Fix forceSimpleAmpersand config implementation

Run ampersand replacement after the htmlEncodeAttr, otherwise the results are overwritten (ckeditor#965)
alexmaris · Sep 26, 2017 · 48d6201 · 48d6201 · j-koehler · Sep 10, 2018
1 parent a0ba16d
commit 48d6201
Showing 1 changed file with 3 additions and 1 deletion.
diff --git a/plugins/htmlwriter/plugin.js b/plugins/htmlwriter/plugin.js
@@ -179,9 +179,11 @@ CKEDITOR.htmlWriter = CKEDITOR.tools.createClass( {
 		attribute: function( attName, attValue ) {
 
 			if ( typeof attValue == 'string' ) {
-				this.forceSimpleAmpersand && ( attValue = attValue.replace( /&amp;/g, '&' ) );
 				// Browsers don't always escape special character in attribute values. (http://dev.ckeditor.com/ticket/4683, http://dev.ckeditor.com/ticket/4719).
 				attValue = CKEDITOR.tools.htmlEncodeAttr( attValue );
+
+				// Run ampersand replacement after the  htmlEncodeAttr, otherwise the results are overwritten (https://github.com/ckeditor/ckeditor-dev/issues/965)
+				this.forceSimpleAmpersand && ( attValue = attValue.replace( /&amp;/g, '&' ) );
 			}
 
 			this._.output.push( ' ', attName, '="', attValue, '"' );