diff --git a/checkin_notes b/checkin_notes index 080f4c86bc..3c009d33bb 100644 --- a/checkin_notes +++ b/checkin_notes @@ -4706,4 +4706,10 @@ Rom 20 May 2009 / configure.ac version.h - \ No newline at end of file + +David 22 May 2009 + - web: escape forum RSS entries instead of stripping tags + (from Nicolas; fixes #899) + + html/user/ + forum_rss.php diff --git a/html/user/forum_rss.php b/html/user/forum_rss.php index fe4b57243a..3ead1dd064 100644 --- a/html/user/forum_rss.php +++ b/html/user/forum_rss.php @@ -122,7 +122,7 @@ foreach ($threads as $thread) { ".strip_tags($thread->title)." $unique_url $unique_url - ".substr(strip_tags($post->content),0,255)." . . . + ".htmlspecialchars(htmlspecialchars(substr($post->content,0,255)))." . . . $post_date ";