fix(gui): properly escape filenames in fancytree

Signed-off-by: Jakob Borg <jakob@kastelo.net>
2026-06-04 14:58:28 -04:00 · 2026-06-02 16:54:21 +02:00
parent 9cdff04877
commit f93306c819
1 changed files with 3 additions and 0 deletions
--- a/gui/default/syncthing/core/syncthingController.js
+++ b/gui/default/syncthing/core/syncthingController.js
@@ -2997,6 +2997,9 @@ angular.module('syncthing.core')
                            $scope.restoreVersions.tree = $("#restoreTree").fancytree({
                                extensions: ["table", "filter", "glyph"],
                                quicksearch: true,
+                                // Node titles are remote-controlled file/path
+                                // components; render them as text, not HTML.
+                                escapeTitles: true,
                                filter: {
                                    hideExpanders: true,
                                    mode: "hide"