From 7bd2294442acfaa749b8528a5f22c4893ff6efe6 Mon Sep 17 00:00:00 2001
From: Stanislas Kita <7335054+stonebuzz@users.noreply.github.com>
Date: Fri, 18 Sep 2026 15:26:02 +0200
Subject: [PATCH] Fix: escape asset name in the replacement form

---
 CHANGELOG.md          | 6 ++++++
 inc/replace.class.php | 2 +-
 2 files changed, 7 insertions(+), 1 deletion(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 0745dcc..9452e42 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,6 +5,12 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](http://keepachangelog.com/)
 and this project adheres to [Semantic Versioning](http://semver.org/).
 
+## [Unreleased]
+
+### Fixed
+
+- Display asset names correctly in the replacement form
+
 ## [2.9.5] - 2026-09-04
 
 ### Improvement
diff --git a/inc/replace.class.php b/inc/replace.class.php
index 62ddaa2..5f0a4b3 100644
--- a/inc/replace.class.php
+++ b/inc/replace.class.php
@@ -848,7 +848,7 @@ public static function showReplacementForm($type, $model_id, $tab_ids, $location
             $commonitem->getFromDB($id);
 
             echo "<tr class='tab_bg_1 center'>";
-            echo "<td>" . $commonitem->getName() . "</td>";
+            echo "<td>" . htmlspecialchars((string) $commonitem->getName(), ENT_QUOTES, 'UTF-8') . "</td>";
 
             if (Search::getOptionNumber($type, 'otherserial')) {
                 echo "<td>" . htmlspecialchars((string) $commonitem->fields['otherserial'], ENT_QUOTES, 'UTF-8') . "</td>";