From f6c4b20f694794030e0d1a52f158a59f3122f6f0 Mon Sep 17 00:00:00 2001
From: garvinhicking <garvinhicking>
Date: Tue, 27 Nov 2007 16:02:06 +0000
Subject: [PATCH]     * Encode RSS feed links, Patch by Hanno Boeck

---
 docs/NEWS                                                 | 2 ++
 .../serendipity_plugin_remoterss.php                      | 8 ++++----
 2 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/docs/NEWS b/docs/NEWS
index b590a3a..279ae24 100644
--- a/docs/NEWS
+++ b/docs/NEWS
@@ -3,6 +3,8 @@
 Version 1.2.1 ()
 ------------------------------------------------------------------------
 
+    * Encode RSS feed links, Patch by Hanno Boeck
+    
     * Fix spartacus filter listing showing event plugin groups in the
       sidebar listing.
       
diff --git a/plugins/serendipity_plugin_remoterss/serendipity_plugin_remoterss.php b/plugins/serendipity_plugin_remoterss/serendipity_plugin_remoterss.php
index 3c2d8e7..edcb8d1 100644
--- a/plugins/serendipity_plugin_remoterss/serendipity_plugin_remoterss.php
+++ b/plugins/serendipity_plugin_remoterss/serendipity_plugin_remoterss.php
@@ -257,7 +257,7 @@ class serendipity_plugin_remoterss extends serendipity_plugin {
         $propbag->add('description',   PLUGIN_REMOTERSS_BLAHBLAH);
         $propbag->add('stackable',     true);
         $propbag->add('author',        'Udo Gerhards, Richard Thomas Harrison');
-        $propbag->add('version',       '1.10');
+        $propbag->add('version',       '1.11');
         $propbag->add('requirements',  array(
             'serendipity' => '0.8',
             'smarty'      => '2.6.7',
@@ -481,7 +481,7 @@ class serendipity_plugin_remoterss extends serendipity_plugin {
                         }
 
                         if ($use_rss_link) {
-                            $content .= '<a href="' . $this->decode($item['link']) . '" ' . (!empty($target) ? 'target="'.$target.'"' : '') . '>';
+                            $content .= '<a href="' . htmlspecialchars($this->decode($item['link'])) . '" ' . (!empty($target) ? 'target="'.$target.'"' : '') . '>';
                         }
 
                         if (!empty($bulletimg)) {
@@ -571,13 +571,13 @@ class serendipity_plugin_remoterss extends serendipity_plugin {
                             }
 
                             if ($blogrolling === true && (!empty($text) || !empty($url))) {
-                                $content .= '&bull; <a href="' . $url . '" ' . (!empty($target) ? 'target="'.$target.'"' : '') . ' title="' . $text . '">' . htmlspecialchars($text) . "</a>";
+                                $content .= '&bull; <a href="' . htmlspecialchars($url) . '" ' . (!empty($target) ? 'target="'.$target.'"' : '') . ' title="' . $text . '">' . htmlspecialchars($text) . "</a>";
                                 if (isset($item['isRecent'])) {
                                     $content .= ' <span style="color: Red; ">*</span>';
                                 }
                                 $content .= "<br />";
                             } elseif ((isset($item['type']) && $item['type'] == 'url') || !empty($url)) {
-                                $content .= '&bull; <a href="' .$url . '" ' . (!empty($target) ? 'target="'.$target.'"' : '') . ' title="' . $text . '">' . $text . "</a>";
+                                $content .= '&bull; <a href="' . htmlspecialchars($url) . '" ' . (!empty($target) ? 'target="'.$target.'"' : '') . ' title="' . $text . '">' . $text . "</a>";
                                 $content .= "<br />";
                             }
                             ++$i;
-- 
2.39.5