From 75ce9c4370ef019f012731cbf80ba3f0e326db01 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Jan=20B=C3=B6hmer?= <mail@jan-boehmer.de>
Date: Sat, 3 Feb 2024 00:50:38 +0100
Subject: [PATCH] Fixed problem with multi escaping in title tag

This should fix issue #505
---
 templates/_turbo_control.html.twig | 3 ++-
 templates/base.html.twig           | 5 +++--
 2 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/templates/_turbo_control.html.twig b/templates/_turbo_control.html.twig
index 252e644d..4c178038 100644
--- a/templates/_turbo_control.html.twig
+++ b/templates/_turbo_control.html.twig
@@ -18,7 +18,8 @@
 {# Insert info about when the sidebar trees were updated last time, so the sidebar_tree_controller can decide if it needs to reload the tree #}
 <span id="sidebar-last-time-updated" style="display: none;" data-last-update="{{ sidebar_tree_updater.lastTreeUpdate.format("Y-m-d\\TH:i:sP") }}"></span>
 
-<div class="d-none" data-title="{% apply trim %}{{ current_page_title }}{% endapply %}" {{ stimulus_controller('turbo/title') }}></div>
+{# The title block is already escaped, therefore we dont require any additional escaping here #}
+<div class="d-none" data-title="{{ current_page_title|trim|raw }}" {{ stimulus_controller('turbo/title') }}></div>
 
 <div class="d-none" {{ stimulus_controller('turbo/locale_menu') }}>
     {% for locale in locale_menu %}
diff --git a/templates/base.html.twig b/templates/base.html.twig
index 7914a9a7..0204596d 100644
--- a/templates/base.html.twig
+++ b/templates/base.html.twig
@@ -26,8 +26,9 @@
     <link rel="icon" type="image/png" href="{{  asset('icon/favicon-16x16.png') }}" sizes="16x16">
     <link rel="mask-icon" href="{{ asset('icon/safari-pinned-tab.svg') }}" color="#5bbad5">
 
-    <title>{% apply trim %}{% block title %}{{ partdb_title}}{% endblock %}{% endapply %}</title>
-    {% set current_page_title = block("title") %}
+    {# The content block is already escaped. so we must not escape it again. #}
+    <title>{% apply trim|raw %}{% block title %}{{ partdb_title }}{% endblock %}{% endapply %}</title>
+    {% set current_page_title = block("title")|raw %}
     {% block stylesheets %}
         {# Include the main bootstrap theme based on user/global setting #}