From 8733ce6148f645ffd88dd690705fe57a275113b6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Mathias=20Gla=CC=88ser?= <mathias.glaeser@beaufort.ch>
Date: Sun, 27 Sep 2026 07:49:37 +0200
Subject: [PATCH] Fix MCP occurrence apostrophe escaping

---
 modules/market_management/service.php         |  7 ++---
 .../market_management_sanitizer_test.php      | 28 +++++++++++++++++++
 2 files changed, 31 insertions(+), 4 deletions(-)
 create mode 100644 scripts/tests/market_management_sanitizer_test.php

diff --git a/modules/market_management/service.php b/modules/market_management/service.php
index 00458f0..aebc125 100644
--- a/modules/market_management/service.php
+++ b/modules/market_management/service.php
@@ -66,7 +66,7 @@ function market_management_sanitize_multiline_html(?string $value): ?string
 
     $tokens = preg_split('/(<\/?a\b[^>]*>|<br\s*\/?>|<\/?strong\s*>)/iu', $value, -1, PREG_SPLIT_DELIM_CAPTURE);
     if ($tokens === false) {
-        return htmlspecialchars($value, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8');
+        return htmlspecialchars($value, ENT_NOQUOTES | ENT_SUBSTITUTE, 'UTF-8');
     }
 
     $result = '';
@@ -89,7 +89,7 @@ function market_management_sanitize_multiline_html(?string $value): ?string
                 $result .= '</a>';
                 $anchorOpen = false;
             } else {
-                $result .= htmlspecialchars($token, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8');
+                $result .= htmlspecialchars($token, ENT_NOQUOTES | ENT_SUBSTITUTE, 'UTF-8');
             }
             continue;
         }
@@ -103,7 +103,7 @@ function market_management_sanitize_multiline_html(?string $value): ?string
             $anchorOpen = true;
             continue;
         }
-        $result .= htmlspecialchars($token, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8');
+        $result .= htmlspecialchars($token, ENT_NOQUOTES | ENT_SUBSTITUTE, 'UTF-8');
     }
     if ($anchorOpen) {
         $result .= '</a>';
@@ -1106,7 +1106,6 @@ function market_management_get_occurrence(PDO $pdo, int $occurrenceId, bool $inc
             break;
         }
     }
-    market_management_sanitize_occurrence_payload($occurrence);
     $costSummary = $pdo->prepare(
         'SELECT COALESCE(SUM(gross_amount), 0) AS gross_amount,
                 COALESCE(SUM(net_amount), 0) AS net_amount,
diff --git a/scripts/tests/market_management_sanitizer_test.php b/scripts/tests/market_management_sanitizer_test.php
new file mode 100644
index 0000000..7d50781
--- /dev/null
+++ b/scripts/tests/market_management_sanitizer_test.php
@@ -0,0 +1,28 @@
+<?php
+declare(strict_types=1);
+
+require_once __DIR__ . '/../../modules/market_management/service.php';
+
+function fail_test(string $message): void
+{
+    fwrite(STDERR, $message . PHP_EOL);
+    exit(1);
+}
+
+function assert_test(bool $condition, string $message): void
+{
+    if (!$condition) {
+        fail_test($message);
+    }
+}
+
+$plainText = "Test 'A' & <B> \"C\"";
+$sanitized = market_management_sanitize_multiline_html($plainText);
+assert_test($sanitized === "Test 'A' &amp; &lt;B&gt; \"C\"", 'Plain text must preserve quotes and escape markup characters once');
+
+$link = '<a href="https://erpnaurua.imhochrain.ch/files.php?path=Marktmanagement%2Fvertrag.pdf">Vertrag</a>';
+$sanitizedLink = market_management_sanitize_multiline_html($link);
+assert_test(str_contains($sanitizedLink, 'class="sg-hyperlink"'), 'Allowed links must remain links');
+assert_test(str_contains($sanitizedLink, 'href="https://erpnaurua.imhochrain.ch/files.php?path=Marktmanagement%2Fvertrag.pdf"'), 'Link href must remain valid');
+
+fwrite(STDOUT, "market_management_sanitizer_test: OK\n");