Fix #12545: Escape RSS URL before outputting it to XHTML

main_page.php sets an RSS URL via a <link> tag to link to the RSS feed of the latest news. The RSS URL should be escaped prior to being inserted into the XHTML output so that the output remains well formed.
mantisbt · Nov 20, 2010 · 9761150 · 9761150
1 parent c75e5d3
commit 9761150
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/core/html_api.php b/core/html_api.php
@@ -146,7 +146,7 @@ function html_rss_link() {
 	global $g_rss_feed_url;
 
 	if( $g_rss_feed_url !== null ) {
-		echo '<link rel="alternate" type="application/rss+xml" title="RSS" href="', $g_rss_feed_url, '" />';
+		echo '<link rel="alternate" type="application/rss+xml" title="RSS" href="' . string_attribute( $g_rss_feed_url ) . "\" />\n";
 	}
 }