diff --git a/emhttp/plugins/dynamix/Browse.page b/emhttp/plugins/dynamix/Browse.page index 7b0cc9e6a..774dbc49c 100644 --- a/emhttp/plugins/dynamix/Browse.page +++ b/emhttp/plugins/dynamix/Browse.page @@ -28,9 +28,11 @@ function validdir($dir) { return in_array(explode('/', $path)[1] ?? '', ['mnt','boot']) ? $path : ''; } -$dir = validdir(htmlspecialchars_decode($dir)); +$dir = validdir(rawurldecode($dir)); [$none,$root,$main,$next,$rest] = my_explode('/', $dir,5); -$dir = htmlspecialchars(str_replace('\\','\\\\', $dir)); +// For JavaScript context: json_encode() properly escapes quotes, backslashes, newlines, etc. +// JSON_UNESCAPED_SLASHES keeps paths readable, JSON_UNESCAPED_UNICODE preserves UTF-8 +$dir_js = json_encode($dir, JSON_UNESCAPED_SLASHES | JSON_UNESCAPED_UNICODE); $lock = $root == 'mnt' ? ($main ?: '---') : ($root == 'boot' ? _('flash') : '---'); $isshare = $root == 'mnt' && (!$main || !$next || ($main == 'rootshare' && !$rest)); $editor = '/boot/config/editor.cfg'; @@ -44,7 +46,7 @@ if (!file_exists($editor)) file_put_contents($editor, implode("\n",['','txt','js