3 files changed, 15 insertions, 12 deletions
diff --git a/modules/server_add/views/admin_server_add.html.php b/modules/server_add/views/admin_server_add.html.php
index 588a9fca..b48a19da 100644
--- a/modules/server_add/views/admin_server_add.html.php
+++ b/modules/server_add/views/admin_server_add.html.php
@@ -11,12 +11,12 @@
     <ul id="gPathList">
       <? foreach ($paths as $id => $path): ?>
       <li class="ui-icon-left">
-        <a href="<?= url::site("admin/server_add/remove_path?path=$path&csrf=$csrf") ?>"
+        <a href="<?= url::site("admin/server_add/remove_path?path=" . urlencode($path) . "&amp;csrf=$csrf") ?>"
            id="icon_<?= $id?>"
            class="gRemoveDir ui-icon ui-icon-trash">
           X
         </a>
-        <?= $path ?>
+        <?= html::clean($path) ?>
       </li>
       <? endforeach ?>
     </ul>
diff --git a/modules/server_add/views/server_add_tree.html.php b/modules/server_add/views/server_add_tree.html.php
index 254a9da0..918fbdc7 100644
--- a/modules/server_add/views/server_add_tree.html.php
+++ b/modules/server_add/views/server_add_tree.html.php
@@ -9,8 +9,8 @@
     <? foreach ($parents as $dir): ?>
     <li class="ui-icon-left">
       <span class="ui-icon ui-icon-folder-open"></span>
-      <span ondblclick="open_dir('<?= $dir ?>')">
-        <?= basename($dir) ?>
+      <span ondblclick='open_dir(<?= html::js_string($dir) ?>)'>
+        <?= html::clean(basename($dir)) ?>
       </span>
       <ul>
         <? endforeach ?>
@@ -22,9 +22,9 @@
                 <? if (is_dir($file)): ?>
                 ondblclick="open_dir($(this).attr('file'))"
                 <? endif ?>
-                file="<?= $file ?>"
+                file="<?= html::clean_attribute($file) ?>"
                 >
-            <?= p::clean(basename($file)) ?>
+            <?= html::clean(basename($file)) ?>
           </span>
         </li>
         <? endforeach ?>
diff --git a/modules/server_add/views/server_add_tree_dialog.html.php b/modules/server_add/views/server_add_tree_dialog.html.php
index 21952849..8eb6e4df 100644
--- a/modules/server_add/views/server_add_tree_dialog.html.php
+++ b/modules/server_add/views/server_add_tree_dialog.html.php
@@ -5,17 +5,17 @@
 </script>
 
 <div id="gServerAdd">
-  <h1 style="display: none;"><?= t("Add Photos to '%title'", array("title" => p::purify($item->title))) ?></h1>
+  <h1 style="display: none;"><?= t("Add Photos to '%title'", array("title" => html::purify($item->title))) ?></h1>
 
   <p id="gDescription"><?= t("Photos will be added to album:") ?></p>
   <ul class="gBreadcrumbs">
     <? foreach ($item->parents() as $parent): ?>
     <li>
-      <?= p::purify($parent->title) ?>
+      <?= html::purify($parent->title) ?>
     </li>
     <? endforeach ?>
     <li class="active">
-      <?= p::purify($item->title) ?>
+      <?= html::purify($item->title) ?>
     </li>
   </ul>
 
@@ -23,7 +23,7 @@
     <?= $tree ?>
   </ul>
 
-  <div id="gProgress" style="display: none">
+  <div id="gServerAddProgress" style="display: none">
     <div class="gProgressBar"></div>
     <div id="gStatus"></div>
   </div>
@@ -34,7 +34,7 @@
       <?= t("Add") ?>
     </button>
 
-    <button class="ui-state-default ui-corner-all" onclick="closeDialog(); window.location.reload();">
+    <button id="gServerCloseButton" class="ui-state-default ui-corner-all">
       <?= t("Close") ?>
     </button>
   </span>
@@ -46,7 +46,10 @@
          $("#gServerAdd .gProgressBar").
            progressbar().
            progressbar("value", 0);
-         $("#gProgress").slideDown("fast", function() { start_add() });
+         $("#gServerAddProgress").slideDown("fast", function() { start_add() });
+      });
+      $("#gServerCloseButton").click(function(event) {
+        $("#gDialog").dialog("close");
       });
     });
   </script>