Ticket #18250: wp-io-sanity-by-miqrogroove.patch

wp-includes/formatting.php

@@ -333 +333 @@
         }
 
         // Handle double encoding ourselves
-        if ( !$double_encode ) {
+        if ( $double_encode ) {
+                $string = @htmlspecialchars( $string, $quote_style, $charset );
+        } else {
+                // Decode & into &
                 $string = wp_specialchars_decode( $string, $_quote_style );
 
-                /* Critical */
-                // The previous line decodes &phrase; into &phrase;  We must guarantee that &phrase; is valid before proceeding.
+                // Guarantee every &entity; is valid or re-encode the &
                 $string = wp_kses_normalize_entities($string);
 
-                // Now proceed with custom double-encoding silliness
-                $string = preg_replace( '/&(#?x?[0-9a-z]+);/i', '|wp_entity|$1|/wp_entity|', $string );
-        }
+                // Now re-encode everything except &entity;
+                $string = preg_split( '/(&#?x?[0-9a-z]+;)/i', $string, -1, PREG_SPLIT_DELIM_CAPTURE );
 
-        $string = @htmlspecialchars( $string, $quote_style, $charset );
+                for ($i=0; $i < count($string); $i += 2)
+                        $string[$i] = @htmlspecialchars( $string[$i], $quote_style, $charset );
 
-        // Handle double encoding ourselves
-        if ( !$double_encode ) {
-                $string = str_replace( array( '|wp_entity|', '|/wp_entity|' ), array( '&', ';' ), $string );
+                $string = implode('', $string);
         }
 
         // Backwards compatibility