The decodeBB did not escape <>, keep this functionality.

2011-01-28 23:12:18 +01:00
parent 59f561b450
commit cc8e3849cf
2 changed files with 5 additions and 4 deletions
--- a/libraries/Message.class.php
+++ b/libraries/Message.class.php
@@ -654,7 +654,7 @@ class PMA_Message
     */
    static public function decodeBB($message)
    {
-        return PMA_sanitize($message, false);
+        return PMA_sanitize($message, false, true);
    }

    /**
--- a/libraries/sanitizing.lib.php
+++ b/libraries/sanitizing.lib.php
@@ -27,11 +27,12 @@
 *
 * @access  public
 */
-function PMA_sanitize($message, $escape = false)
+function PMA_sanitize($message, $escape = false, $safe = false)
 {
+    if (!$safe) {
+        $message = strtr($message, array('<' => '&lt;', '>' => '&gt;'));
+    }
    $replace_pairs = array(
-        '<'         => '&lt;',
-        '>'         => '&gt;',
        '[i]'       => '<em>',      // deprecated by em
        '[/i]'      => '</em>',     // deprecated by em
        '[em]'      => '<em>',