diff --git a/main/wiki/index.php b/main/wiki/index.php
index 8e3af568f6..3fbd1a190f 100644
--- a/main/wiki/index.php
+++ b/main/wiki/index.php
@@ -291,7 +291,7 @@ if ($_GET['view']) {
Display::display_normal_message($is_being_edited, false);
} else {
- Display::display_confirmation_message(restore_wikipage($current_row['page_id'], $current_row['reflink'], mysql_real_escape_string($current_row['title']), mysql_real_escape_string($current_row['content']), $current_row['group_id'], $current_row['assignment'], $current_row['progress'], $current_row['version'], $last_row['version'], $current_row['linksto']).': '.api_htmlentities($last_row['title']).'',false);
+ Display::display_confirmation_message(restore_wikipage($current_row['page_id'], $current_row['reflink'], api_htmlentities($current_row['title']), api_htmlentities($current_row['content']), $current_row['group_id'], $current_row['assignment'], $current_row['progress'], $current_row['version'], $last_row['version'], $current_row['linksto']).': '.api_htmlentities($last_row['title']).'',false);
}
}
}
@@ -1680,9 +1680,9 @@ if ($_GET['action']=='edit') {
$title=get_lang('DefaultTitle');
$page_id=0;
} else {
- $content=$row['content'];
- $title=$row['title'];
- $page_id=$row['page_id'];
+ $content = api_html_entity_decode($row['content']);
+ $title = api_html_entity_decode($row['title']);
+ $page_id = $row['page_id'];
}
//Only teachers and platform admin can edit the index page. Only teachers and platform admin can edit an assignment teacher. And users in groups
diff --git a/main/wiki/wiki.inc.php b/main/wiki/wiki.inc.php
index 84654b34d6..6372e600a8 100644
--- a/main/wiki/wiki.inc.php
+++ b/main/wiki/wiki.inc.php
@@ -807,8 +807,8 @@ function display_wiki_entry($newtitle) {
return Display::display_normal_message(get_lang('WikiStandBy'));
}
} else {
- $content=Security::remove_XSS($row['content'],COURSEMANAGERLOWSECURITY);
- $title= $row['title'];
+ $content=Security::remove_XSS(api_html_entity_decode($row['content']),COURSEMANAGERLOWSECURITY);
+ $title= api_html_entity_decode($row['title']);
}
//assignment mode: identify page type