Merge pull request #3278 from dannon/upload_escape_filename

[16.10] Escape filename in upload dialog, default and composite.

client/galaxy/scripts/mvc/upload/composite/composite-row.js

@@ -115,7 +115,7 @@ function( Utils, UploadSettings, UploadFtp, Popover, Ui, Select ) {
 
         render: function() {
             this.$el.attr( 'id', 'upload-row-' + this.model.id );
-            this.$file_name.html( this.model.get( 'file_name' ) || '-' );
+            this.$file_name.html( _.escape( this.model.get( 'file_name' ) || '-' ) );
             this.$file_desc.html( this.model.get( 'file_desc' ) || 'Unavailable' );
             this.$file_size.html( Utils.bytesToString ( this.model.get( 'file_size' ) ) );
             this.$status.removeClass().addClass( this.status_classes.init );

client/galaxy/scripts/mvc/upload/default/default-row.js

@@ -95,7 +95,7 @@ function( Utils, UploadModel, UploadSettings, Popover, Select ) {
 
         render: function() {
             var options = this.model.attributes;
-            this.$title.html( options.file_name );
+            this.$title.html( _.escape( options.file_name ) );
             this.$size.html( Utils.bytesToString ( options.file_size ) );
             this.$mode.removeClass().addClass( 'upload-mode' ).addClass( 'text-primary' );
             if ( options.file_mode == 'new' ) {
@@ -120,7 +120,7 @@ function( Utils, UploadModel, UploadSettings, Popover, Select ) {
         _refreshExtension: function() {
             this.select_extension.value( this.model.get( 'extension' ) );
         },
-        
+
         /** Update genome */
         _refreshGenome: function() {
             this.select_genome.value( this.model.get( 'genome' ) );