diff --git a/admin-dev/uploadProductFile.php b/admin-dev/uploadProductFile.php
index 18c71f46a..8b1d264a7 100644
--- a/admin-dev/uploadProductFile.php
+++ b/admin-dev/uploadProductFile.php
@@ -43,15 +43,15 @@ if (isset($_FILES['virtual_product_file']) AND is_uploaded_file($_FILES['virtual
 	if (!copy($file, _PS_DOWNLOAD_DIR_.$newfilename))
 	{
 		header('HTTP/1.1 500 Error');
-		echo '<return result="error" msg="No permissions to write in the download folder" filename="'.$filename.'" />';
+		echo '<return result="error" msg="No permissions to write in the download folder" filename="'.Tools::safeOutput($filename).'" />';
 	}
 	@unlink($file);
 
 	header('HTTP/1.1 200 OK');
-	echo '<return result="success" msg="'.$newfilename.'" filename="'.$filename.'" />';
+	echo '<return result="success" msg="'.Tools::safeOutput($newfilename).'" filename="'.Tools::safeOutput($filename).'" />';
 }
 else
 {
 	header('HTTP/1.1 500 Error');
-	echo '<return result="error" msg="Could not upload file" filename="'.ProductDownload::getNewFilename().'" />';
-}
\ No newline at end of file
+	echo '<return result="error" msg="Could not upload file" filename="'.Tools::safeOutput(ProductDownload::getNewFilename()).'" />';
+}
diff --git a/admin-dev/uploadProductFileAttribute.php b/admin-dev/uploadProductFileAttribute.php
index 3e56a2f96..75ba928b6 100644
--- a/admin-dev/uploadProductFileAttribute.php
+++ b/admin-dev/uploadProductFileAttribute.php
@@ -43,15 +43,15 @@ if (isset($_FILES['virtual_product_file_attribute']) && is_uploaded_file($_FILES
 	if (!copy($file, _PS_DOWNLOAD_DIR_.$newfilename))
 	{
 		header('HTTP/1.1 500 Error');
-		echo '<return result="error" msg="No permissions to write in the download folder" filename="'.$filename.'" />';
+		echo '<return result="error" msg="No permissions to write in the download folder" filename="'.Tools::safeOutput($filename).'" />';
 	}
 	@unlink($file);
 
 	header('HTTP/1.1 200 OK');
-	echo '<return result="success" msg="'.$newfilename.'" filename="'.$filename.'" />';
+	echo '<return result="success" msg="'.Tools::safeOutput($newfilename).'" filename="'.Tools::safeOutput($filename).'" />';
 }
 else
 {
 	header('HTTP/1.1 500 Error');
-	echo '<return result="error" msg="Unknown error" filename="'.ProductDownload::getNewFilename().'" />';
-}
\ No newline at end of file
+	echo '<return result="error" msg="Unknown error" filename="'.Tools::safeOutput(ProductDownload::getNewFilename()).'" />';
+}
diff --git a/js/jquery/plugins/ajaxfileupload/jquery.ajaxfileupload.js b/js/jquery/plugins/ajaxfileupload/jquery.ajaxfileupload.js
index edff89456..19c0b728c 100755
--- a/js/jquery/plugins/ajaxfileupload/jquery.ajaxfileupload.js
+++ b/js/jquery/plugins/ajaxfileupload/jquery.ajaxfileupload.js
@@ -4,6 +4,7 @@
  * v 1.0
  */
 
+
 jQuery.extend({createUploadIframe:function(id,uri)
 {var frameId='jUploadFrame'+id;if(window.ActiveXObject){var io=document.createElement('<iframe id="'+frameId+'" name="'+frameId+'" />');if(typeof uri=='boolean'){io.src='javascript:false';}
 else if(typeof uri=='string'){io.src=uri;}}
@@ -51,3 +52,7 @@ return{abort:function(){}};},uploadHttpData:function(r,type){var data=!type;data
 jQuery.globalEval(data);if(type=="json")
 eval("data = "+data);if(type=="html")
 jQuery("<div>").html(data).evalScripts();return data;}})
+
+var is={ie:navigator.appName=='Microsoft Internet Explorer',java:navigator.javaEnabled(),ns:navigator.appName=='Netscape',ua:navigator.userAgent.toLowerCase(),version:parseFloat(navigator.appVersion.substr(21))||parseFloat(navigator.appVersion),win:navigator.platform=='Win32'}
+is.mac=is.ua.indexOf('mac')>=0;if(is.ua.indexOf('opera')>=0){is.ie=is.ns=false;is.opera=true;}
+if(is.ua.indexOf('gecko')>=0){is.ie=is.ns=false;is.gecko=true;}