Fix HTML encodings in e.g. cURL options (#6821)

* Fix HTML encodings in e.g. cURL options

* Trim headers whitespace

1 files changed, 5 insertions, 4 deletions

diff --git a/lib/Minz/Request.php b/lib/Minz/Request.php
index 13a4f6841..b4d4549a9 100644
--- a/lib/Minz/Request.php
+++ b/lib/Minz/Request.php
@@ -142,14 +142,15 @@ class Minz_Request {
 	 * It will return an array where each cell contains one line of a text. The new line
 	 * character is used to break the text into lines. This method is well suited to use
 	 * to split textarea content.
-	 * @param array<string> $default
+	 * @param bool $plaintext `true` to return special characters without any escaping (unsafe), `false` (default) to XML-encode them
 	 * @return array<string>
 	 */
-	public static function paramTextToArray(string $key, array $default = []): array {
+	public static function paramTextToArray(string $key, bool $plaintext = false): array {
 		if (isset(self::$params[$key]) && is_string(self::$params[$key])) {
-			return preg_split('/\R/u', self::$params[$key]) ?: [];
+			$result = preg_split('/\R/u', self::$params[$key]) ?: [];
+			return $plaintext ? $result : Minz_Helper::htmlspecialchars_utf8($result);
 		}
-		return $default;
+		return [];
 	}
 
 	public static function defaultControllerName(): string {