Changes have been made in CVS for this ticket:

http://cvs.horde.org/diff.php/imp/docs/CHANGES?r1=1.699.2.338&r2=1.699.2.339&ty=u
http://cvs.horde.org/diff.php/imp/folders.php?r1=2.309.2.41&r2=2.309.2.42&ty=u
http://cvs.horde.org/diff.php/imp/lib/Compose.php?r1=1.107.2.73&r2=1.107.2.74&ty=u

Changes have been made in CVS for this ticket:

http://cvs.horde.org/diff.php/imp/docs/CHANGES?r1=1.1171&r2=1.1172&ty=u

Yup, that's it.  We were also not escaping displaying the notification 
message when uploading a mbox file.  Fixed these two.

Changes have been made in CVS for this ticket:

http://cvs.horde.org/diff.php/imp/folders.php?r1=2.423&r2=2.424&ty=u
http://cvs.horde.org/diff.php/imp/lib/Compose.php?r1=1.380&r2=1.381&ty=u

I think we may need to run the keys from $_FILES through 
Util::dispelMagicQuotes - try running it with magic_quotes_gpc on (I 
keep the setting on for testing to make sure we neuter it). I see this 
in both Firefox and Safari, fwiw.

I don't see this.  And the MIME headers look fine also:



Content-Type: text/plain;

        charset=UTF-8;

        name="Test' file.txt"

Content-Disposition: attachment;

        filename="Test' file.txt"

When attaching a file with a single quote in its name, the quote gets 
escaped with a backslash both in the attachment list in the compose 
window, and then when the message is received, the backslash is still 
there in the part name.