- Affected version
- 2.1.0 Beta 4
PHP:
$newValue = $this->convertTagOptionToString($newValue);
return preg_replace_callback(
'#=("|\'|).*\]$#s',
function ($match) use ($newValue)
{
if (strpos($newValue, '"') !== false)
{
$newValue = "'$newValue'";
}
else if (strpos($newValue, "'") !== false)
{
$newValue = "\"$newValue\"";
}
else
{
$newValue = $match[1] . $newValue . $match[1];
}
return '=' . $newValue . ']';
},
$open
);
If
$newValue
consists of multiple options like type="full" alt="1234"
for an attachment, this ends up with a broken option string like type='type="full" alt="1234"'