Sanitize user-input on file name (#17666)
Sanitize user-input on file name (#17666)

* Sanitize user-input on file name

- Sanitize user-input before it get passed into the DOM.
- Prevent things like "<iframe onload=alert(1)></iframe>" from being
executed. This isn't a XSS attack as the server seems to be santizing
the path as well.

Co-authored-by: wxiaoguang <afddda5b6ea4f5ea4386c1c8946f240cce9ffa2e@gmail.com>

go-gitea/gitea,go-gitea/gitea,go-gitea/gitea