Index: spacewalk-java-git-0.958eaf1/code/src/com/redhat/rhn/domain/kickstart/cobbler/CobblerSnippet.java
===================================================================
--- spacewalk-java-git-0.958eaf1.orig/code/src/com/redhat/rhn/domain/kickstart/cobbler/CobblerSnippet.java
+++ spacewalk-java-git-0.958eaf1/code/src/com/redhat/rhn/domain/kickstart/cobbler/CobblerSnippet.java
@@ -312,14 +312,17 @@ public class CobblerSnippet implements C
     private static void validateFileName(String name) {
         // file names can have no slashes/ can't be blan or
         // can't start with a period (for it'll mean its hidden)
-        if (StringUtils.isBlank(name) || name.contains("/") || name.startsWith(".")) {
+        // can't contain " to protect against xss
+        if (StringUtils.isBlank(name) || name.contains("/") || name.startsWith(".") ||
+                name.contains("\"") || name.contains("&")) {
             ValidatorException.raiseException("cobbler.snippet.invalidfilename.message");
         }
     }
 
     private static void validateCommonPath(File path) {
-        if (!path.exists() || path.isHidden() || !path.isFile() ||
-                              !isCommonPath(path)) {
+        if (!path.exists() || path.isHidden() || !path.isFile() || !isCommonPath(path) ||
+                path.getAbsolutePath().contains("\"") ||
+                path.getAbsolutePath().contains("&")) {
             ValidatorException.raiseException("cobbler.snippet.invalidfilename.message");
         }
     }
Index: spacewalk-java-git-0.958eaf1/code/src/com/redhat/rhn/frontend/action/kickstart/cobbler/CobblerSnippetListSetupAction.java
===================================================================
--- spacewalk-java-git-0.958eaf1.orig/code/src/com/redhat/rhn/frontend/action/kickstart/cobbler/CobblerSnippetListSetupAction.java
+++ spacewalk-java-git-0.958eaf1/code/src/com/redhat/rhn/frontend/action/kickstart/cobbler/CobblerSnippetListSetupAction.java
@@ -15,12 +15,15 @@
 package com.redhat.rhn.frontend.action.kickstart.cobbler;
 
 import com.redhat.rhn.common.util.DynamicComparator;
+import com.redhat.rhn.common.validator.ValidatorError;
+import com.redhat.rhn.common.validator.ValidatorException;
 import com.redhat.rhn.domain.kickstart.cobbler.CobblerSnippet;
 import com.redhat.rhn.domain.user.User;
 import com.redhat.rhn.frontend.action.common.BadParameterException;
 import com.redhat.rhn.frontend.struts.RequestContext;
 import com.redhat.rhn.frontend.struts.RhnAction;
 import com.redhat.rhn.frontend.struts.RhnHelper;
+import com.redhat.rhn.frontend.struts.RhnValidationHelper;
 import com.redhat.rhn.frontend.taglibs.list.ListTagHelper;
 import com.redhat.rhn.manager.kickstart.cobbler.CobblerSnippetLister;
 
@@ -28,6 +31,7 @@ import org.apache.struts.action.ActionFo
 import org.apache.struts.action.ActionForward;
 import org.apache.struts.action.ActionMapping;
 
+import java.util.ArrayList;
 import java.util.Collections;
 import java.util.List;
 
@@ -53,19 +57,28 @@ public class CobblerSnippetListSetupActi
         request.setAttribute(mapping.getParameter(), Boolean.TRUE);
         RequestContext context = new RequestContext(request);
         User user = context.getCurrentUser();
-        List<CobblerSnippet> result;
-        if (ALL.equals(mapping.getParameter())) {
-            result = CobblerSnippetLister.getInstance().list(user);
+        List<CobblerSnippet> result = new ArrayList<CobblerSnippet>();
+        try {
+            if (ALL.equals(mapping.getParameter())) {
+                result = CobblerSnippetLister.getInstance().list(user);
+            }
+            else if (RhnHelper.DEFAULT_FORWARD.equals(mapping.getParameter())) {
+                result = CobblerSnippetLister.getInstance().listDefault(user);
+            }
+            else if (CUSTOM.equals(mapping.getParameter())) {
+                result = CobblerSnippetLister.getInstance().listCustom(user);
+            }
+            else {
+                throw new BadParameterException("Invalid mapping parameter passed!! [" +
+                                                        mapping.getParameter() + "]");
+            }
         }
-        else if (RhnHelper.DEFAULT_FORWARD.equals(mapping.getParameter())) {
-            result = CobblerSnippetLister.getInstance().listDefault(user);
-        }
-        else if (CUSTOM.equals(mapping.getParameter())) {
-            result = CobblerSnippetLister.getInstance().listCustom(user);
-        }
-        else {
-            throw new BadParameterException("Invalid mapping parameter passed!! [" +
-                                                    mapping.getParameter() + "]");
+        catch (ValidatorException ve) {
+            List<ValidatorError> errors = ve.getResult().getErrors();
+            errors.add(new ValidatorError("cobbler.snippet.invalidfilename.details",
+                    CobblerSnippet.getPrefixFor(user.getOrg())));
+            getStrutsDelegate().saveMessages(request, errors, ve.getResult().getWarnings());
+            RhnValidationHelper.setFailedValidation(request);
         }
         Collections.sort(result, NAME_COMPARATOR);
         request.setAttribute(RequestContext.PAGE_LIST, result);
Index: spacewalk-java-git-0.958eaf1/code/src/com/redhat/rhn/frontend/strings/java/StringResource_en_US.xml
===================================================================
--- spacewalk-java-git-0.958eaf1.orig/code/src/com/redhat/rhn/frontend/strings/java/StringResource_en_US.xml
+++ spacewalk-java-git-0.958eaf1/code/src/com/redhat/rhn/frontend/strings/java/StringResource_en_US.xml
@@ -1965,11 +1965,17 @@ available for this kickstart profile to
         </context-group>
       </trans-unit>
       <trans-unit id="cobbler.snippet.invalidfilename.message">
-        <source>The requested kickstart snippet filename is not valid. The kickstart snippet file name cannot contain slash (/) or  begin with a period(.)</source>
+        <source>The requested kickstart snippet filename is not valid. The kickstart snippet file name cannot contain slash (/), quote (&quot;), ampersand (&amp;), or begin with a period(.)</source>
         <context-group name="ctx">
           <context context-type="sourcefile">Kickstart Profile Details pages.</context>
         </context-group>
       </trans-unit>
+      <trans-unit id="cobbler.snippet.invalidfilename.details">
+        <source>Delete or rename the offending snippet from {0}</source>
+        <context-group name="ctx">
+          <context context-type="sourcefile">Kickstart Snippet Details pages.</context>
+        </context-group>
+      </trans-unit>
       <trans-unit id="toolbar.delete.snippets">
         <source>delete snippet</source>
         <context-group name="ctx">
