Zander/zanders-php-markdown
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Case <"A"@example.com>. Quotes not properly escaped inside the href attribute.

Browse source 
Fixes #139.
This commit is contained in:
Michel Fortin 2014-05-04 21:06:26 -04:00
parent 97e594d329
commit de989d7c21
1 changed files with 2 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
Michelf/Markdown.php
View file

@ -1351,7 +1351,8 @@ class Markdown implements MarkdownInterface {
$r = ($seed * (1 + $key)) % 100; # Pseudo-random function.
# roughly 10% raw, 45% hex, 45% dec
# '@' *must* be encoded. I insist.
if ($r > 90 && $char != '@') /* do nothing */;
# '"' has to be encoded inside the attribute
if ($r > 90 && $char != '@' && $char != '"') /* do nothing */;
else if ($r < 45) $chars[$key] = '&#x'.dechex($ord).';';
else $chars[$key] = '&#'.$ord.';';
}