From e3375ca82e14ec10771a59747dc02f71e572e30f Mon Sep 17 00:00:00 2001
From: danpros <danpros@live.com>
Date: Sat, 16 Aug 2025 18:33:35 +0700
Subject: [PATCH] Update functions.php

---
 system/includes/functions.php | 24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

diff --git a/system/includes/functions.php b/system/includes/functions.php
index 2bf7dad..b8312df 100644
--- a/system/includes/functions.php
+++ b/system/includes/functions.php
@@ -3652,7 +3652,7 @@ function head_contents()
     $output .= '<meta name="generator" content="' . $version . '" />' . "\n";
     $output .= $favicon;
     $output .= '<link rel="sitemap" href="' . site_url() . 'sitemap.xml" />' . "\n";
-    $output .= '<link rel="alternate" type="application/rss+xml" title="' . blog_title() . ' Feed" href="' . site_url() . 'feed/rss" />' . "\n";
+    $output .= '<link rel="alternate" type="application/rss+xml" title="' . safe_html(blog_title()) . ' Feed" href="' . site_url() . 'feed/rss" />' . "\n";
     if (!empty($google_wmt_id)) {
         $output .=  '<meta name="google-site-verification" content="' . $google_wmt_id . '" />' . "\n";
     }
@@ -4081,21 +4081,21 @@ function generate_meta($type = null, $object = null)
         if ($type == 'is_blog') {
             $tags .= '<title>'. generate_title('is_blog', null) .'</title>' . "\n";
             $tags .= '<link rel="canonical" href="'. site_url() . blog_path() .'" />' . "\n";
-            $tags .= '<meta name="description" content="'. blog_title() . ' ' . blog_string() .'"/>' . "\n";
-            $tags .= '<meta property="og:title" content="'. generate_title('is_blog', null) . '" />' . "\n";
-            $tags .= '<meta property="og:description" content="'. blog_title() . ' ' . blog_string() .'" />' . "\n";
+            $tags .= '<meta name="description" content="'. safe_html(blog_title()) . ' ' . safe_html(blog_string()) .'"/>' . "\n";
+            $tags .= '<meta property="og:title" content="'. safe_html(generate_title('is_blog', null)) . '" />' . "\n";
+            $tags .= '<meta property="og:description" content="'. safe_html(blog_title()) . ' ' . safe_html(blog_string()) .'" />' . "\n";
             $tags .= '<meta property="og:url" content="'. site_url() . blog_path() .'" />' . "\n";
         } else {
             $tags .= '<title>'. generate_title('is_front', null) .'</title>' . "\n";
             $tags .= '<link rel="canonical" href="'. site_url() .'" />' . "\n";
             $tags .= '<meta name="description" content="'. safe_html(strip_tags(blog_description())) .'"/>' . "\n";
-            $tags .= '<meta property="og:title" content="'. generate_title('is_front', null) . '" />' . "\n";
+            $tags .= '<meta property="og:title" content="'. safe_html(generate_title('is_front', null)) . '" />' . "\n";
             $tags .= '<meta property="og:description" content="'. safe_html(strip_tags(blog_description())) .'" />' . "\n";
             $tags .= '<meta property="og:url" content="'. site_url() .'" />' . "\n";
         }
         $tags .= '<meta property="og:locale" content="'. locale_language() .'" />' . "\n";
         $tags .= '<meta property="og:type" content="website" />' . "\n";
-        $tags .= '<meta property="og:site_name" content="'. blog_title() . '" />' . "\n";
+        $tags .= '<meta property="og:site_name" content="'. safe_html(blog_title()) . '" />' . "\n";
         $tags .= '<meta property="og:image" content="'. $defaultImg .'" />' . "\n";
         $tags .= '<meta name="twitter:card" content="summary_large_image" />' . "\n";
         if(!empty($twitter)) {
@@ -4116,10 +4116,10 @@ function generate_meta($type = null, $object = null)
         }
         if ($type == 'is_post') {
             $tags .= '<title>'. generate_title('is_post',$object) .'</title>' . "\n";
-            $tags .= '<meta name="author" content="'. $object->authorName .'" />' . "\n";
+            $tags .= '<meta name="author" content="'. safe_html($object->authorName) .'" />' . "\n";
             $tags .= '<meta name="article:published_time" content="'. date('c', $object->date) .'" />' . "\n";
             $tags .= '<meta name="article:modified_time" content="'. date('c', $object->lastMod) .'" />' . "\n";
-            $tags .= '<meta name="article:section" content="'. $object->categoryTitle .'" />' . "\n";
+            $tags .= '<meta name="article:section" content="'. safe_html($object->categoryTitle) .'" />' . "\n";
             $tags .= '<meta name="article:section_url" content="'. $object->categoryUrl .'" />' . "\n";    
         } elseif ($type == 'is_page' || $type == 'is_subpage') {
             $tags .= '<title>'. generate_title('is_page',$object) .'</title>' . "\n";
@@ -4128,7 +4128,7 @@ function generate_meta($type = null, $object = null)
             $tags .= '<title>'. generate_title($type , $object) .'</title>' . "\n";
         }
         $tags .= '<link rel="canonical" href="'. $object->url .'" />' . "\n";
-        $tags .= '<meta name="description" content="'. $object->description .'"/>' . "\n";
+        $tags .= '<meta name="description" content="'. safe_html($object->description) .'"/>' . "\n";
         if(!empty($facebook)) {
             $tags .= '<meta property="article:publisher" content="'. $facebook .'" />' . "\n";
         }
@@ -4138,11 +4138,11 @@ function generate_meta($type = null, $object = null)
             $tags .= '<meta name="twitter:site" content="'. str_replace('/', '@', $twitter['path']) .'" />' . "\n";
         }
         $tags .= '<meta property="og:locale" content="'. locale_language() .'" />' . "\n";
-        $tags .= '<meta property="og:site_name" content="'. blog_title() . '" />' . "\n";
+        $tags .= '<meta property="og:site_name" content="'. safe_html(blog_title()) . '" />' . "\n";
         $tags .= '<meta property="og:type" content="article" />' . "\n";
-        $tags .= '<meta property="og:title" content="'. $object->title .'" />' . "\n";
+        $tags .= '<meta property="og:title" content="'. safe_html($object->title) .'" />' . "\n";
         $tags .= '<meta property="og:url" content="'. $object->url .'" />' . "\n";
-        $tags .= '<meta property="og:description" content="'. $object->description .'" />' . "\n";
+        $tags .= '<meta property="og:description" content="'. safe_html($object->description) .'" />' . "\n";
         $tags .= '<meta name="twitter:card" content="summary_large_image" />' . "\n";
         $tags .= '<meta property="og:image" content="'. $image .'" />' . "\n";
         if (!empty($fbApp)) {