From ad8d99972d044265c11c293a3ac28aa38c0fda63 Mon Sep 17 00:00:00 2001
From: ryuring <egashira@catchup.co.jp>
Date: Thu, 24 Oct 2024 13:28:39 +0900
Subject: [PATCH] Merge commit from fork
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

* JVN#00876083を修正

* ブログ記事のフロントページにてスラッグをサニタイズ
---
 .../templates/plugin/BcBlog/Admin/BlogPosts/edit.php          | 4 ++--
 plugins/bc-blog/src/Service/BlogPostsService.php              | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/plugins/bc-admin-third/templates/plugin/BcBlog/Admin/BlogPosts/edit.php b/plugins/bc-admin-third/templates/plugin/BcBlog/Admin/BlogPosts/edit.php
index ded1691053..85ed09f712 100644
--- a/plugins/bc-admin-third/templates/plugin/BcBlog/Admin/BlogPosts/edit.php
+++ b/plugins/bc-admin-third/templates/plugin/BcBlog/Admin/BlogPosts/edit.php
@@ -36,10 +36,10 @@
     <?php echo $this->BcAdminForm->control('no', ['type' => 'hidden']) ?>
   </span>
   <span class="bca-post__url">
-    <a href="<?php echo $fullUrl ?>"
+    <a href="<?php echo h($fullUrl) ?>"
        class="bca-text-url" target="_blank" data-toggle="tooltip" data-placement="top" title="<?php echo __d('baser_core', '公開URLを開きます') ?>">
       <i class="bca-icon--globe"></i>
-      <?php echo $fullUrl ?>
+      <?php echo h($fullUrl) ?>
     </a>
     <?php echo $this->BcAdminForm->button('', [
       'id' => 'BtnCopyUrl',
diff --git a/plugins/bc-blog/src/Service/BlogPostsService.php b/plugins/bc-blog/src/Service/BlogPostsService.php
index 65a3d979fe..750f422029 100755
--- a/plugins/bc-blog/src/Service/BlogPostsService.php
+++ b/plugins/bc-blog/src/Service/BlogPostsService.php
@@ -974,7 +974,7 @@ public function getUrl(Content $content, BlogPost $post, $full)
         /** @var ContentsServiceInterface $contentsService */
         $contentsService = $this->getService(ContentsServiceInterface::class);
         $contentUrl = $contentsService->getUrl(rawurldecode($content->url), $full, !empty($site->use_subdomain), false);
-        $no = ($post->name)?: $post->no;
+        $no = ($post->name)? rawurlencode($post->name) : $post->no;
         return $contentUrl . 'archives/' . $no;
     }