fix: Éviter de possibles XSS avec le nom des fichiers uploadés (en js)

(cherry picked from commit df7543f1)

javascript/bigup.js

@@ -190,18 +190,28 @@ function Bigup(params, opts, callbacks) {
 				var extension = $.trouver_extension(file.name);
 
 				var template =
-					'\n<div class="fichier">'
-					+ '\n\t<div class="description">'
-					+ '\n\t\t<div class="vignette_extension ' + extension + '" title="' + file.type + '"><span></span></div>'
-					+ '\n\t\t<div class="infos">'
-					+ '\n\t\t\t<span class="name"><strong>' + file.name + '</strong></span>'
-					+ '\n\t\t\t<span class="size">' + $.taille_en_octets(file.size) + '</span>'
-					+ '\n\t\t</div>'
-					+ '\n\t\t<div class="actions">'
-					+ '\n\t\t\t<span class="bigup-btn btn btn-default cancel" onClick="$.bigup_enlever_fichier(this); return false;">' + _T("bigup:bouton_annuler") + '</span>'
-					+ '\n\t\t</div>'
-					+ '\n\t</div>'
-					+ '\n</div>\n';
+					'\n<div class="fichier">' +
+					'\n\t<div class="description">' +
+					'\n\t\t<div class="vignette_extension ' +
+					$.escapeHtml(extension) +
+					'" title="' +
+					file.type +
+					'"><span></span></div>' +
+					'\n\t\t<div class="infos">' +
+					'\n\t\t\t<span class="name"><strong>' +
+					$.escapeHtml(file.name) +
+					'</strong></span>' +
+					'\n\t\t\t<span class="size">' +
+					$.taille_en_octets(file.size) +
+					'</span>' +
+					'\n\t\t</div>' +
+					'\n\t\t<div class="actions">' +
+					'\n\t\t\t<span class="bigup-btn btn btn-default cancel" onClick="$.bigup_enlever_fichier(this);">' +
+					_T('bigup:bouton_annuler') +
+					'</span>' +
+					'\n\t\t</div>' +
+					'\n\t</div>' +
+					'\n</div>\n';
 
 				return template;
 			}

javascript/bigup.utils.js

@@ -171,4 +171,14 @@ $.mime_type_image = function(extension) {
 			break;
 	}
 	return mime;
-};
+};
\ No newline at end of file
+
+/** Escape HTML */
+$.escapeHtml = function(unsafe) {
+	return unsafe
+		.replaceAll('&', '&')
+		.replaceAll('<', '&lt;')
+		.replaceAll('>', '&gt;')
+		.replaceAll('"', '&quot;')
+		.replaceAll("'", '&#039;');
+}