Merged r7570 from trunk (#9245).

git-svn-id: svn+ssh://rubyforge.org/var/svn/redmine/branches/1.2-stable@7578 e93f8b46-1217-0410-a6f0-8f06a7374b81
2011-10-04 19:29:00 +00:00 · 2011-10-04 19:29:00 +00:00 · 0ef89ee4ea
commit 0ef89ee4ea
parent 4813672728
1 changed files with 1 additions and 1 deletions
--- a/lib/redcloth3.rb
+++ b/lib/redcloth3.rb
@ -938,7 +938,7 @@ class RedCloth3 < String
            stln,algn,atts,url,title,href,href_a1,href_a2 = $~[1..8]
            htmlesc title
            atts = pba( atts )
-            atts = " src=\"#{ url }\"#{ atts }"
+            atts = " src=\"#{ htmlesc url.dup }\"#{ atts }"
            atts << " title=\"#{ title }\"" if title
            atts << " alt=\"#{ title }\"" 
            # size = @getimagesize($url);