From 575355731a6d052c96c77a090d86e4f47196ad1a Mon Sep 17 00:00:00 2001
From: Uwe Steinmann <steinm@debian.org>
Date: Fri, 23 Nov 2018 21:02:33 +0100
Subject: [PATCH] no need to include parsedown/Parsedown.php anymore, set flags
 of htmlspecialchars()

---
 views/bootstrap/class.EditOnline.php | 5 ++---
 1 file changed, 2 insertions(+), 3 deletions(-)

diff --git a/views/bootstrap/class.EditOnline.php b/views/bootstrap/class.EditOnline.php
index 10995b10e..80c316d35 100644
--- a/views/bootstrap/class.EditOnline.php
+++ b/views/bootstrap/class.EditOnline.php
@@ -74,14 +74,13 @@ $(document).ready(function()	{
 		<div class="tab-content">
 		  <div class="tab-pane active" id="preview_markdown">
 <?php
-		require_once('parsedown/Parsedown.php');
 		$Parsedown = new Parsedown();
 		echo $Parsedown->text(file_get_contents($dms->contentDir . $version->getPath()));
 ?>
 			</div>
 		  <div class="tab-pane" id="preview_plain">
 <?php
-		echo "<pre>".htmlspecialchars(file_get_contents($dms->contentDir . $version->getPath()))."</pre>";
+		echo "<pre>".htmlspecialchars(file_get_contents($dms->contentDir . $version->getPath()), ENT_SUBSTITUTE)."</pre>";
 ?>
 			</div>
 		</div>
@@ -121,7 +120,7 @@ $this->contentHeading(getMLText("content"));
 <input type="hidden" name="documentid" value="<?php echo $document->getId(); ?>" />
 <textarea id="markdown" name="data" width="100%" rows="20">
 <?php
-		echo htmlspecialchars(file_get_contents($dms->contentDir . $version->getPath()));
+		echo htmlspecialchars(file_get_contents($dms->contentDir . $version->getPath()), ENT_SUBSTITUTE);
 ?>
 </textarea>
 <button id="update" type="submit" class="btn btn-primary"><i class="icon-save"></i> <?php printMLText("save"); ?></button>