From: Tom Hughes <tom@compton.nu>
Date: Sat, 29 Oct 2016 17:08:31 +0000 (+0100)
Subject: Merge remote-tracking branch 'openstreetmap/pull/1349'
X-Git-Tag: live~3824
X-Git-Url: https://git.openstreetmap.org/rails.git/commitdiff_plain/48eb8eb3690851f7f26afc68e1524341fcb6c187?hp=968447595b19ddfa885e2216acf4fc0b355b5e3e

Merge remote-tracking branch 'openstreetmap/pull/1349'
---

diff --git a/app/views/diary_entry/rss.rss.builder b/app/views/diary_entry/rss.rss.builder
index 6ccd21438..d9cc40797 100644
--- a/app/views/diary_entry/rss.rss.builder
+++ b/app/views/diary_entry/rss.rss.builder
@@ -17,7 +17,7 @@ xml.rss("version" => "2.0",
 
     @entries.each do |entry|
       xml.item do
-        xml.title h(entry.title)
+        xml.title entry.title
         xml.link url_for(:action => "view", :id => entry.id, :display_name => entry.user.display_name, :host => SERVER_URL)
         xml.guid url_for(:action => "view", :id => entry.id, :display_name => entry.user.display_name, :host => SERVER_URL)
         xml.description entry.body.to_html
diff --git a/test/controllers/diary_entry_controller_test.rb b/test/controllers/diary_entry_controller_test.rb
index 6e766460e..4a8451e89 100644
--- a/test/controllers/diary_entry_controller_test.rb
+++ b/test/controllers/diary_entry_controller_test.rb
@@ -563,6 +563,13 @@ class DiaryEntryControllerTest < ActionController::TestCase
     assert_response :not_found, "Should not be able to get a deleted users diary RSS"
   end
 
+  def test_rss_character_escaping
+    create(:diary_entry, :title => "<script>")
+    get :rss, :format => :rss
+
+    assert_match "<title>&lt;script&gt;</title>", response.body
+  end
+
   def test_view
     # Try a normal entry that should work
     diary_entry = create(:diary_entry, :user => users(:normal_user))