Author: NickSdot (NickSdot)
Committer: Tim Düsterhus (TimWolla)
Date: 2026-07-19T17:17:26+02:00
Commit: Escape archived message author display names · php/web-news@093f9cb · GitHub
Raw diff: https://github.com/php/web-news/commit/093f9cb2fce9e1468e1e888612f5301a7b1b48a3.diff
Escape archived message author display names
Reported by “ABHI SECURITY RESEARCHER”.
Changed paths:
M lib/common.php
Diff:
diff --git a/lib/common.php b/lib/common.php
index 944dbd2..bbc3940 100644
--- a/lib/common.php
+++ b/lib/common.php
@@ -255,8 +255,10 @@ function format_author($a, $charset = 'iso-8859-1', $nameOnly = false)
} else {
$email = $name = $a;
}
+ $name = clean($name);
+
if ($nameOnly) {
- return str_replace(" ", " ", htmlspecialchars($name, ENT_QUOTES, "UTF-8"));
+ return str_replace(" ", " ", $name);
} else {
return "<a href=\"mailto:" .
htmlspecialchars(urlencode($email), ENT_QUOTES, "UTF-8") .