diff --git a/src/Lib/Activity.php b/src/Lib/Activity.php index a50ddaae9..a9516d525 100644 --- a/src/Lib/Activity.php +++ b/src/Lib/Activity.php @@ -4813,11 +4813,10 @@ class Activity if (isset($a['image'])) { if (self::media_not_in_body($a['image'], $item['body']) && self::media_not_in_body($a['href'], $item['body'])) { if (isset($a['name']) && $a['name']) { - $alt = htmlspecialchars($a['name'], ENT_QUOTES, 'UTF-8', false); // Escape brackets by converting to unicode full-width bracket since regular brackets will confuse multicode/bbcode parsing. // The full width bracket isn't quite as alien looking as most other unicode bracket replacements. // Do the same for double-quotes; which may present issues with the HTML purifier and when rendered as HTML attributes. - $alt = str_replace(['[', ']', '\"', '"', '"'], ['[', ']', '"', '"', '"'], $alt); + $alt = str_replace(['[', ']', '\\"', '\"', '"', '"'], ['[', ']', '"', '"', '"', '"'], $a['name']); $alt = htmlspecialchars($alt, ENT_QUOTES, 'UTF-8', false); $item['body'] .= "\n\n" . '[img alt="' . $alt . '"]' . $a['href'] . '[/img]'; } else { $item['body'] .= "\n\n" . '[img]' . $a['href'] . '[/img]'; @@ -4827,10 +4826,10 @@ class Activity } elseif (self::media_not_in_body($a['href'], $item['body'])) { if (isset($a['name']) && $a['name']) { - $alt = htmlspecialchars($a['name'], ENT_QUOTES, 'UTF-8', false); // Escape brackets by converting to unicode full-width bracket since regular brackets will confuse multicode/bbcode parsing. // The full width bracket isn't quite as alien looking as most other unicode bracket replacements. - $alt = str_replace(['[', ']', '\"', '"', '"'], ['[', ']', '"', '"', '"'], $alt); + // Do the same for double-quotes; which may present issues with the HTML purifier and when rendered as HTML attributes. + $alt = str_replace(['[', ']', '\\"', '\"', '"', '"'], ['[', ']', '"', '"', '"', '"'], $a['name']); $alt = htmlspecialchars($alt, ENT_QUOTES, 'UTF-8', false); $item['body'] .= "\n\n" . '[img alt="' . $alt . '"]' . $a['href'] . '[/img]'; } else { $item['body'] .= "\n\n" . '[img]' . $a['href'] . '[/img]';