| Index: trunk/phase3/languages/LanguageConverter.php |
| — | — | @@ -308,14 +308,23 @@ |
| 309 | 309 | * @return String like ' alt="yyyy"' or ' title="yyyy"' |
| 310 | 310 | */ |
| 311 | 311 | protected function captionConvert( $matches ) { |
| | 312 | + // TODO: cache the preferred variant in every autoConvert() process, |
| | 313 | + // this helps improve performance in a way. |
| 312 | 314 | $toVariant = $this->getPreferredVariant(); |
| 313 | 315 | $title = $matches[1]; |
| 314 | | - $text = $matches[2]; |
| | 316 | + $text = $matches[2]; |
| | 317 | + |
| 315 | 318 | // we convert captions except URL |
| 316 | 319 | if ( !strpos( $text, '://' ) ) { |
| 317 | 320 | $text = $this->translate( $text, $toVariant ); |
| 318 | 321 | } |
| 319 | | - return " $title=\"$text\""; |
| | 322 | + |
| | 323 | + // remove HTML tags to prevent disrupting the layout |
| | 324 | + $text = preg_replace( '/<[^>]+>/', '', $text ); |
| | 325 | + // escape HTML special chars to prevent disrupting the layout |
| | 326 | + $text = htmlspecialchars( $text ); |
| | 327 | + |
| | 328 | + return " {$title}=\"{$text}\""; |
| 320 | 329 | } |
| 321 | 330 | |
| 322 | 331 | /** |