Xml-escape filename in http-upload (thanks Zash).

httpupload.go

@@ -121,6 +121,8 @@ func httpUpload(client *xmpp.Client, jserver string, filePath string) string {
 
 	// Get file name
 	fileName := filepath.Base(filePath)
+	var fileNameEscaped bytes.Buffer
+	xml.Escape(&fileNameEscaped, []byte(fileName))
 
 	// Query server for disco#items
 	id := getID()
@@ -196,7 +198,7 @@ func httpUpload(client *xmpp.Client, jserver string, filePath string) string {
 	go getIQ(client, id, c)
 	_, err = client.RawInformation(client.JID(), uploadComponent, id, "get",
 		"<request xmlns='urn:xmpp:http:upload:0' filename='"+
-			fileName+"' size='"+strconv.FormatInt(fileSize, 10)+
+			fileNameEscaped.String()+"' size='"+strconv.FormatInt(fileSize, 10)+
 			"' content-type='"+mimeType+"' />")
 	if err != nil {
 		log.Fatal(err)