Htmlspecialchars in full view blog title

[coldtrick]

The full view of a blog returns a title which is htmlspecialcharred. This results in the following issue:

Blog with title Q & A results in full view as Q & A

Is the htmlspecialchar required there?

Fix could be to drop the htmlspecialchars in the following file:
mod/blog/lib/blog.php line 29

[coldtrick]

patch supplied in ​https://github.com/Elgg/Elgg/pull/268

[cash]

Elgg has a systematic problem of encoding submitted content and storing it encoded in the database and then double encoding it for display. A lot of this is due to the htmlawed plugin. I think this is likely the case for this one (the encoding should not be happening on the submission but should on the display).

There is a ticket for this problem. Don't recall the ticket number, but it is an early one.

[ewinslow]

Cash is right about this being a systemic problem, but I think the fix provided is correct whichever way we land on that issue. Escaping should be happening at the template level, not the page handler level.

[cash]

[bc92d109140453b216c412d1176bd37dd5b8943a]