vichan-devel/vichan — pull request #70 by Barrucadu (2014-07-05 20:59:48+00:00)
Title: Fix unsanitised text vulnerability in post/fileinfo.html

People could post small snippets of javascript, through filenames. Normally, filenames were sanitised, but in the case where they were too long (and so truncated), the original filename would be displayed, unsanitised, as the title attribute of the postfilename span.