Fix bug #2934891: RSS XML was sometimes invalid because

 special characters did not get escaped.

git-svn-id: https://semanticscuttle.svn.sourceforge.net/svnroot/semanticscuttle/trunk@617 b3834d28-1941-0410-a4f8-b48e95affb8f

diff --git a/data/templates/rss.tpl.php b/data/templates/rss.tpl.php
index 21bdeabcd52fbefee5166b9c5ae37af34039ef68..e6e66f764c69ac13c70ce0a6ee188e9550a5d98c 100644 (file)
--- a/data/templates/rss.tpl.php
+++ b/data/templates/rss.tpl.php
@@ -3,22 +3,22 @@ echo '<' . '?xml version="1.0" encoding="utf-8" ?' . ">\n";
 ?>
 <rss version="2.0" xmlns:dc="http://purl.org/dc/elements/1.1/">
 <channel>
-    <title><?php echo $feedtitle; ?></title> 
-    <link><?php echo $feedlink; ?></link> 
-    <description><?php echo $feeddescription; ?></description>
+    <title><?php echo htmlspecialchars($feedtitle); ?></title>
+    <link><?php echo htmlspecialchars($feedlink); ?></link>
+    <description><?php echo htmlspecialchars($feeddescription); ?></description>
     <pubDate><?php echo date('r'); ?></pubDate>
     <lastBuildDate><?php echo $feedlastupdate ?></lastBuildDate>
     <ttl>60</ttl>
 
 <?php foreach($bookmarks as $bookmark): ?>
     <item>
-        <title><?php echo $bookmark['title']; ?></title>
-        <link><?php echo $bookmark['link']; ?></link>
-        <description><?php echo $bookmark['description']; ?></description>
-        <dc:creator><?php echo $bookmark['creator']; ?></dc:creator>
+        <title><?php echo htmlspecialchars($bookmark['title']); ?></title>
+        <link><?php echo htmlspecialchars($bookmark['link']); ?></link>
+        <description><?php echo htmlspecialchars($bookmark['description']); ?></description>
+        <dc:creator><?php echo htmlspecialchars($bookmark['creator']); ?></dc:creator>
         <pubDate><?php echo $bookmark['pubdate']; ?></pubDate>
 <?php foreach($bookmark['tags'] as $tag): ?>
-        <category><?php echo $tag; ?></category>
+        <category><?php echo htmlspecialchars($tag); ?></category>
 <?php endforeach; ?>
     </item>
 <?php endforeach; ?>

diff --git a/doc/ChangeLog b/doc/ChangeLog
index 1f44ed9d43564b9480c195f18bb53d2ec439b10e..9c7fa0e3d5fff6332e014afa1301700b77c201ea 100644 (file)
--- a/doc/ChangeLog
+++ b/doc/ChangeLog
@@ -15,6 +15,8 @@ ChangeLog for SemantiScuttle
   Patch by fnorder@users.sourceforge.net
 - Implement request #2934872: Option to set the "no description"
   description. Patch by fnorder@users.sourceforge.net
+- Fix bug #2934891: RSS XML was sometimes invalid because
+  special characters did not get escaped.
 
 
 0.95.2 - 2010-01-16