BBCode converters did not handle encoded HTML entities

diff --git a/wcfsetup/install/files/lib/system/html/metacode/converter/CodeMetacodeConverter.class.php b/wcfsetup/install/files/lib/system/html/metacode/converter/CodeMetacodeConverter.class.php
index 01b4035a76f1d266e0da13a24f23e2a0cb6f5f18..6e06b599abac9082ada0e610babb84d9a0165f84 100644 (file)
--- a/wcfsetup/install/files/lib/system/html/metacode/converter/CodeMetacodeConverter.class.php
+++ b/wcfsetup/install/files/lib/system/html/metacode/converter/CodeMetacodeConverter.class.php
@@ -61,7 +61,7 @@ class CodeMetacodeConverter extends AbstractMetacodeConverter {
                                break;
                }
                
-               $element->setAttribute('data-file', $file);
+               $element->setAttribute('data-file', StringUtil::decodeHTML($file));
                $element->setAttribute('data-highlighter', $highlighter);
                $element->setAttribute('data-line', $line);
                

diff --git a/wcfsetup/install/files/lib/system/html/metacode/converter/ImgMetacodeConverter.class.php b/wcfsetup/install/files/lib/system/html/metacode/converter/ImgMetacodeConverter.class.php
index 8a1dfafa6595e9fb4060aefdad59c0ce3b1eeccf..7d10e672f44234429a21ab78d69297d6eb1f6ffb 100644 (file)
--- a/wcfsetup/install/files/lib/system/html/metacode/converter/ImgMetacodeConverter.class.php
+++ b/wcfsetup/install/files/lib/system/html/metacode/converter/ImgMetacodeConverter.class.php
@@ -1,5 +1,6 @@
 <?php
 namespace wcf\system\html\metacode\converter;
+use wcf\util\StringUtil;
 
 /**
  * Converts img bbcode into `<img>`.
@@ -16,7 +17,7 @@ class ImgMetacodeConverter extends AbstractMetacodeConverter {
         */
        public function convert(\DOMDocumentFragment $fragment, array $attributes) {
                $element = $fragment->ownerDocument->createElement('img');
-               $element->setAttribute('src', $attributes[0]);
+               $element->setAttribute('src', StringUtil::decodeHTML($attributes[0]));
                
                if (isset($attributes[1]) && in_array($attributes[1], ['left', 'right'])) {
                        $element->setAttribute('class', 'messageFloatObject'.ucfirst($attributes[1]));

diff --git a/wcfsetup/install/files/lib/system/html/metacode/converter/QuoteMetacodeConverter.class.php b/wcfsetup/install/files/lib/system/html/metacode/converter/QuoteMetacodeConverter.class.php
index 88c6fe8220cba3e2daf9e4919d22071aedb3d640..d0df2135ec08deb863b67de82e923215e1329cf3 100644 (file)
--- a/wcfsetup/install/files/lib/system/html/metacode/converter/QuoteMetacodeConverter.class.php
+++ b/wcfsetup/install/files/lib/system/html/metacode/converter/QuoteMetacodeConverter.class.php
@@ -1,5 +1,6 @@
 <?php
 namespace wcf\system\html\metacode\converter;
+use wcf\util\StringUtil;
 
 /**
  * Converts quote bbcode into `<woltlab-quote>`.
@@ -16,8 +17,8 @@ class QuoteMetacodeConverter extends AbstractMetacodeConverter {
         */
        public function convert(\DOMDocumentFragment $fragment, array $attributes) {
                $element = $fragment->ownerDocument->createElement('woltlab-quote');
-               $element->setAttribute('data-author', isset($attributes[0]) ? $attributes[0] : '');
-               $element->setAttribute('data-link', isset($attributes[1]) ? $attributes[1] : '');
+               $element->setAttribute('data-author', isset($attributes[0]) ? StringUtil::decodeHTML($attributes[0]) : '');
+               $element->setAttribute('data-link', isset($attributes[1]) ? StringUtil::decodeHTML($attributes[1]) : '');
                $element->appendChild($fragment);
                
                return $element;

diff --git a/wcfsetup/install/files/lib/system/html/metacode/converter/SpoilerMetacodeConverter.class.php b/wcfsetup/install/files/lib/system/html/metacode/converter/SpoilerMetacodeConverter.class.php
index 9886aa447f0ab7f0b221a2ce0808dc87aa1843fd..178a7ea817365d78bfaee2074f92e067df378aab 100644 (file)
--- a/wcfsetup/install/files/lib/system/html/metacode/converter/SpoilerMetacodeConverter.class.php
+++ b/wcfsetup/install/files/lib/system/html/metacode/converter/SpoilerMetacodeConverter.class.php
@@ -17,7 +17,7 @@ class SpoilerMetacodeConverter extends AbstractMetacodeConverter {
         */
        public function convert(\DOMDocumentFragment $fragment, array $attributes) {
                $element = $fragment->ownerDocument->createElement('woltlab-spoiler');
-               $element->setAttribute('data-label', (!empty($attributes[0])) ? StringUtil::trim($attributes[0]) : '');
+               $element->setAttribute('data-label', (!empty($attributes[0])) ? StringUtil::trim(StringUtil::decodeHTML($attributes[0])) : '');
                $element->appendChild($fragment);
                
                return $element;

diff --git a/wcfsetup/install/files/lib/system/html/metacode/converter/UrlMetacodeConverter.class.php b/wcfsetup/install/files/lib/system/html/metacode/converter/UrlMetacodeConverter.class.php
index 5d1f195fce11a1b146aeb7614822b9600f50af9a..4e2ec3be9ceeb8309cbf4cdf89d6704950aaa9de 100644 (file)
--- a/wcfsetup/install/files/lib/system/html/metacode/converter/UrlMetacodeConverter.class.php
+++ b/wcfsetup/install/files/lib/system/html/metacode/converter/UrlMetacodeConverter.class.php
@@ -23,6 +23,8 @@ class UrlMetacodeConverter extends AbstractMetacodeConverter {
                        $href = $fragment->textContent;
                }
                
+               $href = StringUtil::decodeHTML($href);
+               
                // check if the link is empty, use the href value instead
                $useHrefAsValue = false;
                if ($fragment->childNodes->length === 0) {