SECURITY: backport fix for #70 for 4.5. reported by Barrucadu

templates/post_reply.html

@@ -35,7 +35,7 @@
 			{% if config.show_filename and post.filename %}
 				, 
 				{% if post.filename|length > config.max_filename_display %}
-					<span class="postfilename" title="{{ post.filename|e }}">{{ post.filename|truncate(config.max_filename_display)|bidi_cleanup }}</span>
+					<span class="postfilename" title="{{ post.filename|e|bidi_cleanup }}">{{ post.filename|truncate(config.max_filename_display)|e|bidi_cleanup }}</span>
 				{% else %}
 					<span class="postfilename">{{ post.filename|e|bidi_cleanup }}</span>
 				{% endif %}

templates/post_thread.html

@@ -24,7 +24,7 @@
 		{% if config.show_filename and post.filename %}
 			, 
 			{% if post.filename|length > config.max_filename_display %}
-				<span class="postfilename" title="{{ post.filename|e }}">{{ post.filename|truncate(config.max_filename_display)|bidi_cleanup }}</span>
+				<span class="postfilename" title="{{ post.filename|e|bidi_cleanup }}">{{ post.filename|truncate(config.max_filename_display)|e|bidi_cleanup }}</span>
 			{% else %}
 				<span class="postfilename">{{ post.filename|e|bidi_cleanup }}</span>
 			{% endif %}