2 files changed, 5 insertions, 2 deletions
diff --git a/phpBB/assets/javascript/core.js b/phpBB/assets/javascript/core.js
index 5b8331bdce..4657af90ab 100644
--- a/phpBB/assets/javascript/core.js
+++ b/phpBB/assets/javascript/core.js
@@ -994,7 +994,8 @@ phpbb.colorPalette = function(dir, width, height) {
 	numberList[3] = 'BF';
 	numberList[4] = 'FF';
 
-	html += '<table style="width: auto;">';
+	var table_class = (dir == 'h') ? 'horizontal-palette' : 'vertical-palette';
+	html += '<table class="not-responsive colour-palette ' + table_class + '" style="width: auto;">';
 
 	for (r = 0; r < 5; r++) {
 		if (dir == 'h') {
diff --git a/phpBB/assets/javascript/plupload.js b/phpBB/assets/javascript/plupload.js
index 91a9806955..3c2fc5c3cb 100644
--- a/phpBB/assets/javascript/plupload.js
+++ b/phpBB/assets/javascript/plupload.js
@@ -162,7 +162,7 @@ phpbb.plupload.insertRow = function(file) {
 	var row = $(phpbb.plupload.rowTpl);
 
 	row.attr('id', file.id);
-	row.find('.file-name').html(file.name);
+	row.find('.file-name').html(plupload.xmlEncode(file.name));
 	row.find('.file-size').html(plupload.formatSize(file.size));
 
 	if (phpbb.plupload.order == 'desc') {
@@ -499,6 +499,8 @@ $('#file-list').on('click', '.file-error', function(e) {
  * Fires when an error occurs.
  */
 uploader.bind('Error', function(up, error) {
+	error.file.name = plupload.xmlEncode(error.file.name);
+
 	// The error message that Plupload provides for these is vague, so we'll be more specific.
 	if (error.code === plupload.FILE_EXTENSION_ERROR) {
 		error.message = plupload.translate('Invalid file extension:') + ' ' + error.file.name;