From 68ba5a5c4abaaaed6d7693994a451692da6e6070 Mon Sep 17 00:00:00 2001
From: Sebastien DOIDO <sebdoido@users.noreply.github.com>
Date: Mon, 24 Apr 2017 15:03:29 +0200
Subject: [PATCH 1/2] Improve french translation: Campaign.json +
 MassEmail.json (#517)

---
 .../Espo/Modules/Crm/Resources/i18n/fr_FR/MassEmail.json    | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/application/Espo/Modules/Crm/Resources/i18n/fr_FR/MassEmail.json b/application/Espo/Modules/Crm/Resources/i18n/fr_FR/MassEmail.json
index 624bf2772d..3c7b183423 100644
--- a/application/Espo/Modules/Crm/Resources/i18n/fr_FR/MassEmail.json
+++ b/application/Espo/Modules/Crm/Resources/i18n/fr_FR/MassEmail.json
@@ -7,7 +7,7 @@
     "fromAddress": "Adresse de l’émetteur",
     "fromName": "Nom de l'expéditeur",
     "replyToAddress": "Addresse de réponse",
-    "replyToName": "Reply-to Name",
+    "replyToName": "Nom pour répondre",
     "campaign": "Campagne",
     "emailTemplate": "Modèle d'email",
     "inboundEmail": "Compte email",
@@ -39,7 +39,7 @@
   },
   "messages": {
     "selectAtLeastOneTarget": "Sélectionner au moins une cible",
-    "testSent": "Test email(s) supposed to be sent"
+    "testSent": "Le message de test est supposé être envoyé"
   },
   "tooltips": {
     "optOutEntirely": "Email addresses of recipients that unsubscribed will be marked as opted out and they will not receive any mass emails anymore.",
@@ -50,4 +50,4 @@
     "actual": "Actual",
     "complete": "Complete"
   }
-}
\ No newline at end of file
+}

From 9460943ad2214cb650cacc37fa7deb28abb658ba Mon Sep 17 00:00:00 2001
From: yuri <yurikuzn@users.noreply.github.com>
Date: Thu, 27 Apr 2017 11:33:22 +0300
Subject: [PATCH 2/2] escaping fix

---
 client/src/views/fields/attachment-multiple.js | 6 +++++-
 client/src/views/fields/file.js                | 6 +++++-
 client/src/views/modals/detail.js              | 2 +-
 3 files changed, 11 insertions(+), 3 deletions(-)

diff --git a/client/src/views/fields/attachment-multiple.js b/client/src/views/fields/attachment-multiple.js
index 984ca86635..9f88f4ab37 100644
--- a/client/src/views/fields/attachment-multiple.js
+++ b/client/src/views/fields/attachment-multiple.js
@@ -252,6 +252,8 @@ Espo.define('views/fields/attachment-multiple', 'views/fields/base', function (D
         },
 
         getEditPreview: function (name, type, id) {
+            name = Handlebars.Utils.escapeExpression(name);
+
             var preview = name;
 
             switch (type) {
@@ -411,6 +413,8 @@ Espo.define('views/fields/attachment-multiple', 'views/fields/base', function (D
         },
 
         getDetailPreview: function (name, type, id) {
+            name = Handlebars.Utils.escapeExpression(name);
+
             var preview = name;
 
             if (this.isTypeIsImage(type)) {
@@ -433,7 +437,7 @@ Espo.define('views/fields/attachment-multiple', 'views/fields/base', function (D
                         previews.push('<div class="attachment-preview">' + this.getDetailPreview(name, type, id) + '</div>');
                         continue;
                     }
-                    var line = '<div class="attachment-block"><span class="glyphicon glyphicon-paperclip small"></span> <a href="' + this.getDownloadUrl(id) + '" target="_BLANK">' + name + '</a></div>';
+                    var line = '<div class="attachment-block"><span class="glyphicon glyphicon-paperclip small"></span> <a href="' + this.getDownloadUrl(id) + '" target="_BLANK">' + Handlebars.Utils.escapeExpression(name); + '</a></div>';
                     names.push(line);
                 }
                 var string = previews.join('') + names.join('');
diff --git a/client/src/views/fields/file.js b/client/src/views/fields/file.js
index 5e06c8ca53..91d27e5fc8 100644
--- a/client/src/views/fields/file.js
+++ b/client/src/views/fields/file.js
@@ -187,6 +187,7 @@ Espo.define('views/fields/file', 'views/fields/link', function (Dep) {
         },
 
         getDetailPreview: function (name, type, id) {
+            name = Handlebars.Utils.escapeExpression(name);
             var preview = name;
 
             switch (type) {
@@ -199,6 +200,7 @@ Espo.define('views/fields/file', 'views/fields/link', function (Dep) {
         },
 
         getEditPreview: function (name, type, id) {
+            name = Handlebars.Utils.escapeExpression(name);
             var preview = name;
 
             switch (type) {
@@ -226,7 +228,7 @@ Espo.define('views/fields/file', 'views/fields/link', function (Dep) {
                 if (this.showPreview && ~this.previewTypeList.indexOf(type)) {
                     string = '<div class="attachment-preview">' + this.getDetailPreview(name, type, id) + '</div>';
                 } else {
-                    string = '<span class="glyphicon glyphicon-paperclip small"></span> <a href="'+ this.getDownloadUrl(id) +'" target="_BLANK">' + name + '</a>';
+                    string = '<span class="glyphicon glyphicon-paperclip small"></span> <a href="'+ this.getDownloadUrl(id) +'" target="_BLANK">' + Handlebars.Utils.escapeExpression(name) + '</a>';
                 }
                 return string;
             }
@@ -333,6 +335,8 @@ Espo.define('views/fields/file', 'views/fields/link', function (Dep) {
         addAttachmentBox: function (name, type, id) {
             this.$attachment.empty();
 
+            name = Handlebars.Utils.escapeExpression(name);
+
             var self = this;
 
             var removeLink = '<a href="javascript:" class="remove-attachment pull-right"><span class="glyphicon glyphicon-remove"></span></a>';
diff --git a/client/src/views/modals/detail.js b/client/src/views/modals/detail.js
index 51a42431e8..691423ec27 100644
--- a/client/src/views/modals/detail.js
+++ b/client/src/views/modals/detail.js
@@ -185,7 +185,7 @@ Espo.define('views/modals/detail', 'views/modal', function (Dep) {
             this.header = this.getLanguage().translate(scope, 'scopeNames');
 
             if (model.get('name')) {
-                this.header += ' &raquo; ' + model.get('name');
+                this.header += ' &raquo; ' + Handlebars.Utils.escapeExpression(model.get('name'));
             }
             if (!this.fullFormDisabled) {
                 this.header = '<a href="#' + scope + '/view/' + this.id+'" class="action" title="'+this.translate('Full Form')+'" data-action="fullForm">' + this.header + '</a>';