From abc1fa936e12de13bd9413148f02bba5476a1645 Mon Sep 17 00:00:00 2001 From: Rello Date: Mon, 5 Jan 2026 20:01:09 +0700 Subject: [PATCH 1/9] Escaping various strings Escaping various strings Signed-off-by: Matthieu Gallien --- src/gui/accountsettings.cpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/gui/accountsettings.cpp b/src/gui/accountsettings.cpp index 8e4ae54cb05ae..171c850e79c90 100644 --- a/src/gui/accountsettings.cpp +++ b/src/gui/accountsettings.cpp @@ -820,7 +820,7 @@ void AccountSettings::slotFolderWizardAccepted() if (!dir.mkpath(".")) { QMessageBox::warning(this, tr("Folder creation failed"), tr("

Could not create local folder %1.

") - .arg(QDir::toNativeSeparators(definition.localPath))); + .arg(Utility::escape(QDir::toNativeSeparators(definition.localPath)))); return; } } From 2326537bd9f0ab5360122b170af77a5a6fd41999 Mon Sep 17 00:00:00 2001 From: Rello Date: Mon, 5 Jan 2026 20:02:34 +0700 Subject: [PATCH 2/9] Escape filenames in deletion confirmation message Signed-off-by: Matthieu Gallien --- src/gui/conflictsolver.cpp | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/gui/conflictsolver.cpp b/src/gui/conflictsolver.cpp index a0458a8332629..c1a14426d6428 100644 --- a/src/gui/conflictsolver.cpp +++ b/src/gui/conflictsolver.cpp @@ -191,8 +191,8 @@ bool ConflictSolver::confirmDeletion() QFileInfo info(_localVersionFilename); const auto message = FileSystem::isDir(_localVersionFilename) - ? tr("Do you want to delete the directory %1 and all its contents permanently?").arg(info.dir().dirName()) - : tr("Do you want to delete the file %1 permanently?").arg(info.fileName()); + ? tr("Do you want to delete the directory %1 and all its contents permanently?").arg(Utility::escape(info.dir().dirName())) + : tr("Do you want to delete the file %1 permanently?").arg(Utility::escape(info.fileName())); const auto result = QMessageBox::question(_parentWidget, tr("Confirm deletion"), message, buttons); switch (result) { From 3cb83900a1ad498cb26e8b3a591fe8318c7a65ee Mon Sep 17 00:00:00 2001 From: Rello Date: Mon, 5 Jan 2026 20:03:17 +0700 Subject: [PATCH 3/9] Escape file name in error message for opening file Signed-off-by: Matthieu Gallien --- src/gui/editlocallyjob.cpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/gui/editlocallyjob.cpp b/src/gui/editlocallyjob.cpp index b9ad80e5d47d9..0970d438d91b7 100644 --- a/src/gui/editlocallyjob.cpp +++ b/src/gui/editlocallyjob.cpp @@ -433,7 +433,7 @@ void EditLocallyJob::openFile() // if the VFS is enabled - we just always call it from a separate thread. auto futureResult = QtConcurrent::run([localFilePathUrl, this]() { if (!QDesktopServices::openUrl(localFilePathUrl)) { - emit callShowError(tr("Could not open %1").arg(_fileName), tr("Please try again.")); + emit callShowError(tr("Could not open %1").arg(Utility::escape(_fileName)), tr("Please try again.")); } Systray::instance()->destroyEditFileLocallyLoadingDialog(); From cab677c35a41177ac92c804f9400706e56519c56 Mon Sep 17 00:00:00 2001 From: Rello Date: Mon, 5 Jan 2026 20:05:09 +0700 Subject: [PATCH 4/9] Escape warnings and folder path in folderwizard Escape warnings and folder path for better formatting. Signed-off-by: Matthieu Gallien --- src/gui/folderwizard.cpp | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/src/gui/folderwizard.cpp b/src/gui/folderwizard.cpp index 3dc10ad198578..fae6d197a0649 100644 --- a/src/gui/folderwizard.cpp +++ b/src/gui/folderwizard.cpp @@ -55,11 +55,11 @@ QString FormatWarningsWizardPage::formatWarnings(const QStringList &warnings) co { QString formattedWarning; if (warnings.count() == 1) { - formattedWarning = warnings.first(); + formattedWarning = Utility::escape(warnings.first()); } else if (warnings.count() > 1) { formattedWarning = "
    "; for (const auto &warning : warnings) { - formattedWarning += QString::fromLatin1("
  • %1
    • ").arg(warning); + formattedWarning += QString::fromLatin1("
  • %1
    • ").arg(Utility::escape(warning)); } formattedWarning += "
"; } @@ -310,7 +310,7 @@ void FolderWizardRemotePath::recursiveInsert(QTreeWidgetItem *parent, QStringLis item->setIcon(0, folderIcon); item->setText(0, folderName); item->setData(0, Qt::UserRole, folderPath); - item->setToolTip(0, folderPath); + item->setToolTip(0, Utility::escape(folderPath)); item->setChildIndicatorPolicy(QTreeWidgetItem::ShowIndicator); } From 39efb5f33d9766ded1547ab6c121edcd4abf8480 Mon Sep 17 00:00:00 2001 From: Rello Date: Mon, 5 Jan 2026 20:10:32 +0700 Subject: [PATCH 5/9] Update owncloudsetupwizard.cpp Signed-off-by: Matthieu Gallien --- src/gui/owncloudsetupwizard.cpp | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/gui/owncloudsetupwizard.cpp b/src/gui/owncloudsetupwizard.cpp index 8fe46dca5d0f3..0ae0ac1d1b025 100644 --- a/src/gui/owncloudsetupwizard.cpp +++ b/src/gui/owncloudsetupwizard.cpp @@ -656,8 +656,8 @@ void OwncloudSetupWizard::slotCreateRemoteFolderFinished(QNetworkReply *reply) _remoteFolder.clear(); success = false; } else { - _ocWizard->appendToConfigurationLog(tr("Remote folder %1 creation failed with error %2.").arg(Utility::escape(_remoteFolder)).arg(error)); - _ocWizard->displayError(tr("Remote folder %1 creation failed with error %2.").arg(Utility::escape(_remoteFolder)).arg(error), false); + _ocWizard->appendToConfigurationLog(tr("Remote folder %1 creation failed with error %2.").arg(Utility::escape(_remoteFolder)).arg(QString::number(error))); + _ocWizard->displayError(tr("Remote folder %1 creation failed with error %2.").arg(Utility::escape(_remoteFolder)).arg(QString::number(error)), false); _remoteFolder.clear(); success = false; } From 650034c9cacbc43c1e0f622b19a52cab000d3dec Mon Sep 17 00:00:00 2001 From: Rello Date: Mon, 5 Jan 2026 20:11:21 +0700 Subject: [PATCH 6/9] Escape host in SSL error message for security Signed-off-by: Matthieu Gallien --- src/gui/sslerrordialog.cpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/gui/sslerrordialog.cpp b/src/gui/sslerrordialog.cpp index cc0397f295fb9..b6ec90917608a 100644 --- a/src/gui/sslerrordialog.cpp +++ b/src/gui/sslerrordialog.cpp @@ -149,7 +149,7 @@ bool SslErrorDialog::checkFailingCertsKnown(const QList &errors) msg += QL(""); auto host = _account->url().host(); - msg += QL("

