From fd1b5e9343b6fe92b4e5dfbbc2f01ddfcd010af9 Mon Sep 17 00:00:00 2001
From: Alexandre Alapetite <alexandre@alapetite.fr>
Date: Thu, 12 Sep 2024 11:04:49 +0200
Subject: Fix inversed encoding logic in paramArray (#6800)

* Fix inversed encoding logic in paramArray
https://github.com/FreshRSS/FreshRSS/pull/6797#discussion_r1754661634
Also fix the possibility to use `<'&">` in shortcuts, and some minor encoding bugs in user queries

* Forgot paramArrayString
---
 app/views/configure/shortcut.phtml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

(limited to 'app/views/configure/shortcut.phtml')

diff --git a/app/views/configure/shortcut.phtml b/app/views/configure/shortcut.phtml
index 78b659120..b7930f263 100644
--- a/app/views/configure/shortcut.phtml
+++ b/app/views/configure/shortcut.phtml
@@ -16,7 +16,9 @@
 		<?php } ?>
 	</datalist>
 
-	<?php $s = FreshRSS_Context::userConf()->shortcuts; ?>
+	<?php
+		$s = array_map(static fn(string $string) => htmlspecialchars($string, ENT_COMPAT, 'UTF-8'), FreshRSS_Context::userConf()->shortcuts);
+	?>
 
 	<?php if ([] !== $nonStandard = getNonStandardShortcuts($s)): ?>
 		<p class="alert alert-error">
-- 
cgit v1.2.3