files: remove rigth-to-left override character for display in files.

This allows faking the name a bit, we in this particular place want to
skip the override for enhanced security.

rhodecode/lib/vcs/nodes.py

@@ -114,7 +114,8 b' class Node(object):'
     only. Moreover, every single node is identified by the ``path`` attribute,
     so it cannot end with slash, too. Otherwise, path could lead to mistakes.
     """
-
+    RTLO_MARKER = u"\u202E"  # RTLO marker allows swapping text, and certain
+                             # security attacks could be used with this
     commit = None
 
     def __init__(self, path, kind):
@@ -149,6 +150,20 b' class Node(object):'
         return safe_unicode(self.path)
 
     @LazyProperty
+    def has_rtlo(self):
+        """Detects if a path has right-to-left-override marker"""
+        return self.RTLO_MARKER in self.unicode_path
+
+    @LazyProperty
+    def unicode_path_safe(self):
+        """
+        Special SAFE representation of path without the right-to-left-override.
+        This should be only used for "showing" the file, cannot be used for any
+        urls etc.
+        """
+        return safe_unicode(self.path).replace(self.RTLO_MARKER, '')
+
+    @LazyProperty
     def dir_path(self):
         """
         Returns name of the directory from full path of this vcs node. Empty

rhodecode/templates/files/files_source.mako

@@ -6,7 +6,7 b''
             <span>
                 <strong>
                     <i class="icon-file-text"></i>
-                    ${c.file}
+                    ${c.file.unicode_path_safe}
                 </strong>
             </span>
             % if c.lf_node: