From 4e6e5c37b81a163d74edc5be2989c55b945e1e5a Mon Sep 17 00:00:00 2001
From: Djamil Legato <djamil@djamil.it>
Date: Fri, 21 Jan 2022 15:47:51 -0800
Subject: [PATCH] Clean file names before displaying metadata modal

---
 CHANGELOG.md                        | 2 ++
 themes/grav/app/pages/page/media.js | 8 +++++---
 themes/grav/js/admin.min.js         | 8 +++++---
 3 files changed, 12 insertions(+), 6 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 984e0cc70..9dd954462 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,8 @@
    * Requires Grav `v1.7.27` and Login `v3.6.2`
 2. [](#improved)
    * Added new asset language strings
+3. [](#bugfix)
+   * Clean file names before displaying errors/metadata modals
 
 # v1.10.26.1
 ## 01/03/2022
diff --git a/themes/grav/app/pages/page/media.js b/themes/grav/app/pages/page/media.js
index 832b7edaf..7fe50f58f 100644
--- a/themes/grav/app/pages/page/media.js
+++ b/themes/grav/app/pages/page/media.js
@@ -155,6 +155,7 @@ export default class PageMedia extends FilesField {
             const target = $(e.currentTarget);
             const file = target.parent('.dz-preview').find('.dz-filename');
             const filename = encodeURI(file.text());
+            const cleanName = file.text().replace('<', '&lt;').replace('>', '&gt;');
 
             let fileObj = this.dropzone.files.filter((file) => file.name === global.decodeURI(filename)).shift() || {};
 
@@ -163,7 +164,7 @@ export default class PageMedia extends FilesField {
             }
 
             if (Array.isArray(fileObj.extras.metadata) && !fileObj.extras.metadata.length) {
-                fileObj.extras.metadata = { '': `${global.decodeURI(filename)}.meta.yaml doesn't exist` };
+                fileObj.extras.metadata = { '': `${cleanName}.meta.yaml doesn't exist` };
             }
 
             fileObj = fileObj.extras;
@@ -171,14 +172,15 @@ export default class PageMedia extends FilesField {
             const modal_element = $('body').find('[data-remodal-id="metadata"]');
             const modal = $.remodal.lookup[modal_element.data('remodal')];
 
-            modal_element.find('h1 strong').html(filename);
+            modal_element.find('h1 strong').html(cleanName);
             if (fileObj.url) {
                 modal_element.find('.meta-preview').html(`<img src="${fileObj.url}" />`);
             }
 
             const container = modal_element.find('.meta-content').html('<ul />').find('ul');
             Object.keys(fileObj.metadata).forEach((meta) => {
-                container.append(`<li><strong>${meta ? meta + ':' : ''}</strong> ${fileObj.metadata[meta]}</li>`);
+                const cleanMeta = fileObj.metadata[meta].replace('<', '&lt;').replace('>', '&gt;');
+                container.append(`<li><strong>${meta ? meta + ':' : ''}</strong> ${cleanMeta}</li>`);
             });
 
             modal.open();
diff --git a/themes/grav/js/admin.min.js b/themes/grav/js/admin.min.js
index db42e9752..1bd8992fc 100644
--- a/themes/grav/js/admin.min.js
+++ b/themes/grav/js/admin.min.js
@@ -4250,6 +4250,7 @@ var PageMedia = /*#__PURE__*/function (_FilesField) {
         var target = external_jQuery_default()(e.currentTarget);
         var file = target.parent('.dz-preview').find('.dz-filename');
         var filename = encodeURI(file.text());
+        var cleanName = file.text().replace('<', '&lt;').replace('>', '&gt;');
         var fileObj = _this3.dropzone.files.filter(function (file) {
           return file.name === __webpack_require__.g.decodeURI(filename);
         }).shift() || {};
@@ -4262,14 +4263,14 @@ var PageMedia = /*#__PURE__*/function (_FilesField) {
 
         if (Array.isArray(fileObj.extras.metadata) && !fileObj.extras.metadata.length) {
           fileObj.extras.metadata = {
-            '': "".concat(__webpack_require__.g.decodeURI(filename), ".meta.yaml doesn't exist")
+            '': "".concat(cleanName, ".meta.yaml doesn't exist")
           };
         }
 
         fileObj = fileObj.extras;
         var modal_element = external_jQuery_default()('body').find('[data-remodal-id="metadata"]');
         var modal = (external_jQuery_default()).remodal.lookup[modal_element.data('remodal')];
-        modal_element.find('h1 strong').html(filename);
+        modal_element.find('h1 strong').html(cleanName);
 
         if (fileObj.url) {
           modal_element.find('.meta-preview').html("<img src=\"".concat(fileObj.url, "\" />"));
@@ -4277,7 +4278,8 @@ var PageMedia = /*#__PURE__*/function (_FilesField) {
 
         var container = modal_element.find('.meta-content').html('<ul />').find('ul');
         Object.keys(fileObj.metadata).forEach(function (meta) {
-          container.append("<li><strong>".concat(meta ? meta + ':' : '', "</strong> ").concat(fileObj.metadata[meta], "</li>"));
+          var cleanMeta = fileObj.metadata[meta].replace('<', '&lt;').replace('>', '&gt;');
+          container.append("<li><strong>".concat(meta ? meta + ':' : '', "</strong> ").concat(cleanMeta, "</li>"));
         });
         modal.open();
       });