Remove double encoded entities in title attribute

diff --git a/framework/Core/lib/Horde.php b/framework/Core/lib/Horde.php
index 65e2a59..ee86ca3 100644 (file)
--- a/framework/Core/lib/Horde.php
+++ b/framework/Core/lib/Horde.php
@@ -1162,7 +1162,11 @@ HTML;
                     htmlspecialchars(
                         nl2br(htmlspecialchars($title, ENT_QUOTES, $charset)),
                         ENT_QUOTES, $charset));
+
                 error_reporting($old_error);
+
+                /* Remove double encoded entities. */
+                $title = preg_replace('/&([a-z]+|(#\d+));/i', '&\\1;', $title);
             }
             $attributes['title.raw'] = $title;
         }