From 9ec7ab4afc6f860e818f9e5ab8eb8586b2358544 Mon Sep 17 00:00:00 2001
From: Julian Lam <julian@nodebb.org>
Date: Tue, 13 Jun 2023 14:53:16 -0400
Subject: [PATCH] fix: improper neutralization of user input in image wrapping
 code

(Backport of: 1d1639d46f15c5a9c84d3ccfc7a334244c28039a)
---
 public/src/client/topic/images.js | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/public/src/client/topic/images.js b/public/src/client/topic/images.js
index a04b22a9e9..7506790fff 100644
--- a/public/src/client/topic/images.js
+++ b/public/src/client/topic/images.js
@@ -24,7 +24,7 @@ define('forum/topic/images', [], function () {
 
 			if (!$this.parent().is('a')) {
 				$this.wrap('<a href="' + src + '" ' +
-					(!srcExt && altExt ? ' download="' + altFilename + '" ' : '') +
+					(!srcExt && altExt ? ' download="' + utils.escapeHTML(altFilename) + '" ' : '') +
 					' target="_blank" rel="noopener">');
 			}
 		});