From 777d0d45c6bb06b312493acb33b35fe6f7b0f6db Mon Sep 17 00:00:00 2001
From: keithhacks <111162058+keithhacks@users.noreply.github.com>
Date: Sun, 19 Nov 2023 23:23:29 +0000
Subject: [PATCH] HTML-escape notification contact names

---
 src/Navigation/Notifications/Entity/Notify.php | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/Navigation/Notifications/Entity/Notify.php b/src/Navigation/Notifications/Entity/Notify.php
index ab042bc9f0..f24ea16ce6 100644
--- a/src/Navigation/Notifications/Entity/Notify.php
+++ b/src/Navigation/Notifications/Entity/Notify.php
@@ -134,6 +134,6 @@ class Notify extends BaseEntity
 	 */
 	public static function formatMessage(string $name, string $message): string
 	{
-		return str_replace('{0}', '<span class="contactname">' . BBCode::toPlaintext($name, false) . '</span>', htmlspecialchars($message));
+		return str_replace('{0}', '<span class="contactname">' . htmlspecialchars(BBCode::toPlaintext($name, false)) . '</span>', htmlspecialchars($message));
 	}
 }