From: keithhacks <111162058+keithhacks@users.noreply.github.com>
Date: Sun, 19 Nov 2023 23:23:29 +0000 (+0000)
Subject: HTML-escape notification contact names
X-Git-Url: https://git.mxchange.org/?a=commitdiff_plain;h=777d0d45c6bb06b312493acb33b35fe6f7b0f6db;p=friendica.git

HTML-escape notification contact names
---

diff --git a/src/Navigation/Notifications/Entity/Notify.php b/src/Navigation/Notifications/Entity/Notify.php
index ab042bc9f0..f24ea16ce6 100644
--- a/src/Navigation/Notifications/Entity/Notify.php
+++ b/src/Navigation/Notifications/Entity/Notify.php
@@ -134,6 +134,6 @@ class Notify extends BaseEntity
 	 */
 	public static function formatMessage(string $name, string $message): string
 	{
-		return str_replace('{0}', '<span class="contactname">' . BBCode::toPlaintext($name, false) . '</span>', htmlspecialchars($message));
+		return str_replace('{0}', '<span class="contactname">' . htmlspecialchars(BBCode::toPlaintext($name, false)) . '</span>', htmlspecialchars($message));
 	}
 }