Upgrade to 3.5.7

kirby/config/routes.php

@@ -59,7 +59,7 @@ return function ($kirby) {
             }
         ],
         [
-            'pattern' => $media . '/plugins/(:any)/(:any)/(:all).(css|gif|js|jpg|png|svg|webp|woff2|woff)',
+            'pattern' => $media . '/plugins/(:any)/(:any)/(:all).(css|map|gif|js|mjs|jpg|png|svg|webp|avif|woff2|woff|json)',
             'env'     => 'media',
             'action'  => function (string $provider, string $pluginName, string $filename, string $extension) {
                 return PluginAssets::resolve($provider . '/' . $pluginName, $filename . '.' . $extension);

kirby/config/sections/files.php

@@ -1,6 +1,7 @@
 <?php
 
 use Kirby\Cms\File;
+use Kirby\Toolkit\Escape;
 use Kirby\Toolkit\I18n;
 
 return [
@@ -116,6 +117,13 @@ return [
             foreach ($this->files as $file) {
                 $image = $file->panelImage($this->image);
 
+                // escape the default text
+                // TODO: no longer needed in 3.6
+                $text = $file->toString($this->text);
+                if ($this->text === '{{ file.filename }}') {
+                    $text = Escape::html($text);
+                }
+
                 $data[] = [
                     'dragText' => $file->dragText('auto', $dragTextAbsolute),
                     'extension' => $file->extension(),
@@ -127,7 +135,7 @@ return [
                     'link'     => $file->panelUrl(true),
                     'mime'     => $file->mime(),
                     'parent'   => $file->parent()->panelPath(),
-                    'text'     => $file->toString($this->text),
+                    'text'     => $text,
                     'url'      => $file->url(),
                 ];
             }

kirby/config/sections/pages.php

@@ -2,6 +2,7 @@
 
 use Kirby\Cms\Blueprint;
 use Kirby\Toolkit\A;
+use Kirby\Toolkit\Escape;
 use Kirby\Toolkit\I18n;
 
 return [
@@ -153,10 +154,17 @@ return [
                 $permissions = $item->permissions();
                 $image       = $item->panelImage($this->image);
 
+                // escape the default text
+                // TODO: no longer needed in 3.6
+                $text = $item->toString($this->text);
+                if ($this->text === '{{ page.title }}') {
+                    $text = Escape::html($text);
+                }
+
                 $data[] = [
                     'id'          => $item->id(),
                     'dragText'    => $item->dragText(),
-                    'text'        => $item->toString($this->text),
+                    'text'        => $text,
                     'info'        => $item->toString($this->info ?? false),
                     'parent'      => $item->parentId(),
                     'icon'        => $item->panelIcon($image),