From 5b4253d6f0a50d34904941f5292097b627a8bdab Mon Sep 17 00:00:00 2001
From: Max Pozdeev <maxpozdeev@gmail.com>
Date: Thu, 17 Feb 2022 20:13:41 +0300
Subject: [PATCH] * dont restrict some chracters in tag names (/\<'>&")

---
 src/ajax.php               | 2 +-
 src/includes/common.php    | 4 ++--
 src/includes/mytinytodo.js | 4 ++--
 3 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/src/ajax.php b/src/ajax.php
index bd8f151..14729d5 100644
--- a/src/ajax.php
+++ b/src/ajax.php
@@ -661,7 +661,7 @@ function prepareTags($tagsStr)
     $aTags = array('tags'=>array(), 'ids'=>array());
     foreach($tags as $tag)
     {
-        $tag = str_replace(array('"',"'",'<','>','&','/','\\','^','#'),'',trim($tag));
+        $tag = str_replace(array('^','#'),'',trim($tag));
         if($tag == '') continue;
 
         $aTag = getOrCreateTag($tag);
diff --git a/src/includes/common.php b/src/includes/common.php
index 42830df..b90e189 100644
--- a/src/includes/common.php
+++ b/src/includes/common.php
@@ -24,8 +24,8 @@ function htmlarray_ref(&$a, $exclude=null)
     foreach($a as $k=>$v)
     {
         if(is_array($v)) $a[$k] = htmlarray($v, $exclude);
-        elseif(!$exclude) $a[$k] = htmlspecialchars($v);
-        elseif(!in_array($k, $exclude)) $a[$k] = htmlspecialchars($v);
+        elseif(!$exclude) $a[$k] = htmlspecialchars($v ?? '');
+        elseif(!in_array($k, $exclude)) $a[$k] = htmlspecialchars($v ?? '');
     }
     return;
 }
diff --git a/src/includes/mytinytodo.js b/src/includes/mytinytodo.js
index 50b7328..598e89b 100644
--- a/src/includes/mytinytodo.js
+++ b/src/includes/mytinytodo.js
@@ -1593,7 +1593,7 @@ function editTask(id)
 	form.task.value = item.titleText;
 	form.note.value = item.noteText;
 	form.id.value = item.id;
-	form.tags.value = item.tags.split(',').join(', ');
+	form.tags.value = dehtml(item.tags).split(',').join(', ');
 	form.duedate.value = item.duedate;
 	form.prio.value = item.prio;
 	$('#taskedit_id').text('#' + item.id);
@@ -2297,7 +2297,7 @@ function isParentId(el, id)
 
 function dehtml(str)
 {
-	return str.replace(/&quot;/g,'"').replace(/&lt;/g,'<').replace(/&gt;/g,'>').replace(/&amp;/g,'&');
+	return str.replace(/&quot;/g, '"').replace(/&#039;/g, "'").replace(/&lt;/g, '<').replace(/&gt;/g, '>').replace(/&amp;/g, '&');
 };