") + tr("Cannot connect securely to %1:").arg(host) + QL("

"); + msg += QL("

") + tr("Cannot connect securely to %1:").arg(Utility::escape(host)) + QL("

"); // loop over the unknown certs and line up their errors. msg += QL("
"); for (const auto &cert : std::as_const(_unknownCerts)) { From 15916d2535e2d83b5310a65b59b2abf442c887ae Mon Sep 17 00:00:00 2001 From: Rello Date: Mon, 5 Jan 2026 20:12:27 +0700 Subject: [PATCH 7/9] Escape display path using Utility::escape Use Utility::escape to process displayPath for better handling of special characters. Signed-off-by: Matthieu Gallien --- src/gui/tray/activitylistmodel.cpp | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/gui/tray/activitylistmodel.cpp b/src/gui/tray/activitylistmodel.cpp index 674aee5a7247d..45f319b5e1931 100644 --- a/src/gui/tray/activitylistmodel.cpp +++ b/src/gui/tray/activitylistmodel.cpp @@ -17,6 +17,7 @@ #include "caseclashfilenamedialog.h" #include "activitydata.h" #include "systray.h" +#include "common/utility.h" #include #include @@ -194,7 +195,7 @@ QVariant ActivityListModel::data(const QModelIndex &index, int role) const const auto displayLocation = [&]() { const auto displayPath = QFileInfo(getDisplayPath()).path(); - return displayPath == "." || displayPath == "/" ? QString() : displayPath; + return displayPath == "." || displayPath == "/" ? QString() : Utility::escape(displayPath); }; const auto generatePreviewMap = [](const PreviewData &preview) { From d141fae1b28973082a3f9207b6e47f7e4500a025 Mon Sep 17 00:00:00 2001 From: Rello Date: Mon, 5 Jan 2026 20:13:34 +0700 Subject: [PATCH 8/9] Update usermodel.cpp Signed-off-by: Matthieu Gallien --- src/gui/tray/usermodel.cpp | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/gui/tray/usermodel.cpp b/src/gui/tray/usermodel.cpp index 5d4349a228d15..bd4d824b43f6b 100644 --- a/src/gui/tray/usermodel.cpp +++ b/src/gui/tray/usermodel.cpp @@ -23,6 +23,7 @@ #include "tray/unifiedsearchresultslistmodel.h" #include "tray/talkreply.h" #include "userstatusconnector.h" +#include "common/utility.h" #include #include @@ -1538,7 +1539,7 @@ void UserModel::removeAccount(const int id) tr("Confirm Account Removal"), tr("

Do you really want to remove the connection to the account %1?

" "

Note: This will not delete any files.

") - .arg(_users[id]->name()), + .arg(Utility::escape(_users[id]->name()), QMessageBox::NoButton); const auto * const yesButton = messageBox.addButton(tr("Remove connection"), QMessageBox::YesRole); messageBox.addButton(tr("Cancel"), QMessageBox::NoRole); From 25b5c74d5698de66d0146aa8084444f88c789d33 Mon Sep 17 00:00:00 2001 From: Rello Date: Mon, 5 Jan 2026 23:14:41 +0700 Subject: [PATCH 9/9] Update usermodel.cpp Signed-off-by: Matthieu Gallien --- src/gui/tray/usermodel.cpp | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/gui/tray/usermodel.cpp b/src/gui/tray/usermodel.cpp index bd4d824b43f6b..f7a26ac88d455 100644 --- a/src/gui/tray/usermodel.cpp +++ b/src/gui/tray/usermodel.cpp @@ -1539,7 +1539,7 @@ void UserModel::removeAccount(const int id) tr("Confirm Account Removal"), tr("

Do you really want to remove the connection to the account %1?

" "

Note: This will not delete any files.

") - .arg(Utility::escape(_users[id]->name()), + .arg(Utility::escape(_users[id]->name())), QMessageBox::NoButton); const auto * const yesButton = messageBox.addButton(tr("Remove connection"), QMessageBox::YesRole); messageBox.addButton(tr("Cancel"), QMessageBox::NoRole);