Fix the HTML encoding when uploading a folder in FF when using french…

[nickvergessen]

… l10n

Fix #459

Please review @tflidd

[tflidd]

That was a quick fix. Thank you, it works perfectly.
👍

[LukasReschke]

I got to say that I consider this a kinda risky chance. While data.errorThrown may right now not echo back user controlled input this has still the potential to do bad things in the future… 🙈

[LukasReschke]

Can we do that at

server/apps/files/js/file-upload.js

Lines 357 to 360 in 45c99c2

	data.errorThrown = t('files',
	'Unable to upload {filename} as it is a directory or has 0 bytes',
	{filename: file.name}
	);

? Then we prevent the double escaping and don't introduce a XSS by mistake. :)

[nickvergessen]

The file name is already escaped there, it is also escaped here.
The problem is, that the actual translation contains the ', and when using that string here as a parameter in the translation, it is html encoded and displayes as &#...;. So not sure how this could be fixed on the other place, if this place breaks it.

[LukasReschke]

Simply unescape

server/apps/files/js/file-upload.js

Lines 357 to 360 in 45c99c2

	data.errorThrown = t('files',
	'Unable to upload {filename} as it is a directory or has 0 bytes',
	{filename: file.name}
	);

? Then the escaping here will take care of it, or do I miss something?

[LukasReschke]

Aha… Gotcha now… Let me think…

[nickvergessen]

unescape what? the unescape option only affects parameters, but the parameter is not the problem. Also the value in data.errorThrown here is not a problem, it's still what we would display in the UI. It's the t() method here, which takes the translated string as an argument and thereby s/'/&#..; the first translation. TO avoid this I removed escaping from all parameters and only escaped the file name, since the string here is only translator controlled, not user controlled, we can and have to trust it anyway....

[LukasReschke]

Ok. You're right. This is also properly escaped all since we don't use showHTML. (so even when passing HTML strings this shouldn't be rendered as HTML anyways)

[LukasReschke]

👍

[MorrisJobke]

@nickvergessen @LukasReschke Backport?