Since only the body text of a notification may contain markup,
by combining the two together and calling set_markup(), the
title would also get interpreted as if it had markup.
This could be seen with:
$ notify-send "Title & text" "<i>body text</i>"

The unescaped & would get interpreted as broken markup and so
naughty would fall back to escaping everything which would make
the "<i>" tags be shown rather than interpreted.

So, the title must always be escaped so that it is not interpreted
as markup.

Signed-off-by: Ross Lagerwall <[email protected]>
---
 lib/naughty.lua.in | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/lib/naughty.lua.in b/lib/naughty.lua.in
index cf015c2..228ff17 100644
--- a/lib/naughty.lua.in
+++ b/lib/naughty.lua.in
@@ -303,6 +303,8 @@ function naughty.notify(args)
     local margin = args.margin or preset.margin
     local border_width = args.border_width or preset.border_width
     local position = args.position or preset.position
+    local escape_pattern = "[<>&]"
+    local escape_subs = { ['<'] = "&lt;", ['>'] = "&gt;", ['&'] = "&amp;" }
 
     -- beautiful
     local beautiful = bt.get()
@@ -376,17 +378,20 @@ function naughty.notify(args)
     textbox:set_font(font)
 
     local function setMarkup(pattern, replacements)
-        textbox:set_markup(string.format('<b>%s</b>%s', title:gsub(pattern, 
replacements), text:gsub(pattern, replacements)))
+        textbox:set_markup(string.format('<b>%s</b>%s', title, 
text:gsub(pattern, replacements)))
     end
     local function setText()
         textbox:set_text(string.format('%s %s', title, text))
     end
 
-    -- First try to set the text while only interpreting <br>.
+    -- Since the title cannot contain markup, it must be escaped first so that
+    -- it is not interpreted by Pango later.
+    title = title:gsub(escape_pattern, escape_subs)
+    -- Try to set the text while only interpreting <br>.
     -- (Setting a textbox' .text to an invalid pattern throws a lua error)
     if not pcall(setMarkup, "<br.->", "\n") then
         -- That failed, escape everything which might cause an error from pango
-        if not pcall(setMarkup, "[<>&]", { ['<'] = "&lt;", ['>'] = "&gt;", 
['&'] = "&amp;" }) then
+        if not pcall(setMarkup, escape_pattern, escape_subs) then
             -- Ok, just ignore all pango markup. If this fails, we got some 
invalid utf8
             if not pcall(setText) then
                 textbox:set_markup("<i>&lt;Invalid markup or UTF8, cannot 
display message&gt;</i>")
-- 
1.8.2


-- 
To unsubscribe, send mail to [email protected].

Reply via email to