From e2bfe6dcec9e7f3c3dfca41e87e88917cae14a1a Mon Sep 17 00:00:00 2001
From: ~keith <keith@keithhacks.cyou>
Date: Sun, 19 Nov 2023 18:08:28 -0500
Subject: [PATCH] HTML-escape notification contact names

---
 src/Navigation/Notifications/Entity/Notify.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/Navigation/Notifications/Entity/Notify.php b/src/Navigation/Notifications/Entity/Notify.php
index ab042bc9f..f24ea16ce 100644
--- a/src/Navigation/Notifications/Entity/Notify.php
+++ b/src/Navigation/Notifications/Entity/Notify.php
@@ -134,6 +134,6 @@ class Notify extends BaseEntity
 	 */
 	public static function formatMessage(string $name, string $message): string
 	{
-		return str_replace('{0}', '<span class="contactname">' . BBCode::toPlaintext($name, false) . '</span>', htmlspecialchars($message));
+		return str_replace('{0}', '<span class="contactname">' . htmlspecialchars(BBCode::toPlaintext($name, false)) . '</span>', htmlspecialchars($message));
 	}
 }