From 1854700e775cea18428e898f88e2813c16fc3fc4 Mon Sep 17 00:00:00 2001
From: Kijin Sung <kijin@kijinsung.com>
Date: Sat, 20 Jan 2024 00:41:14 +0900
Subject: [PATCH] RVE-2024-1 properly encode document title passed to js
 variable

---
 modules/board/skins/default/_read.html  | 2 +-
 modules/board/skins/xedition/_read.html | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/modules/board/skins/default/_read.html b/modules/board/skins/default/_read.html
index 28c6f8571..dfee5006c 100644
--- a/modules/board/skins/default/_read.html
+++ b/modules/board/skins/default/_read.html
@@ -67,7 +67,7 @@
 				<li class="delicious link"><a href="https://delicious.com/">Delicious</a></li>
 			</ul>
 			<script>
-				var sTitle = '{str_ireplace(array('<script', '</script'), array("<scr'+'ipt", "</scr'+'ipt"), addslashes($oDocument->getTitleText()))}';
+				var sTitle = {json_encode($oDocument->getTitleText())};
 				jQuery(function($){
 					$('.twitter>a').snspost({
 						type : 'twitter',
diff --git a/modules/board/skins/xedition/_read.html b/modules/board/skins/xedition/_read.html
index 3e4d87e71..a67e04efe 100644
--- a/modules/board/skins/xedition/_read.html
+++ b/modules/board/skins/xedition/_read.html
@@ -64,7 +64,7 @@
 		    </li>
 		    </ul>
 			<script>
-				var sTitle = '{$oDocument->getTitleText()}';
+				var sTitle = {json_encode($oDocument->getTitleText())};
 				jQuery(function($){
 					$('.twitter').snspost({
 						type : 'twitter',