URLs must be escaped inside XML, e.g. inside the <link> container, too.

[matthijs/upstream/blosxom.git] / blosxom.cgi

diff --git a/blosxom.cgi b/blosxom.cgi
index e415d60984c50e6f0596c595632d5a429ebb5546..341d2967c87773a2922f7975c4ddef395afa8bfe 100755 (executable)
--- a/blosxom.cgi
+++ b/blosxom.cgi
@@ -667,11 +667,15 @@ sub generate {
                     '<' => '&lt;',
                     '>' => '&gt;',
                     '&' => '&amp;',
-                    '"' => '&quot;'
+                    '"' => '&quot;',
+                    "'" => '&apos;'
                 );
                 my $escape_re = join '|' => keys %escape;
                 $title =~ s/($escape_re)/$escape{$1}/g;
                 $body  =~ s/($escape_re)/$escape{$1}/g;
+                $url   =~ s/($escape_re)/$escape{$1}/g;
+                $path  =~ s/($escape_re)/$escape{$1}/g;
+                $fn    =~ s/($escape_re)/$escape{$1}/g;
             }
 
             $story = &$interpolate($story);