Escape album name select list in photo upload form

- Thanks to @apexrabbit for the report!

diff --git a/mod/photos.php b/mod/photos.php
index bef9d07205b7d8bf9926afa873722ba6106da2ce..32031e2714d52058f2ab5f5383d0466c52eadc8d 100644 (file)
--- a/mod/photos.php
+++ b/mod/photos.php
@@ -672,18 +672,14 @@ function photos_content(App $a)
 
                $selname = (!is_null($datum) && Strings::isHex($datum)) ? hex2bin($datum) : '';
 
-               $albumselect = '';
-
-               $albumselect .= '<option value="" ' . (!$selname ? ' selected="selected" ' : '') . '>&lt;current year&gt;</option>';
-               $albums = Photo::getAlbums($owner_uid);
-               if (!empty($albums)) {
-                       foreach ($albums as $album) {
-                               if ($album['album'] === '') {
-                                       continue;
-                               }
-                               $selected = (($selname === $album['album']) ? ' selected="selected" ' : '');
-                               $albumselect .= '<option value="' . $album['album'] . '"' . $selected . '>' . $album['album'] . '</option>';
+               $albumselect = ['' => '<current year>'];
+
+               foreach (Photo::getAlbums($owner_uid) as $album) {
+                       if ($album['album'] === '') {
+                               continue;
                        }
+
+                       $albumselect[$album['album']] = $album['album'];
                }
 
                $uploader = '';
@@ -729,6 +725,7 @@ function photos_content(App $a)
                        '$existalbumtext' => DI::l10n()->t('or select existing album:'),
                        '$nosharetext' => DI::l10n()->t('Do not show a status post for this upload'),
                        '$albumselect' => $albumselect,
+                       '$selname' => $selname,
                        '$permissions' => DI::l10n()->t('Permissions'),
                        '$aclselect' => $aclselect_e,
                        '$lockstate' => ACL::getLockstateForUserId($a->getLoggedInUserId()) ? 'lock' : 'unlock',

diff --git a/view/theme/frio/templates/photos_upload.tpl b/view/theme/frio/templates/photos_upload.tpl
index f6a84373dff9291f47de0c395756ecd13c6f1a74..172164f1ef041aa34601e486ac21211d6c8a68a0 100644 (file)
--- a/view/theme/frio/templates/photos_upload.tpl
+++ b/view/theme/frio/templates/photos_upload.tpl
@@ -9,7 +9,11 @@
                        <label id="photos-upload-text" for="photos-upload-newalbum">{{$newalbum}}</label>
 
                        <input id="photos-upload-album-select" class="form-control" placeholder="{{$existalbumtext}}" list="dl-photo-upload" type="text" name="album" size="4">
-                       <datalist id="dl-photo-upload">{{$albumselect  nofilter}}</datalist>
+                       <datalist id="dl-photo-upload">
+                               {{foreach $albumselect as $value => $name}}
+                                       <option value="{{$value}}"{{if $selname == $value}} selected{{/if}}>{{$name}}</option>
+                               {{/foreach}}
+                       </datalist>
                </div>
                <div id="photos-upload-end" class="clearfix"></div>