From 3f52968fdb678e3596fd0f43d7726107ce2cb43d Mon Sep 17 00:00:00 2001
From: meteogrid <marcos@meteogrid.com>
Date: Tue, 14 Mar 2023 13:43:17 +0000
Subject: [PATCH] escapes filename for url

---
 .../templates/filebrowser/include/filelisting.html          | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/filebrowser_safe/templates/filebrowser/include/filelisting.html b/filebrowser_safe/templates/filebrowser/include/filelisting.html
index 7e73aad..8cd9040 100644
--- a/filebrowser_safe/templates/filebrowser/include/filelisting.html
+++ b/filebrowser_safe/templates/filebrowser/include/filelisting.html
@@ -86,7 +86,7 @@
 
     <!-- RENAME -->
     {% if query.pop != '4' %}
-    <td class="fb_icon"><a href="{% url "fb_rename" %}{% query_string %}&amp;filename={{ file.filename }}" class="fb_renamelink" title="{% trans 'Rename' %}"></a></td>
+    <td class="fb_icon"><a href="{% url "fb_rename" %}{% query_string %}&amp;filename={{ file.filename | urlencode }}" class="fb_renamelink" title="{% trans 'Rename' %}"></a></td>
     {% endif %}
 
     <!-- SIZE -->
@@ -98,10 +98,10 @@
     <!-- DELETE -->
     <td class="fb_icon">
         {% if file.filetype != 'Folder' %}
-        <form method="POST" action="{% url "fb_delete" %}{% query_string %}&amp;filename={{ file.filename }}&amp;filetype={{ file.filetype }}" id="delete-{{ forloop.counter0 }}">{% csrf_token %}</form>
+        <form method="POST" action="{% url "fb_delete" %}{% query_string %}&amp;filename={{ file.filename | urlencode }}&amp;filetype={{ file.filetype }}" id="delete-{{ forloop.counter0 }}">{% csrf_token %}</form>
         <a href="#" class="fb_deletelink" onclick="if (confirm('{% trans "Are you sure you want to delete this file?" %}')) {jQuery('#delete-{{ forloop.counter0 }}').submit();} return false;" title="{% trans 'Delete File' %}"></a>
         {% else %}
-        <form method="POST" action="{% url "fb_delete" %}{% query_string %}&amp;filename={{ file.filename }}&amp;filetype={{ file.filetype }}" id="delete-{{ forloop.counter0 }}">{% csrf_token %}</form>
+        <form method="POST" action="{% url "fb_delete" %}{% query_string %}&amp;filename={{ file.filename | urlencode }}&amp;filetype={{ file.filetype }}" id="delete-{{ forloop.counter0 }}">{% csrf_token %}</form>
         <a href="#" class="fb_deletelink" onclick="if (confirm('{% trans "Are you sure you want to delete this Folder?" %}')) {jQuery('#delete-{{ forloop.counter0 }}').submit();} return false;" title="{% trans 'Delete Folder' %}"></a>
         {% endif %}
     </td>