XSS vulnerability using crafted filename

Current version of Lutim is vulnerable to an XSS attack.

How to reproduce

• An attacker gives an image with a crafted filename, for example like <img src=x onerror=alert(0)>.jpg, to a targeted user
• The targeted user uploads the file on Lutim
• The JS payload is executed in the notification after upload and in the myfiles page

The impact of a successful attack is important because an attacker can read all the images uploaded by the target and can remove them. But succeed in exploiting this attack seems unlikely, because an attacker has to trick the user to use his/her custom filename.

How to fix

Filenames should be escaped in the myfiles page and in the notifications.