container = modal_element.find('.meta-content').html('<ul />').find('ul');
         Object.keys(fileObj.metadata).forEach(function (meta) {
-          container.append("<li><strong>".concat(meta ? meta + ':' : '', "</strong> ").concat(fileObj.metadata[meta], "</li>"));
+          var cleanMeta = fileObj.metadata[meta].replace('<', '&lt;').replace('>', '&gt;');
+          container.append("<li><strong>".concat(meta ? meta + ':' : '', "</strong> ").concat(cleanMeta, "</li>"));
         });
         modal.open();
       });