problem

What was completely forgotten when implementing TRANSLATE-283 was the possibility that filenames (workfiles / reference files / etc. pp) are also vulnerable for PXSS attacks.

First we need a concept how to fix that, the concept can then go into a new t5dev issue. The issue should be converted into a TRANSLATE-issue right before release, so that we do not publish about security issues before release.