Disallow custom HTML in file info format.

I doubt anyone is using it, and if someone manages to inject a
malicious script into the page, this could be used to install a
script permanently to be executed each time 4chan is visited.

I'll mention it in the changelog, and if anyone complains, I can
add it back with some security checks.

src/Miscellaneous/FileInfo.coffee

@@ -9,11 +9,11 @@ FileInfo =
     return if !@file or @isClone
     @file.text.innerHTML = "<span class=file-info>#{FileInfo.format Conf['fileInfo'], @}</span>"
   format: (formatString, post) ->
-    formatString.replace /%([A-Za-z])/g, (s, c) ->
+    formatString.replace /%([A-Za-z])|[^%]+/g, (s, c) ->
       if c of FileInfo.formatters
         FileInfo.formatters[c].call(post)
       else
-        s
+        FileInfo.escape s
   convertUnit: (size, unit) ->
     if unit is 'B'
       return "#{size.toFixed()} Bytes"