From 5e4d66ad504e4cd8209931a5f5f4cd539f0ecb93 Mon Sep 17 00:00:00 2001
From: Jean-Philippe Lang <jp_lang@yahoo.fr>
Date: Wed, 24 Dec 2008 11:56:36 +0000
Subject: [PATCH] Backported r2170 from trunk.

git-svn-id: svn+ssh://rubyforge.org/var/svn/redmine/branches/0.7-stable@2176 e93f8b46-1217-0410-a6f0-8f06a7374b81
---
 lib/redcloth.rb                              | 4 ++--
 test/unit/helpers/application_helper_test.rb | 1 +
 2 files changed, 3 insertions(+), 2 deletions(-)

diff --git a/lib/redcloth.rb b/lib/redcloth.rb
index 4faa4b9e5..421346cc7 100644
--- a/lib/redcloth.rb
+++ b/lib/redcloth.rb
@@ -465,7 +465,7 @@ class RedCloth < String
             style << "vertical-align:#{ v_align( $& ) };" if text =~ A_VLGN
         end
 
-        style << "#{ $1 };" if not filter_styles and
+        style << "#{ htmlesc $1 };" if not filter_styles and
             text.sub!( /\{([^}]*)\}/, '' )
 
         lang = $1 if
@@ -786,7 +786,7 @@ class RedCloth < String
             
             atts = pba( atts )
             atts = " href=\"#{ url }#{ slash }\"#{ atts }"
-            atts << " title=\"#{ title }\"" if title
+            atts << " title=\"#{ htmlesc title }\"" if title
             atts = shelve( atts ) if atts
             
             external = (url =~ /^https?:\/\//) ? ' class="external"' : ''
diff --git a/test/unit/helpers/application_helper_test.rb b/test/unit/helpers/application_helper_test.rb
index e20866786..04449d921 100644
--- a/test/unit/helpers/application_helper_test.rb
+++ b/test/unit/helpers/application_helper_test.rb
@@ -61,6 +61,7 @@ class ApplicationHelperTest < HelperTestCase
       'This is a "link":http://foo.bar' => 'This is a <a href="http://foo.bar" class="external">link</a>',
       'This is an intern "link":/foo/bar' => 'This is an intern <a href="/foo/bar">link</a>',
       '"link (Link title)":http://foo.bar' => '<a href="http://foo.bar" title="Link title" class="external">link</a>',
+      '"link (Link title with "double-quotes")":http://foo.bar' => '<a href="http://foo.bar" title="Link title with &quot;double-quotes&quot;" class="external">link</a>',
       # no multiline link text
       "This is a double quote \"on the first line\nand another on a second line\":test" => "This is a double quote \"on the first line<br />\nand another on a second line\":test"
     }
-- 
2.39.5