From 1cc8b873d46164c65f5eb445768a3cfbc4386067 Mon Sep 17 00:00:00 2001
From: ed <s@ocv.me>
Date: Wed, 6 May 2020 23:07:18 +0200
Subject: [PATCH] add missing urldecodes in js

---
 copyparty/web/md.js  | 4 +++-
 copyparty/web/mde.js | 4 +++-
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/copyparty/web/md.js b/copyparty/web/md.js
index d2a7facd..b7328ebb 100644
--- a/copyparty/web/md.js
+++ b/copyparty/web/md.js
@@ -22,7 +22,9 @@ var dom_md = document.getElementById('mt');
         if (a > 0)
             loc.push(n[a]);
 
-        nav.push('<a href="/' + loc.join('/') + '">' + n[a] + '</a>');
+        var dec = decodeURIComponent(n[a]).replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+
+        nav.push('<a href="/' + loc.join('/') + '">' + dec + '</a>');
     }
     dom_nav.innerHTML = nav.join('');
 })();
diff --git a/copyparty/web/mde.js b/copyparty/web/mde.js
index 71b9e752..5cc4c74f 100644
--- a/copyparty/web/mde.js
+++ b/copyparty/web/mde.js
@@ -13,7 +13,9 @@ var dom_md = document.getElementById('mt');
         if (a > 0)
             loc.push(n[a]);
 
-        nav.push('<a href="/' + loc.join('/') + '">' + n[a] + '</a>');
+        var dec = decodeURIComponent(n[a]).replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
+
+        nav.push('<a href="/' + loc.join('/') + '">' + dec + '</a>');
     }
     dom_nav.innerHTML = nav.join('');
 })();