From ec36df97c4ea3da4bc177a96050c54cf8f35ba25 Mon Sep 17 00:00:00 2001
From: unarist <m.unarist@gmail.com>
Date: Sun, 17 Sep 2017 04:33:52 +0900
Subject: Escape URL parts on formatting local status (#4975)

---
 app/lib/formatter.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'app')

diff --git a/app/lib/formatter.rb b/app/lib/formatter.rb
index d9f843f44..575830190 100644
--- a/app/lib/formatter.rb
+++ b/app/lib/formatter.rb
@@ -137,7 +137,7 @@ class Formatter
     suffix = url[prefix.length + 30..-1]
     cutoff = url[prefix.length..-1].length > 30
 
-    "<span class=\"invisible\">#{prefix}</span><span class=\"#{cutoff ? 'ellipsis' : ''}\">#{text}</span><span class=\"invisible\">#{suffix}</span>"
+    "<span class=\"invisible\">#{encode(prefix)}</span><span class=\"#{cutoff ? 'ellipsis' : ''}\">#{encode(text)}</span><span class=\"invisible\">#{encode(suffix)}</span>"
   end
 
   def hashtag_html(tag)
-- 
cgit