sandbox: disable escaping when rendering as text/plain, bcosca/fatfre…

…e#654
f3-factory · May 26, 2020 · f7b934f · f7b934f · Rayne · May 26, 2020
1 parent 2dc899d
commit f7b934f
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/base.php b/base.php
@@ -2888,7 +2888,8 @@ protected function sandbox(array $hive=NULL,$mime=NULL) {
 				!preg_grep ('/^Content-Type:/',headers_list()))
 				header('Content-Type: '.$mime.'; '.
 					'charset='.$fw->ENCODING);
-			if ($fw->ESCAPE)
+			if ($fw->ESCAPE && (!$mime ||
+					preg_match('/^(text\/html|(application|text)\/(.+\+)?xml)$/i',$mime)))
 				$hive=$this->esc($hive);
 			if (isset($hive['ALIASES']))
 				$hive['ALIASES']=$fw->build($hive['ALIASES']);