Version 4.7.0

applications/core/interface/plupload/jquery.ui.plupload/jquery.ui.plupload.js

@@ -491,7 +491,7 @@ $.widget("ui.plupload", {
 					break;
 			}
 
-			message += " <br /><i>" + details + "</i>";
+			message += " <br /><i>" + plupload.xmlEncode(details) + "</i>";
 
 			self._trigger('error', null, { up: up, error: err } );
 
@@ -902,6 +902,9 @@ $.widget("ui.plupload", {
 			$('.ui-button-text', this.browse_button).html(plupload.sprintf(_('%d files queued'), up.total.queued));
 		}
 
+		// have a helper class on a container expressing whether it has files queued or not
+		this.container.toggleClass('plupload_files_queued', up.files.length);
+
 		up.refresh();
 	},
 
@@ -1164,7 +1167,7 @@ $.widget("ui.plupload", {
 						return ext;
 
 					default:
-						return file[$1] || '';
+						return plupload.xmlEncode(file[$1] || '');
 				}
 			});
 		});
@@ -1310,7 +1313,7 @@ $.widget("ui.plupload", {
 					// Rename file and glue extension back on
 					if (e.keyCode === 13) {
 						file.name = nameInput.val() + ext;
-						nameSpan.html(file.name);
+						nameSpan.text(file.name);
 					}
 					nameInput.blur();
 				}