CVE-2023-4007: fix: added missing conversion to HTML entities · thorsten/phpMyFAQ@40eb968

Expand Up @@ -315,11 +315,11 @@ public function toHtmlAnchor(): string }
if (!empty($this->tooltip)) { $htmlAnchor .= sprintf(' title="%s"’, addslashes($this->tooltip)); $htmlAnchor .= sprintf(' title="%s"’, Strings::htmlentities($this->tooltip)); }
if (!empty($this->name)) { $htmlAnchor .= sprintf(' name="%s"’, $this->name); $htmlAnchor .= sprintf(' name="%s"’, Strings::htmlentities($this->name)); } else { if (!empty($this->url)) { $htmlAnchor .= sprintf(' href="%s"’, $url); Expand All @@ -333,10 +333,10 @@ public function toHtmlAnchor(): string } $htmlAnchor .= '>’; if ((‘0’ == $this->text) || (!empty($this->text))) { $htmlAnchor .= $this->text; $htmlAnchor .= Strings::htmlentities($this->text); } else { if (!empty($this->name)) { $htmlAnchor .= $this->name; $htmlAnchor .= Strings::htmlentities($this->name); } else { $htmlAnchor .= $url; } Expand Down