Author: NickSdot (NickSdot) Committer: Tim Düsterhus (TimWolla) Date: 2026-07-19T17:17:26+02:00
Commit: https://github.com/php/web-news/commit/093f9cb2fce9e1468e1e888612f5301a7b1b48a3 Raw diff: https://github.com/php/web-news/commit/093f9cb2fce9e1468e1e888612f5301a7b1b48a3.diff Escape archived message author display names Reported by “ABHI SECURITY RESEARCHER”. Changed paths: M lib/common.php Diff: diff --git a/lib/common.php b/lib/common.php index 944dbd2..bbc3940 100644 --- a/lib/common.php +++ b/lib/common.php @@ -255,8 +255,10 @@ function format_author($a, $charset = 'iso-8859-1', $nameOnly = false) } else { $email = $name = $a; } + $name = clean($name); + if ($nameOnly) { - return str_replace(" ", " ", htmlspecialchars($name, ENT_QUOTES, "UTF-8")); + return str_replace(" ", " ", $name); } else { return "<a href=\"mailto:"; . htmlspecialchars(urlencode($email), ENT_QUOTES, "UTF-8") .
