From d02b106dc6408c0e1d1183dd143486e684638182 Mon Sep 17 00:00:00 2001 From: Korvin Szanto Date: Mon, 3 Feb 2014 17:05:16 -0800 Subject: [PATCH] Wrap the feed text rendering stuff with `htmlspecialchars_decode` Summary: I've only seen this be an issue with PhabricatorBot. Test Plan: Comment on something with characters that are automatically converted like "<>", and see what the irc bot reports Reviewers: epriestley, #blessed_reviewers Reviewed By: epriestley CC: epriestley, aran Differential Revision: https://secure.phabricator.com/D8140 --- .../tokens/feed/PhabricatorTokenGivenFeedStory.php | 6 +++++- .../feed/PhabricatorApplicationTransactionFeedStory.php | 6 +++++- 2 files changed, 10 insertions(+), 2 deletions(-) diff --git a/src/applications/tokens/feed/PhabricatorTokenGivenFeedStory.php b/src/applications/tokens/feed/PhabricatorTokenGivenFeedStory.php index d448f0b989..370a54c55d 100644 --- a/src/applications/tokens/feed/PhabricatorTokenGivenFeedStory.php +++ b/src/applications/tokens/feed/PhabricatorTokenGivenFeedStory.php @@ -44,7 +44,11 @@ final class PhabricatorTokenGivenFeedStory public function renderText() { // TODO: This is grotesque; the feed notification handler relies on it. - return strip_tags(hsprintf('%s', $this->renderView()->render())); + return htmlspecialchars_decode( + strip_tags( + hsprintf( + '%s', + $this->renderView()->render()))); } } diff --git a/src/applications/transactions/feed/PhabricatorApplicationTransactionFeedStory.php b/src/applications/transactions/feed/PhabricatorApplicationTransactionFeedStory.php index 3b556b8489..a5af332ff3 100644 --- a/src/applications/transactions/feed/PhabricatorApplicationTransactionFeedStory.php +++ b/src/applications/transactions/feed/PhabricatorApplicationTransactionFeedStory.php @@ -66,7 +66,11 @@ class PhabricatorApplicationTransactionFeedStory public function renderText() { // TODO: This is grotesque; the feed notification handler relies on it. - return strip_tags(hsprintf('%s', $this->renderView()->render())); + return htmlspecialchars_decode( + strip_tags( + hsprintf( + '%s', + $this->renderView()->render()))); } }