From 6661b23cd5840884f44b29c49c20afd487eabb7d Mon Sep 17 00:00:00 2001
From: RhodeCode Admin <admin@rhodecode.com>
Date: Thu, 18 Nov 2021 15:18:21 +0100
Subject: [PATCH] security: fixed self-xss on archive download page.

---
 rhodecode/apps/repository/views/repo_files.py | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/rhodecode/apps/repository/views/repo_files.py b/rhodecode/apps/repository/views/repo_files.py
index 7dd4cdab..f1f52792 100644
--- a/rhodecode/apps/repository/views/repo_files.py
+++ b/rhodecode/apps/repository/views/repo_files.py
@@ -381,7 +381,7 @@ class RepoFilesView(RepoAppView):
         try:
             at_path = commit.get_node(at_path).path or default_at_path
         except Exception:
-            return Response(_('No node at path {} for this repository').format(at_path))
+            return Response(_('No node at path {} for this repository').format(h.escape(at_path)))
 
         # path sha is part of subdir
         path_sha = ''