Backported r2170 from trunk.

git-svn-id: svn+ssh://rubyforge.org/var/svn/redmine/branches/0.7-stable@2176 e93f8b46-1217-0410-a6f0-8f06a7374b81

diff --git a/lib/redcloth.rb b/lib/redcloth.rb
index 4faa4b9e59504f904e1c9e862d5735c2464f42ee..421346cc773002d9332de2e3eba29596e755d4ca 100644 (file)
--- a/lib/redcloth.rb
+++ b/lib/redcloth.rb
@@ -465,7 +465,7 @@ class RedCloth < String
             style << "vertical-align:#{ v_align( $& ) };" if text =~ A_VLGN
         end
 
-        style << "#{ $1 };" if not filter_styles and
+        style << "#{ htmlesc $1 };" if not filter_styles and
             text.sub!( /\{([^}]*)\}/, '' )
 
         lang = $1 if
@@ -786,7 +786,7 @@ class RedCloth < String
             
             atts = pba( atts )
             atts = " href=\"#{ url }#{ slash }\"#{ atts }"
-            atts << " title=\"#{ title }\"" if title
+            atts << " title=\"#{ htmlesc title }\"" if title
             atts = shelve( atts ) if atts
             
             external = (url =~ /^https?:\/\//) ? ' class="external"' : ''

diff --git a/test/unit/helpers/application_helper_test.rb b/test/unit/helpers/application_helper_test.rb
index e20866786bbed3d306c9c320f7e4a549ccfc6e9c..04449d9219d57907051ecfbbdeb029be423c44cf 100644 (file)
--- a/test/unit/helpers/application_helper_test.rb
+++ b/test/unit/helpers/application_helper_test.rb
@@ -61,6 +61,7 @@ class ApplicationHelperTest < HelperTestCase
       'This is a "link":http://foo.bar' => 'This is a <a href="http://foo.bar" class="external">link</a>',
       'This is an intern "link":/foo/bar' => 'This is an intern <a href="/foo/bar">link</a>',
       '"link (Link title)":http://foo.bar' => '<a href="http://foo.bar" title="Link title" class="external">link</a>',
+      '"link (Link title with "double-quotes")":http://foo.bar' => '<a href="http://foo.bar" title="Link title with &quot;double-quotes&quot;" class="external">link</a>',
       # no multiline link text
       "This is a double quote \"on the first line\nand another on a second line\":test" => "This is a double quote \"on the first line<br />\nand another on a second line\":test"
     }