Fixes inherited bug

This seems to allow escaped HTML through...
octobercms · Nov 21, 2024 · 6ab8956 · 6ab8956
1 parent 0b21726
commit 6ab8956
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/src/Html/HtmlBuilder.php b/src/Html/HtmlBuilder.php
@@ -404,7 +404,7 @@ public function obfuscate($value)
      */
     public static function strip($string, $allow = '')
     {
-        return htmlspecialchars_decode(strip_tags($string, $allow));
+        return strip_tags(htmlspecialchars_decode($string), $allow);
     }
 
     /**