Double HTML encoding

Thanks for the bug report. It looks like a bug of double encoding. First ' is converted to ' and then encoded again it becomes '

Do you see the same problem with other social sites or is it only linked in?

I will look at it when I get a chance, or if you can provide a patch it will get fixed faster.

We're seeing this too on a drupal 7 site. This is caused by token_replace which sanitizes the token replacements and _rrssb_urlencode(). I changed token_replace so it wont sanitize the vars but maybe even its better to remove _rrssb_urlencode() completely.

@SpaghettiBolognese thanks for the analysis and patch.

It's not clear that we can justify sanitize=FALSE, when all we do is urlencode:

sanitize: A boolean flag indicating that tokens should be sanitized for display to a web browser. Defaults to TRUE. Developers who set this option to FALSE assume responsibility for running filter_xss(), check_plain() or other appropriate scrubbing functions before displaying data to users.

I think you may be right, it's not clear why _rrssb_urlencode is needed, but I feel I must have had some reason in my mind at the time! I guess it would be interesting to try taking that out then testing that titles and URLs are correctly encoded. Maybe it could turn out that what is needed is to urlencode the URL but not the title - in which case it should be possible to handle in rrssb_tokens.

If you are willing to test a bit further that would be greatly appreciated.

_rrssb_urlencode is definitely needed because we are putting the values in a URL and must replace :/ etc.

I have committed a fix for D8. The sanitise option is no longer available so it required a bit of a hack!

If anyone can test the dev version and confirm it's fixed that would be useful.

I think the patch from #5 is probably the right solution for D7. We ensure the output is safe when we run rawurlencode. However I need to do a little testing before I commit, and no more time right now unfortunately.

Oops commit from #8 broke the phone button text.

Sorry no time to backport to D7