From: Andrew Dolgov <fox@madoka.volgo-balt.ru>
Date: Sat, 23 Mar 2013 05:44:52 +0000 (+0400)
Subject: title escaping: do not double-encode entities
X-Git-Tag: 1.7.5~6
X-Git-Url: https://git.wh0rd.org/?a=commitdiff_plain;h=d6ce708930cb838af3ed1cf585d3ca62b7036d9b;p=tt-rss.git

title escaping: do not double-encode entities
---

diff --git a/classes/feeds.php b/classes/feeds.php
index 3657a056..f6732117 100644
--- a/classes/feeds.php
+++ b/classes/feeds.php
@@ -432,7 +432,8 @@ class Feeds extends Handler_Protected {
 					$reply['content'] .= "<div onclick='return hlClicked(event, $id)'
 						class=\"hlTitle\"><span class='hlContent$hlc_suffix'>";
 					$reply['content'] .= "<a id=\"RTITLE-$id\"
-						href=\"" . htmlspecialchars($line["link"]) . "\"
+						href=\"" . htmlspecialchars($line["link"], ENT_COMPAT | ENT_HTML401,
+							'utf-8', false) . "\"
 						onclick=\"\">" .
 						truncate_string($line["title"], 200);
 
diff --git a/include/functions.php b/include/functions.php
index e57ee695..994b4c17 100644
--- a/include/functions.php
+++ b/include/functions.php
@@ -3022,7 +3022,8 @@
 
 			if ($line["link"]) {
 				$rv['content'] .= "<div class='postTitle'><a target='_blank'
-					title=\"".htmlspecialchars($line['title'])."\"
+					title=\"".htmlspecialchars($line["link"], ENT_COMPAT | ENT_HTML401,
+               'utf-8', false)."\"
 					href=\"" .
 					htmlspecialchars($line["link"]) . "\">" .
 					$line["title"] . "</a>" .