Files containing a single quote in the name upload ok and get thumbnailed ok.
But when you click on a thumbnail, the popup doesn't shows.
I've found the problem in a lacking of escaping the file name, but I'm not sure if to use htmlspecialchars() or I should resort to some other (Drupal API friendly) function, but I'm a bit of lost in the Drupal API.
Plz, someone tell me and I'll be more than glad to fix and commit a patch.
Also, if some developer is reading I think it will be a 2 min fix, so feel free to go ahead, since I'm not too familiar with the commiting process :)
Thank you.

Comments

amontero’s picture

amontero
Location Barcelona
commented

I've fixed it temporarily by adding an addslashes() call when the JS code is generated.

andypost’s picture

andypost
he/him
Primary language Russian
commented

I think it's better to setup md5-filenames
or change $file->filename = preg_replace('/[ \'"]+/', '_', $file->filename);