Breaking: #69863 - Fluid escaping behaviour changed from ENT_COMPAT to ENT_QUOTES¶

See forge#69863

Description¶

The escaping behaviour in Fluid has been changed. Before, ENT_COMPAT was used. Now, ENT_QUOTES is used.

Impact¶

Fluid templates which depend on single quotes not being escaped when escaping variables. Affects ObjectAccessor (variable access in general) and calls to f:format.htmlentities and f:format.htmlspecialchars.

Affected Installations¶

Any TYPO3 site containing Fluid templates which depend on single quotes not being escaped.

Migration¶

Change template to not depend on single quotes being escaped in any ObjectAccessor, consider adding {variable -> f:format.htmlspecialchars(keepQuotes: 1)} or <f:format.htmlspecialchars keepQuotes="1">{variable}</f:format.htmlentities> when accessing variables but be aware of possible XSS implications due to incomplete escaping.