diff --git a/includes/common.inc b/includes/common.inc index 9b9f8b76c4c..00d1ca0e565 100644 --- a/includes/common.inc +++ b/includes/common.inc @@ -659,7 +659,11 @@ function format_rss_channel($title, $link, $description, $items, $language = 'en $output = "\n"; $output .= ' '. check_plain($title) ."\n"; $output .= ' '. check_url($link) ."\n"; - $output .= ' '. check_plain($description) ."\n"; + + // The RSS 2.0 "spec" doesn't indicate HTML can be used in the description. + // We strip all HTML tags, but need to prevent double encoding from properly + // escaped source data (such as & becoming &amp;). + $output .= ' '. check_plain(decode_entities(strip_tags($description))) ."\n"; $output .= ' '. check_plain($language) ."\n"; foreach ($args as $key => $value) { $output .= ' <'. $key .'>'. check_plain($value) ."\n"; @@ -1339,4 +1343,4 @@ function page_set_cache() { } } } -} \ No newline at end of file +}