diff --git a/mailpoet/lib/Newsletter/Renderer/Blocks/Text.php b/mailpoet/lib/Newsletter/Renderer/Blocks/Text.php index 2890b1ac5f..f0d7d964da 100644 --- a/mailpoet/lib/Newsletter/Renderer/Blocks/Text.php +++ b/mailpoet/lib/Newsletter/Renderer/Blocks/Text.php @@ -38,7 +38,7 @@ class Text { if (preg_match('/h\d/', $paragraph->getTag())) { $contents[] = $paragraph->getOuterText(); } else { - $contents[] = str_replace('&', '&', $paragraph->html()); + $contents[] = $paragraph->toString(true, true, 1); } if ($index + 1 < $paragraphs->count()) $contents[] = '
'; $paragraph->remove(); @@ -105,7 +105,7 @@ class Text { if (!preg_match('/text-align/i', $style)) { $style = 'text-align: left;' . $style; } - $contents = str_replace('&', '&', $paragraph->html()); + $contents = $paragraph->toString(true, true, 1); $paragraph->setTag('table'); $paragraph->style = 'border-spacing:0;mso-table-lspace:0;mso-table-rspace:0;'; $paragraph->width = '100%'; @@ -144,7 +144,7 @@ class Text { if (!$lists->count()) return $html; foreach ($lists as $list) { if ($list->tag === 'li') { - $list->setInnertext(str_replace('&', '&', $list->html())); + $list->setInnertext($list->toString(true, true, 1)); $list->class = 'mailpoet_paragraph'; } else { $list->class = 'mailpoet_paragraph'; diff --git a/mailpoet/tests/unit/Newsletter/Renderer/Blocks/TextTest.php b/mailpoet/tests/unit/Newsletter/Renderer/Blocks/TextTest.php index 98e0da3c2f..4527cdddeb 100644 --- a/mailpoet/tests/unit/Newsletter/Renderer/Blocks/TextTest.php +++ b/mailpoet/tests/unit/Newsletter/Renderer/Blocks/TextTest.php @@ -185,4 +185,39 @@ class TextTest extends \MailPoetUnitTest { $output = (new Text)->render($this->block); expect($output)->stringNotContainsString('
'); } + + public function htmlEntitiesStrings() { + return [ + 'paragraph' => ["

Text <script>alert('test');</script>

"], + 'list' => [""], + 'blockquote' => [""], + ]; + } + + /** + * @dataProvider htmlEntitiesStrings + */ + public function testItDoesNotDecodeHtmlEntities($htmlString) { + $this->block['text'] = $htmlString; + $output = (new Text())->render($this->block); + expect($output)->stringNotContainsString('