strk/friendica
1
0
Fork 0
Code Issues Pull requests Releases Wiki Activity

Merge pull request #8111 from annando/tag-entities

Browse source 
Tags and mentions should be escaped
This commit is contained in:
Hypolite Petovan 2020-01-13 10:47:37 -05:00 committed by GitHub
parent c84a8ebe78 43e3b14672
commit a0bf7a8c94
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 4 additions and 4 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
src/Model/Term.php
View file

@ -447,13 +447,13 @@ class Term
$item['body'] = str_replace($orig_tag, $tag['url'], $item['body']); $item['body'] = str_replace($orig_tag, $tag['url'], $item['body']);
} }
$return['hashtags'][] = $prefix . '<a href="' . $tag['url'] . '" target="_blank">' . $tag['term'] . '</a>'; $return['hashtags'][] = $prefix . '<a href="' . $tag['url'] . '" target="_blank">' . htmlspecialchars($tag['term']) . '</a>';
$return['tags'][] = $prefix . '<a href="' . $tag['url'] . '" target="_blank">' . $tag['term'] . '</a>'; $return['tags'][] = $prefix . '<a href="' . $tag['url'] . '" target="_blank">' . htmlspecialchars($tag['term']) . '</a>';
break; break;
case self::MENTION: case self::MENTION:
$tag['url'] = Contact::magicLink($tag['url']); $tag['url'] = Contact::magicLink($tag['url']);
$return['mentions'][] = $prefix . '<a href="' . $tag['url'] . '" target="_blank">' . $tag['term'] . '</a>'; $return['mentions'][] = $prefix . '<a href="' . $tag['url'] . '" target="_blank">' . htmlspecialchars($tag['term']) . '</a>';
$return['tags'][] = $prefix . '<a href="' . $tag['url'] . '" target="_blank">' . $tag['term'] . '</a>'; $return['tags'][] = $prefix . '<a href="' . $tag['url'] . '" target="_blank">' . htmlspecialchars($tag['term']) . '</a>';
break; break;
case self::IMPLICIT_MENTION: case self::IMPLICIT_MENTION:
$return['implicit_mentions'][] = $prefix . $tag['term']; $return['implicit_mentions'][] = $prefix . $tag['term'];