Steps to reproduce
Nextcloud version: master
- Go to Files and create a new File Request.
- In the "Subject" field, enter a string containing a special character, e.g. an apostrophe:
Submissions for XYZ's event
- Save the file request and copy the generated share link.
- Open the share link (e.g. in a private/incognito window or a different browser).
- Observe the subject shown in the "enter your name" dialog — the initial prompt shown to the recipient before they can upload files.
Expected behaviour
The dialog heading and info box show the subject exactly as entered:
- Heading:
Upload files to Submissions for XYZ's event
- Info box:
To upload files to Submissions for XYZ's event, you must first enter your name.
Actual behaviour
The dialog heading and info box display the HTML-encoded version of the subject:
- Heading:
Upload files to Submissions for XYZ's event
- Info box:
To upload files to Submissions for XYZ's event, you must first enter your name.
Additional information
The issue is exclusively limited to the "enter your name" dialog. The underlying file management view — where the uploaded files actually appear — correctly displays the subject with the original characters. This suggests the subject string is being HTML-encoded before being passed to the dialog template, rather than being escaped only at render time.
Steps to reproduce
Nextcloud version:
masterSubmissions for XYZ's eventExpected behaviour
The dialog heading and info box show the subject exactly as entered:
Upload files to Submissions for XYZ's eventTo upload files to Submissions for XYZ's event, you must first enter your name.Actual behaviour
The dialog heading and info box display the HTML-encoded version of the subject:
Upload files to Submissions for XYZ's eventTo upload files to Submissions for XYZ's event, you must first enter your name.Additional information
The issue is exclusively limited to the "enter your name" dialog. The underlying file management view — where the uploaded files actually appear — correctly displays the subject with the original characters. This suggests the subject string is being HTML-encoded before being passed to the dialog template, rather than being escaped only at render time.