Escape properly filenames in bbp_converter_setting_callback_platform

[xknown]

In src/includes/admin/settings.php, the $file variable could be escaped to avoid some issues on files with weird names.

Index: src/includes/admin/settings.php
===================================================================
--- src/includes/admin/settings.php	(revision 5710)
+++ src/includes/admin/settings.php	(working copy)
@@ -1306,7 +1306,7 @@
 	while ( $file = readdir( $curdir ) ) {
 		if ( ( stristr( $file, '.php' ) ) && ( stristr( $file, 'index' ) === false ) ) {
 			$file              = preg_replace( '/.php/', '', $file );
-			$platform_options .= '<option value="' . $file . '">' . esc_html( $file ) . '</option>';
+			$platform_options .= '<option value="' . esc_attr( $file ) . '">' . esc_html( $file ) . '</option>';
 		}
 	}

Reported originally by ​https://hackerone.com/yujitounai

[thebrandonallen]

Good catch @xknown!

[netweb]

In 6040:

Admin: Escape $file variable for importer filenames in bbp_converter_setting_callback_platform()

Props xknown
Fixes #2792

[johnjamesjacoby]

Nice. Thanks everyone!