diff --git a/NEWS b/NEWS index a0fd34d7..95735f14 100644 --- a/NEWS +++ b/NEWS @@ -1,3 +1,4 @@ + - fix html_options to not escape already escaped entities (Monte) - send Last-Modified header on cache creation (Monte) - check strict syntax of function attributes (Monte) - dropped support for modifers on object parameters, diff --git a/libs/plugins/function.html_options.php b/libs/plugins/function.html_options.php index 450524da..068164a0 100644 --- a/libs/plugins/function.html_options.php +++ b/libs/plugins/function.html_options.php @@ -38,11 +38,11 @@ function smarty_function_html_options($params, &$smarty) function smarty_function_html_options_optoutput($key, $value, $selected) { if(!is_array($value)) { - $html_result = '' . "\n"; } else { $html_result = smarty_function_html_options_optgroup($key, $value, $selected); } @@ -50,7 +50,7 @@ function smarty_function_html_options_optoutput($key, $value, $selected) { } function smarty_function_html_options_optgroup($key, $values, $selected) { - $optgroup_html = '' . "\n"; + $optgroup_html = '' . "\n"; foreach ($values as $key => $value) { $optgroup_html .= smarty_function_html_options_optoutput($key, $value, $selected); } @@ -58,6 +58,14 @@ function smarty_function_html_options_optgroup($key, $values, $selected) { return $optgroup_html; } +function smarty_function_html_options_htmlspecialchars($text) { + // do not escape already escaped entities (& {) + $text = preg_replace('!&(#?\w+);!', '%%%SMARTY_START%%%\\1%%%SMARTY_END%%%', $text); + $text = htmlspecialchars($text); + $text = str_replace(array('%%%SMARTY_START%%%','%%%SMARTY_END%%%'), array('&',';'), $text); + return $text; +} + /* vim: set expandtab: */ ?> diff --git a/plugins/function.html_options.php b/plugins/function.html_options.php index 450524da..068164a0 100644 --- a/plugins/function.html_options.php +++ b/plugins/function.html_options.php @@ -38,11 +38,11 @@ function smarty_function_html_options($params, &$smarty) function smarty_function_html_options_optoutput($key, $value, $selected) { if(!is_array($value)) { - $html_result = '' . "\n"; } else { $html_result = smarty_function_html_options_optgroup($key, $value, $selected); } @@ -50,7 +50,7 @@ function smarty_function_html_options_optoutput($key, $value, $selected) { } function smarty_function_html_options_optgroup($key, $values, $selected) { - $optgroup_html = '' . "\n"; + $optgroup_html = '' . "\n"; foreach ($values as $key => $value) { $optgroup_html .= smarty_function_html_options_optoutput($key, $value, $selected); } @@ -58,6 +58,14 @@ function smarty_function_html_options_optgroup($key, $values, $selected) { return $optgroup_html; } +function smarty_function_html_options_htmlspecialchars($text) { + // do not escape already escaped entities (& {) + $text = preg_replace('!&(#?\w+);!', '%%%SMARTY_START%%%\\1%%%SMARTY_END%%%', $text); + $text = htmlspecialchars($text); + $text = str_replace(array('%%%SMARTY_START%%%','%%%SMARTY_END%%%'), array('&',';'), $text); + return $text; +} + /* vim: set expandtab: */ ?>