Escape href attribute in auto links (#5179).

git-svn-id: svn+ssh://rubyforge.org/var/svn/redmine/trunk@3612 e93f8b46-1217-0410-a6f0-8f06a7374b81
2010-03-24 20:26:22 +00:00
parent 84dfff5957
commit 8cdcf308be
3 changed files with 10 additions and 4 deletions
@@ -825,7 +825,7 @@ class RedCloth3 < String
              post = ")"+post # add closing parenth to post
            end
            atts = pba( atts )
-            atts = " href=\"#{ url }#{ slash }\"#{ atts }"
+            atts = " href=\"#{ htmlesc url }#{ slash }\"#{ atts }"
            atts << " title=\"#{ htmlesc title }\"" if title
            atts = shelve( atts ) if atts