From 13e409ac15bf410da956e600b556f4d7902c0365 Mon Sep 17 00:00:00 2001
From: Sergey Biryukov <sergeybiryukov@git.wordpress.org>
Date: Mon, 29 Feb 2016 04:41:03 +0000
Subject: [PATCH] Formatting: In `sanitize_title_with_dashes()`, convert
 `&nbsp`, `&ndash`, and `&mdash` HTML entities to hyphens on save.

Props polevaultweb for initial patch.
Fixes #31790.

git-svn-id: https://develop.svn.wordpress.org/trunk@36775 602fd350-edb4-49c9-b593-d223f7449a82
---
 src/wp-includes/formatting.php                    |  7 +++++--
 .../tests/formatting/SanitizeTitleWithDashes.php  | 15 +++++++++++++++
 2 files changed, 20 insertions(+), 2 deletions(-)

diff --git a/src/wp-includes/formatting.php b/src/wp-includes/formatting.php
index 01b6405c9b..5cfa20b81d 100644
--- a/src/wp-includes/formatting.php
+++ b/src/wp-includes/formatting.php
@@ -1584,12 +1584,12 @@ function sanitize_title_with_dashes( $title, $raw_title = '', $context = 'displa
 	}
 
 	$title = strtolower($title);
-	$title = preg_replace('/&.+?;/', '', $title); // kill entities
-	$title = str_replace('.', '-', $title);
 
 	if ( 'save' == $context ) {
 		// Convert nbsp, ndash and mdash to hyphens
 		$title = str_replace( array( '%c2%a0', '%e2%80%93', '%e2%80%94' ), '-', $title );
+		// Convert nbsp, ndash and mdash HTML entities to hyphens
+		$title = str_replace( array( '&nbsp;', '&#160;', '&ndash;', '&#8211;', '&mdash;', '&#8212;' ), '-', $title );
 
 		// Strip these characters entirely
 		$title = str_replace( array(
@@ -1612,6 +1612,9 @@ function sanitize_title_with_dashes( $title, $raw_title = '', $context = 'displa
 		$title = str_replace( '%c3%97', 'x', $title );
 	}
 
+	$title = preg_replace('/&.+?;/', '', $title); // kill entities
+	$title = str_replace('.', '-', $title);
+
 	$title = preg_replace('/[^%a-z0-9 _-]/', '', $title);
 	$title = preg_replace('/\s+/', '-', $title);
 	$title = preg_replace('|-+|', '-', $title);
diff --git a/tests/phpunit/tests/formatting/SanitizeTitleWithDashes.php b/tests/phpunit/tests/formatting/SanitizeTitleWithDashes.php
index 80be9414c5..d0797e2da7 100644
--- a/tests/phpunit/tests/formatting/SanitizeTitleWithDashes.php
+++ b/tests/phpunit/tests/formatting/SanitizeTitleWithDashes.php
@@ -63,11 +63,26 @@ class Tests_Formatting_SanitizeTitleWithDashes extends WP_UnitTestCase {
 		$this->assertEquals("dont-break-the-space", sanitize_title_with_dashes("don't break the space", '', 'save'));
 	}
 
+	/**
+	 * @ticket 31790
+	 */
+	function test_replaces_nbsp_entities() {
+		$this->assertEquals("dont-break-the-space", sanitize_title_with_dashes("don't&nbsp;break&#160;the&nbsp;space", '', 'save'));
+	}
+
 	function test_replaces_ndash_mdash() {
 		$this->assertEquals("do-the-dash", sanitize_title_with_dashes("Do – the Dash", '', 'save'));
 		$this->assertEquals("do-the-dash", sanitize_title_with_dashes("Do the — Dash", '', 'save'));
 	}
 
+	/**
+	 * @ticket 31790
+	 */
+	function test_replaces_ndash_mdash_entities() {
+		$this->assertEquals("do-the-dash", sanitize_title_with_dashes("Do &ndash; the &#8211; Dash", '', 'save'));
+		$this->assertEquals("do-the-dash", sanitize_title_with_dashes("Do &mdash; the &#8212; Dash", '', 'save'));
+	}
+
 	function test_replaces_iexcel_iquest() {
 		$this->assertEquals("just-a-slug", sanitize_title_with_dashes("Just ¡a Slug", '', 'save'));
 		$this->assertEquals("just-a-slug", sanitize_title_with_dashes("Just a Slug¿", '', 'save'));