[web-news] master: Escape archived message author display names
| From: | NickSdot via Tim Düsterhus | Date: | Sun, 19 Jul 2026 15:18:32 +0000 |
| Subject: | [web-news] master: Escape archived message author display names | ||
| Groups: | php.webmaster | ||
| Request: | Send a blank email to php-webmaster+get-33882@lists.php.net to get a copy of this message | ||
Author: NickSdot (NickSdot)
Committer: Tim Düsterhus (TimWolla)
Date: 2026-07-19T17:17:26+02:00
Commit: https://github.com/php/web-news/commit/093f9cb2fce9e1468e1e888612f5301a7b1b48a3
Raw diff: https://github.com/php/web-news/commit/093f9cb2fce9e1468e1e888612f5301a7b1b48a3.diff
Escape archived message author display names
Reported by “ABHI SECURITY RESEARCHER”.
Changed paths:
M lib/common.php
Diff:
diff --git a/lib/common.php b/lib/common.php
index 944dbd2..bbc3940 100644
--- a/lib/common.php
+++ b/lib/common.php
@@ -255,8 +255,10 @@ function format_author($a, $charset = 'iso-8859-1', $nameOnly =
false)
} else {
$email = $name = $a;
}
+ $name = clean($name);
+
if ($nameOnly) {
- return str_replace(" ", " ", htmlspecialchars($name,
ENT_QUOTES, "UTF-8"));
+ return str_replace(" ", " ", $name);
} else {
return "<a href=\"mailto:" .
htmlspecialchars(urlencode($email), ENT_QUOTES, "UTF-8") .