keith/friendica
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

HTML-escape notification contact names

Browse source
This commit is contained in:
~keith 2023-11-19 18:08:28 -05:00
parent a802fada23
commit e2bfe6dcec
Signed by: keith
GPG key ID: 5BEBEEAB2C73D520
1 changed files with 1 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
src/Navigation/Notifications/Entity/Notify.php
View file

@ -134,6 +134,6 @@ class Notify extends BaseEntity
*/
public static function formatMessage(string $name, string $message): string
{
return str_replace('{0}', '<span class="contactname">' . BBCode::toPlaintext($name, false) . '</span>', htmlspecialchars($message));
return str_replace('{0}', '<span class="contactname">' . htmlspecialchars(BBCode::toPlaintext($name, false)) . '</span>', htmlspecialchars($message));
}
}