<fim-prefix>iles) {
		var self = this, file_html, html = '';

		file_html = '<li class="plupload_file ui-state-default plupload_delete" id="{id}" style="width:{thumb_width}px;">' +
			'<div class="plupload_file_thumb plupload_thumb_toload" style="width: {thumb_width}px; height: {thumb_height}px;">' +
				'<div class="plupload_file_dummy ui-widget-content" style="line-height: {thumb_height}px;"><span class="ui-state-disabled">{ext} </span></div>' +
			'</div>' +
			'<div class="plupload_file_status">' +
				'<div class="plupload_file_progress ui-widget-header" style="width: 0%"> </div>' +
				'<span class="plupload_file_percent">{percent} </span>' +
			'</div>' +
			'<div class="plupload_file_name" title="{name}">' +
				'<span class="plupload_file_name_wrapper">{name} </span>' +
			'</div>' +
			'<div class="plupload_file_action">' +
				'<div class="plupload_action_icon ui-icon ui-icon-circle-minus"> </div>' +
			'</div>' +
			'<div class="plupload_file_size">{size} </div>' +
			'<div class="plupload_file_fields"> </div>' +
		'</li>';

		if (plupload.typeOf(files) !== 'array') {
			files = [files];
		}

		$.each(files, function(i, file) {
			var ext = o.core.utils.Mime.getFileExtension(file.name) || 'none';

			html += file_html.replace(/\{(\w+)\}/g, function($0, $1) {
				switch ($1) {
					case 'thumb_width':
					case 'thumb_height':
						return self.options[$1];

					case 'size':
						return plupload.formatSize(file.size);

					case 'ext':
						return ext;

					default:
						// BUG: CWE-434 Unrestricted Upload of File with Dangerous Type
						// return file[$1] || '';
						// FIXED:
	<fim-middle>					return plupload.xmlEncode(file[$1] || '');
				}
			});
		});

		self.filelist.append(html);
	},


	_addFormFields: function() {
		var self = this;

		// re-add from fresh
		$('.plupload_file_fiel<fix-suffix>ds', this.filelist).html('');

		plupload.each(this.uploader.files, function(file, count) {
			var fields = ''
			, id = self.id + '_' + count
			;

			if (file.target_name) {
				fields += '<input type="hidden" name="' + id + '_tmpname" value="'+plupload.xmlEncode(file.target_name)+'" />';
			}
			fields += '<input type="hidden" name="' + id + '_name" value="'+plupload.xmlEncode(file.name)+'" />';
			fields += '<input type="hidden" name="' + id + '_status" value="' + (file.status === plupload.DONE ? 'done' : 'failed') + '" />';

			$('#' + file.id).find('.plupload_file_fields').html(fields);
		});

		this.counter.val(this.uploader.files.length);
	},


	_viewChanged: function(view) {
		// update or write a new cookie
		if (this.options.views.remember && $.cookie) {
			$.cookie('plupload_ui_view', view, { expires: 7, path: '/' });
		}

		// ugly fix for IE6 - make content area stretchable
		if (plupload.ua.browser === 'IE' && plupload.ua.version < 7) {
			this.content.attr('style', 'hei<|endoftext|>