dangerous values in usernames for shared messages from diaspora are now encoded.

diff --git a/include/diaspora.php b/include/diaspora.php
index 0deb3cc2bb86222ec9aa153f98d51b698ef9bafb..abc518cd59edc2c3930e4153c2f3997d3f8b0f26 100755 (executable)
--- a/include/diaspora.php
+++ b/include/diaspora.php
@@ -1041,10 +1041,10 @@ function diaspora_reshare($importer,$xml,$msg) {
        $datarray['owner-link'] = $contact['url'];
        $datarray['owner-avatar'] = ((x($contact,'thumb')) ? $contact['thumb'] : $contact['photo']);
        if (!intval(get_config('system','wall-to-wall_share'))) {
-               $prefix = "[share author='".str_replace("'", "'",$person['name']).
+               $prefix = "[share author='".str_replace(array("'", "[", "]"), array("'", "[", "]"),$person['name']).
                                "' profile='".$person['url'].
                                "' avatar='".((x($person,'thumb')) ? $person['thumb'] : $person['photo']).
-                               "' link='".$orig_url."']";
+                               "' link='".str_replace(array("'", "[", "]"), array("'", "[", "]"),$orig_url)."']";
                $datarray['author-name'] = $contact['name'];
                $datarray['author-link'] = $contact['url'];
                $datarray['author-avatar'] = $contact['thumb'];