diff --git a/mod/events.php b/mod/events.php
index a788cc157..cb91fae35 100644
--- a/mod/events.php
+++ b/mod/events.php
@@ -97,9 +97,9 @@ function events_post(App $a)
// and we'll waste a bunch of time responding to it. Time that
// could've been spent doing something else.
- $summary = Strings::escapeHtml(trim(defaults($_POST, 'summary', '')));
- $desc = Strings::escapeHtml(trim(defaults($_POST, 'desc', '')));
- $location = Strings::escapeHtml(trim(defaults($_POST, 'location', '')));
+ $summary = trim(defaults($_POST, 'summary' , ''));
+ $desc = trim(defaults($_POST, 'desc' , ''));
+ $location = trim(defaults($_POST, 'location', ''));
$type = 'event';
$params = [
diff --git a/src/Model/Event.php b/src/Model/Event.php
index 348ced525..d25f2a151 100644
--- a/src/Model/Event.php
+++ b/src/Model/Event.php
@@ -16,6 +16,7 @@ use Friendica\Core\System;
use Friendica\Database\DBA;
use Friendica\Util\DateTimeFormat;
use Friendica\Util\Map;
+use Friendica\Util\Strings;
use Friendica\Util\XML;
require_once 'boot.php';
@@ -52,11 +53,11 @@ class Event extends BaseObject
if ($simple) {
if (!empty($event['summary'])) {
- $o = "
" . BBCode::convert($event['summary'], false, $simple) . "
";
+ $o = "" . BBCode::convert(Strings::escapeHtml($event['summary']), false, $simple) . "
";
}
if (!empty($event['desc'])) {
- $o .= "" . BBCode::convert($event['desc'], false, $simple) . "
";
+ $o .= "" . BBCode::convert(Strings::escapeHtml($event['desc']), false, $simple) . "
";
}
$o .= "" . L10n::t('Starts:') . "
" . $event_start . "
";
@@ -66,7 +67,7 @@ class Event extends BaseObject
}
if (!empty($event['location'])) {
- $o .= "" . L10n::t('Location:') . "
" . BBCode::convert($event['location'], false, $simple) . "
";
+ $o .= "" . L10n::t('Location:') . "
" . BBCode::convert(Strings::escapeHtml($event['location']), false, $simple) . "
";
}
return $o;
@@ -74,7 +75,7 @@ class Event extends BaseObject
$o = '' . "\r\n";
- $o .= '
' . BBCode::convert($event['summary'], false, $simple) . '
' . "\r\n";
+ $o .= '
' . BBCode::convert(Strings::escapeHtml($event['summary']), false, $simple) . '
' . "\r\n";
$o .= '
' . L10n::t('Starts:') . ' ' . BBCode::convert($event['desc'], false, $simple) . '
' . "\r\n";
+ $o .= '
' . BBCode::convert(Strings::escapeHtml($event['desc']), false, $simple) . '
' . "\r\n";
}
if (!empty($event['location'])) {
$o .= '
' . L10n::t('Location:') . ' '
- . BBCode::convert($event['location'], false, $simple)
+ . BBCode::convert(Strings::escapeHtml($event['location']), false, $simple)
. '
' . "\r\n";
// Include a map of the location if the [map] BBCode is used.
@@ -591,10 +592,9 @@ class Event extends BaseObject
$drop = [System::baseUrl() . '/events/drop/' . $event['id'] , L10n::t('Delete event') , '', ''];
}
- $title = strip_tags(html_entity_decode(BBCode::convert($event['summary']), ENT_QUOTES, 'UTF-8'));
+ $title = BBCode::convert(Strings::escapeHtml($event['summary']));
if (!$title) {
- list($title, $_trash) = explode("
$event['id'],
'start' => $start,
diff --git a/src/Protocol/ActivityPub/Processor.php b/src/Protocol/ActivityPub/Processor.php
index bff8767f3..d2f5b3b2d 100644
--- a/src/Protocol/ActivityPub/Processor.php
+++ b/src/Protocol/ActivityPub/Processor.php
@@ -209,20 +209,20 @@ class Processor
*/
public static function createEvent($activity, $item)
{
- $event['summary'] = $activity['name'];
- $event['desc'] = $activity['content'];
- $event['start'] = $activity['start-time'];
- $event['finish'] = $activity['end-time'];
+ $event['summary'] = HTML::toBBCode($activity['name']);
+ $event['desc'] = HTML::toBBCode($activity['content']);
+ $event['start'] = $activity['start-time'];
+ $event['finish'] = $activity['end-time'];
$event['nofinish'] = empty($event['finish']);
$event['location'] = $activity['location'];
- $event['adjust'] = true;
- $event['cid'] = $item['contact-id'];
- $event['uid'] = $item['uid'];
- $event['uri'] = $item['uri'];
- $event['edited'] = $item['edited'];
- $event['private'] = $item['private'];
- $event['guid'] = $item['guid'];
- $event['plink'] = $item['plink'];
+ $event['adjust'] = true;
+ $event['cid'] = $item['contact-id'];
+ $event['uid'] = $item['uid'];
+ $event['uri'] = $item['uri'];
+ $event['edited'] = $item['edited'];
+ $event['private'] = $item['private'];
+ $event['guid'] = $item['guid'];
+ $event['plink'] = $item['plink'];
$condition = ['uri' => $item['uri'], 'uid' => $item['uid']];
$ev = DBA::selectFirst('event', ['id'], $condition);