Scrub all atom output with common_xml_safe_str()

2 files changed, 25 insertions, 10 deletions

diff --git a/lib/activity.php b/lib/activity.php
index 2cb80f9e1..125d391b0 100644
--- a/lib/activity.php
+++ b/lib/activity.php
@@ -78,7 +78,7 @@ class PoCoAddress
         if (!empty($this->formatted)) {
             $xs = new XMLStringer(true);
             $xs->elementStart('poco:address');
-            $xs->element('poco:formatted', null, $this->formatted);
+            $xs->element('poco:formatted', null, common_xml_safe_str($this->formatted));
             $xs->elementEnd('poco:address');
             return $xs->getString();
         }
@@ -279,7 +279,7 @@ class PoCo
         );
 
         if (!empty($this->note)) {
-            $xs->element('poco:note', null, $this->note);
+            $xs->element('poco:note', null, common_xml_safe_str($this->note));
         }
 
         if (!empty($this->address)) {
@@ -805,7 +805,6 @@ class ActivityObject
         return $object;
     }
 
-
     function asString($tag='activity:object')
     {
         $xs = new XMLStringer(true);
@@ -817,16 +816,28 @@ class ActivityObject
         $xs->element(self::ID, null, $this->id);
 
         if (!empty($this->title)) {
-            $xs->element(self::TITLE, null, $this->title);
+            $xs->element(
+                self::TITLE,
+                null,
+                common_xml_safe_str($this->title)
+            );
         }
 
         if (!empty($this->summary)) {
-            $xs->element(self::SUMMARY, null, $this->summary);
+            $xs->element(
+                self::SUMMARY,
+                null,
+                common_xml_safe_str($this->summary)
+            );
         }
 
         if (!empty($this->content)) {
             // XXX: assuming HTML content here
-            $xs->element(ActivityUtils::CONTENT, array('type' => 'html'), $this->content);
+            $xs->element(
+                ActivityUtils::CONTENT,
+                array('type' => 'html'),
+                common_xml_safe_str($this->content)
+            );
         }
 
         if (!empty($this->link)) {
diff --git a/lib/apiaction.php b/lib/apiaction.php
index 73777f4e8..cef5d1c1e 100644
--- a/lib/apiaction.php
+++ b/lib/apiaction.php
@@ -743,8 +743,12 @@ class ApiAction extends Action
     function showTwitterAtomEntry($entry)
     {
         $this->elementStart('entry');
-        $this->element('title', null, $entry['title']);
-        $this->element('content', array('type' => 'html'), $entry['content']);
+        $this->element('title', null, common_xml_safe_str($entry['title']));
+        $this->element(
+            'content',
+            array('type' => 'html'),
+            common_xml_safe_str($entry['content'])
+        );
         $this->element('id', null, $entry['id']);
         $this->element('published', null, $entry['published']);
         $this->element('updated', null, $entry['updated']);
@@ -859,7 +863,7 @@ class ApiAction extends Action
 
         $this->initDocument('atom');
 
-        $this->element('title', null, $title);
+        $this->element('title', null, common_xml_safe_str($title));
         $this->element('id', null, $id);
         $this->element('link', array('href' => $link, 'rel' => 'alternate', 'type' => 'text/html'), null);
 
@@ -869,7 +873,7 @@ class ApiAction extends Action
         }
 
         $this->element('updated', null, common_date_iso8601('now'));
-        $this->element('subtitle', null, $subtitle);
+        $this->element('subtitle', null, common_xml_safe_str($subtitle));
 
         if (is_array($group)) {
             foreach ($group as $g) {