Double HTML escaping when using plain_title formatter

So, I'm confused. Was it displaying "This & That" on the screen, or "This & That", for instance?

Also, this isn't the way to present fixes as patches. I welcome patches, so here's a couple of links that may be helpful:

• Patches
• Making a Drupal Patch with Git

The issue boils down to: when using the 'Title as plain text' display for the field, ampersands are converted to:
Test & Test

The hint is in 'as plain text' I suppose. But it would be better if characters like ampersands displayed properly.

Using 'Title as link' does not exhibit this problem.

I've attached a patch for jmart's fix in #1 but the question remains if there are any issues in using this approach in terms of security.

Hmm.... Okay, I got it.

Here's the deal. If there's a URL, then the code goes through the l() function, which checks to see if the option 'html' is true - if it is, it bypasses the check_plain function. (Which it is, usually. By default link fields are set to do token replacement, and that means we feed the title through filter_xss.) However, if there isn't a url, then we force the title through check_plain() even if the 'html' option is on! Whoops.

The short version of all this is, if you don't need token support in the link field, then turn it off and you won't need to patch anything.

I'm thinking tokens should be something that is off by default, actually.

In any case, I've got code that's fixing the immediate problem, but I'm considering the issue of tokens being on by default in a link field.

Okay, I've pushed a fix for this up to the code - should show up in 7.x-1.x-dev tomorrow.

The latest dev version doesn't seem to check from the HTML option in the 'Title as plain text' formatter.

/**
 * Formats a link's title as plain text.
 */
function theme_link_formatter_link_title_plain($vars) {
  return empty($vars['element']['title']) ? '' : check_plain($vars['element']['title']);
}

Probably we should do this:

/**
 * Formats a link's title as plain text.
 */
function theme_link_formatter_link_title_plain($vars) {
  $link_options = $vars['element'];
  $title = empty($vars['element']['title']) ? '' : $vars['element']['title'];
  $title = $link_options['html'] ? $title : check_plain($title);
  return $title;
}

Patch is attached.

Tested seanB's patch and it works fine. Moving to RTBC.

Also adjusting the title to one that better describes the issue.

Hi,
#8 solved this issue for me, thanks!

Small tweak applied.

Patch #12 is working as expected. Verified on D 7.x, PHP 5.6, Mysql 5.5.

Applied and checked patch and its working. Just to sum up :

Without patch : If manage display has "Title, as plain text" and in title field has content "This & That" it was printing This &amp; That.

After applying patch : We get desired result This & That. (No need to mention patch applied cleanly too as test is pass). Marking RTBC.

Added into 7.x-1.x-dev version.

This is still an issue in D8

"&" in a link title field gets converted to "&" when printed onto page.

I'm using views to print the link so I don't know if this is views related as well.