Proper fix for gravatar URL '&' encoding

This partially reverts the change introduced in issue #21804 (see commit fa2e717), letting the caller escape the URL as needed. Fixes #21844
mantisbt · Nov 12, 2016 · aa2a3c0 · aa2a3c0
1 parent d47f367
commit aa2a3c0
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 5 deletions.
diff --git a/core/classes/TimelineEvent.class.php b/core/classes/TimelineEvent.class.php
@@ -80,9 +80,9 @@ public function html_start() {
 
 		return sprintf(
 			'<div class="entry"><div class="avatar"><a href="%s"><img class="avatar" src="%s" alt="%s" width="32" height="32" /></a></div><div class="timestamp">%s</div>',
-			$t_avatar->link,
-			$t_avatar->image,
-			$t_avatar->text,
+			htmlspecialchars( $t_avatar->link ),
+			htmlspecialchars( $t_avatar->image ),
+			htmlspecialchars( $t_avatar->text ),
 			$this->format_timestamp( $this->timestamp )
 		);
 	}

diff --git a/plugins/Gravatar/Gravatar.php b/plugins/Gravatar/Gravatar.php
@@ -153,8 +153,7 @@ function user_get_avatar( $p_event, $p_user_id, $p_size = 80 ) {
 					'd' => $t_default_avatar,
 					'r' => $t_rating,
 					's' => $p_size,
-				),
-				'', '&amp;'
+				)
 			);
 
 		$t_avatar = new Avatar();