[TikiWiki-commits] [Git][tikiwiki/tiki][24.x] [FIX] Set double_encode to false in to the htmlspecialchars Self_link to avoid double encoding...
"Elifeleti Mukisa Dan \(@Danelif\) via TikiWiki-cvs" <[email protected]>
| Newsgroups | gmane.comp.cms.tiki.cvs |
|---|---|
| Message-ID | <6a10a45aa5d0e_38192710518cc@gitlab-sidekiq-low-urgency-cpu-bound-v2-5755d7f9f9-jl25j.mail> |
Elifeleti Mukisa Dan pushed to branch 24.x at Tiki Wiki CMS Groupware / Tiki Commits: 7913d036 by Elifeleti Mukisa Dan at 2026-05-22T18:40:38+00:00 [FIX] Set double_encode to false in to the htmlspecialchars Self_link to avoid double encoding... --- * [FIX] Set double_encode to false in to the htmlspecialchars Self_link to avoid double encoding... (cherry picked from commit 85b027b575641560e2aecf1a6a71fa2595cf6134) de1e04df [FIX] Set double_encode to false in to the parser to avoid double encoding... Co-authored-by: Elifeleti Mukisa Dan <[email protected]> See merge request tikiwiki/tiki!10298 - - - - - 1 changed file: - lib/smarty_tiki/block.self_link.php Changes: ===================================== lib/smarty_tiki/block.self_link.php ===================================== @@ -137,8 +137,11 @@ function smarty_block_self_link($params, $content, $smarty, &$repeat = false) ); unset($params['_onclick']); // Prevent addition to $link later } else { - // Escape href value to prevent XSS injection - $ret = 'href="' . htmlspecialchars($ret, ENT_QUOTES, 'UTF-8') . '"'; + /* Escape href value to prevent XSS injection. Set double_encode to false + because smarty_function_query() already produces an HTML-safe URL query + (http_build_query with & separator and htmlspecialchars on PHP_SELF), + so existing entities must not be re-encoded (for instance & would become &amp;).**/ + $ret = 'href="' . htmlspecialchars($ret, ENT_QUOTES, 'UTF-8', false) . '"'; } } View it on GitLab: https://gitlab.com/tikiwiki/tiki/-/commit/7913d036ffef9aa8d66b317cf106b4e0dcb0e0af -- View it on GitLab: https://gitlab.com/tikiwiki/tiki/-/commit/7913d036ffef9aa8d66b317cf106b4e0dcb0e0af You're receiving this email because of your account on gitlab.com. Manage all notifications: https://gitlab.com/-/profile/notifications | Help: https://gitlab.com/help _______________________________________________ TikiWiki-cvs mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/tikiwiki-cvs