From 0fb52800f74e7320c3f99b2128136abab5cf28e1 Mon Sep 17 00:00:00 2001
From: mappu <mappu04@gmail.com>
Date: Mon, 2 Apr 2018 18:10:51 +1200
Subject: [PATCH] bbcode: properly unhesc content before applying url escaping

---
 bbcode.go | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/bbcode.go b/bbcode.go
index 07d4898..afcbef9 100644
--- a/bbcode.go
+++ b/bbcode.go
@@ -77,7 +77,10 @@ func (this *BBCodeRenderer) bbcode(data string) string {
 		pregReplaceRule{regexp.MustCompile(`(?si)\[\*\]`), `</li><li>`},
 		pregReplaceRule{regexp.MustCompile(`(?si)\[url=(.*?)\](.*?)\[/url\]`), `<a rel="noreferrer" href="$1">$2</a>`},
 		pregReplaceFunc{regexp.MustCompile(`(?si)\[article=(.*?)\](.*?)\[/article\]`), func(m []string) string {
-			return `<a href="` + template.HTMLEscapeString(this.baseUrl+`view/`+url.PathEscape(m[1])) + `">` + m[2] + `</a>`
+			// m[1] has already been hesc'd
+			// Need to unhesc, and then pathescape
+			targetArticle := html.UnescapeString(m[1])
+			return `<a href="` + template.HTMLEscapeString(this.baseUrl+`view/`+url.PathEscape(targetArticle)) + `">` + m[2] + `</a>`
 		}},
 		pregReplaceFunc{regexp.MustCompile(`(?si)\[rev=(.*?)\](.*?)\[/rev\]`), func(m []string) string {
 			return `<a href="` + template.HTMLEscapeString(this.baseUrl+`archive/`+url.PathEscape(m[1])) + `">` + m[2] + `</a>`