Added filter

$field = filter_var($_GET['fid'], FILTER_VALIDATE_INT, FILTER_NULL_ON_FAILURE);

If attempted xss then $field will be null

code/FilePage.php

@@ -57,10 +57,11 @@ public function init() {
 	function Listing($ParentID = null) {
 		if(!$this->FolderID) return false;
 
-		$field = $_GET['fid'];
-		if (isset($field) && is_numeric($field)) {
-			if (DataObject::get("File", "ID = ".$_GET['fid'])) {
-				$ParentID = $_GET['fid'];
+		$field = filter_var($_GET['fid'], FILTER_VALIDATE_INT, FILTER_NULL_ON_FAILURE);
+
+		if (isset($field)) {
+			if (DataObject::get("File", "ID = ".$field)) {
+				$ParentID = $field;
 			}
 		} else {
 			$ParentID = $this->FolderID;
@@ -75,8 +76,10 @@ function Listing($ParentID = null) {
 
 	// Checks if not at the root folder
 	function NotRoot() {
-		if (isset($_GET['fid'])) {
-			if (DataObject::get("File", "ID = ".$_GET['fid'])) {
+		$field = filter_var($_GET['fid'], FILTER_VALIDATE_INT, FILTER_NULL_ON_FAILURE);
+
+		if (isset($field)) {
+			if (DataObject::get("File", "ID = ".$field)) {
 				return true;
 			}
 		}
@@ -85,8 +88,10 @@ function NotRoot() {
 
 	// Gets current folder from $_GET['fid']
 	function CurrentFolder() {
-		if (isset($_GET['fid'])) {
-			return DataObject::get_by_id("File",$_GET['fid']);
+		$field = filter_var($_GET['fid'], FILTER_VALIDATE_INT, FILTER_NULL_ON_FAILURE);
+
+		if (isset($field)) {
+			return DataObject::get_by_id("File",$field);
 		}
 		return false;
 	}