From dd019afff6c32f5e750fd86de6e668faeaaaa25b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Mathias=20Gla=CC=88ser?= <mathias.glaeser@beaufort.ch>
Date: Mon, 21 Sep 2026 15:45:53 +0200
Subject: [PATCH] Normalize escaped Hermes rich text

---
 modules/market_management/service.php | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/modules/market_management/service.php b/modules/market_management/service.php
index 00458f0..31c0b25 100644
--- a/modules/market_management/service.php
+++ b/modules/market_management/service.php
@@ -64,6 +64,15 @@ function market_management_sanitize_multiline_html(?string $value): ?string
         return $value;
     }
 
+    for ($decodePass = 0; $decodePass < 3; $decodePass++) {
+        $decoded = html_entity_decode($value, ENT_QUOTES | ENT_HTML5, 'UTF-8');
+        if ($decoded === $value) {
+            break;
+        }
+        $value = $decoded;
+    }
+    $value = preg_replace('/(<a\b[^>]*\bhref\s*=\s*["\'])@url:/iu', '$1', $value) ?? $value;
+
     $tokens = preg_split('/(<\/?a\b[^>]*>|<br\s*\/?>|<\/?strong\s*>)/iu', $value, -1, PREG_SPLIT_DELIM_CAPTURE);
     if ($tokens === false) {
         return htmlspecialchars($value, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8');