force using utf-8 as charset for htmlentities/htmlspecialchars (#12135)

5 files changed, 9 insertions, 9 deletions

diff --git a/plugins/Actions/Reports/GetPageTitles.php b/plugins/Actions/Reports/GetPageTitles.php
index 5a5e0581e9..ddddb2e0ae 100644
--- a/plugins/Actions/Reports/GetPageTitles.php
+++ b/plugins/Actions/Reports/GetPageTitles.php
@@ -29,7 +29,7 @@ class GetPageTitles extends Base
         $this->dimension     = new PageTitle();
         $this->name          = Piwik::translate('Actions_SubmenuPageTitles');
         $this->documentation = Piwik::translate('Actions_PageTitlesReportDocumentation',
-                                                array('<br />', htmlentities('<title>')));
+                                                array('<br />', htmlentities('<title>', ENT_COMPAT | ENT_HTML401, 'UTF-8')));
 
         $this->order   = 5;
         $this->metrics = array('nb_hits', 'nb_visits');
diff --git a/plugins/Dashboard/Dashboard.php b/plugins/Dashboard/Dashboard.php
index 86cf3ec2cd..7392ea119b 100644
--- a/plugins/Dashboard/Dashboard.php
+++ b/plugins/Dashboard/Dashboard.php
@@ -243,7 +243,7 @@ class Dashboard extends \Piwik\Plugin
             return $layout;
         }
 
-        $layout = html_entity_decode($layout);
+        $layout = html_entity_decode($layout, ENT_COMPAT | ENT_HTML401, 'UTF-8');
         $layout = str_replace("\\\"", "\"", $layout);
         $layout = str_replace("\n", "", $layout);
 
diff --git a/plugins/Monolog/Handler/WebNotificationHandler.php b/plugins/Monolog/Handler/WebNotificationHandler.php
index 7b3098d315..5f0de1bb8c 100644
--- a/plugins/Monolog/Handler/WebNotificationHandler.php
+++ b/plugins/Monolog/Handler/WebNotificationHandler.php
@@ -37,7 +37,7 @@ class WebNotificationHandler extends AbstractProcessingHandler
                 break;
         }
 
-        $message = $record['level_name'] . ': ' . htmlentities($record['message']);
+        $message = $record['level_name'] . ': ' . htmlentities($record['message'], ENT_COMPAT | ENT_HTML401, 'UTF-8');
 
         $notification = new Notification($message);
         $notification->context = $context;
diff --git a/plugins/Overlay/Controller.php b/plugins/Overlay/Controller.php
index 6327d34ddf..4ccdcf0b18 100644
--- a/plugins/Overlay/Controller.php
+++ b/plugins/Overlay/Controller.php
@@ -194,7 +194,7 @@ class Controller extends \Piwik\Plugin\Controller
         $url = Common::unsanitizeInputValue($url);
 
         $message = Piwik::translate('Overlay_RedirectUrlError', array($url, "\n"));
-        $message = nl2br(htmlentities($message));
+        $message = nl2br(htmlentities($message, ENT_COMPAT | ENT_HTML401, 'UTF-8'));
 
         $view = new View('@Overlay/showErrorWrongDomain');
         $this->addCustomLogoInfo($view);
@@ -204,11 +204,11 @@ class Controller extends \Piwik\Plugin\Controller
             // TODO use $idSite to link to the correct row. This is tricky because the #rowX ids don't match
             // the site ids when sites have been deleted.
             $url = 'index.php?module=SitesManager&action=index';
-            $troubleshoot = htmlentities(Piwik::translate('Overlay_RedirectUrlErrorAdmin'));
+            $troubleshoot = htmlentities(Piwik::translate('Overlay_RedirectUrlErrorAdmin'), ENT_COMPAT | ENT_HTML401, 'UTF-8');
             $troubleshoot = sprintf($troubleshoot, '<a href="' . $url . '" target="_top">', '</a>');
             $view->troubleshoot = $troubleshoot;
         } else {
-            $view->troubleshoot = htmlentities(Piwik::translate('Overlay_RedirectUrlErrorUser'));
+            $view->troubleshoot = htmlentities(Piwik::translate('Overlay_RedirectUrlErrorUser'), ENT_COMPAT | ENT_HTML401, 'UTF-8');
         }
 
         $this->outputCORSHeaders();
diff --git a/plugins/Referrers/Controller.php b/plugins/Referrers/Controller.php
index 31429d7885..f9df7e39d4 100644
--- a/plugins/Referrers/Controller.php
+++ b/plugins/Referrers/Controller.php
@@ -380,7 +380,7 @@ function DisplayTopKeywords($url = "")
 	}
 
 	// Display the list in HTML
-	$url = htmlspecialchars($url, ENT_QUOTES);
+	$url = htmlspecialchars($url, ENT_QUOTES, \'UTF-8\');
 	$output = "<h2>Top Keywords for <a href=\'$url\'>$url</a></h2><ul>";
 	foreach($keywords as $keyword) {
 		$output .= "<li>". $keyword . "</li>";
@@ -418,7 +418,7 @@ function DisplayTopKeywords($url = "")
             }
 
             // Display the list in HTML
-            $url = htmlspecialchars($url, ENT_QUOTES);
+            $url = htmlspecialchars($url, ENT_QUOTES, 'UTF-8');
             $output = "<h2>Top Keywords for <a href=\'$url\'>$url</a></h2><ul>";
             foreach ($keywords as $keyword) {
                 $output .= "<li>" . $keyword . "</li>";
@@ -434,7 +434,7 @@ function DisplayTopKeywords($url = "")
 
         echo "</div><br/>
 		<p style='padding: 0 12px;'>Here is the PHP function that you can paste in your pages:</P>
-		<textarea style='padding: 0 12px;height:auto;width:auto;margin-left:12px;' cols=60 rows=8>&lt;?php\n" . htmlspecialchars($code) . "\n DisplayTopKeywords();</textarea>
+		<textarea style='padding: 0 12px;height:auto;width:auto;margin-left:12px;' cols=60 rows=8>&lt;?php\n" . htmlspecialchars($code, ENT_COMPAT | ENT_HTML401, 'UTF-8') . "\n DisplayTopKeywords();</textarea>
 		";
 
         echo "