From d814746d1b06ffdf572933d76948a5515c397467 Mon Sep 17 00:00:00 2001
From: Jason Agnew <jason@bigbitecreative.com>
Date: Tue, 23 Oct 2018 18:50:27 +0100
Subject: [PATCH 1/2] Fix encoding issues which affect shortcodes and hashtags

---
 classes/class-wpcom-liveblog-entry-extend-feature-hashtags.php | 3 +++
 classes/class-wpcom-liveblog-rest-api.php                      | 2 +-
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/classes/class-wpcom-liveblog-entry-extend-feature-hashtags.php b/classes/class-wpcom-liveblog-entry-extend-feature-hashtags.php
index cd8818e4f..b1baffccb 100644
--- a/classes/class-wpcom-liveblog-entry-extend-feature-hashtags.php
+++ b/classes/class-wpcom-liveblog-entry-extend-feature-hashtags.php
@@ -39,6 +39,9 @@ public function load() {
 		// the generated hashtag class.
 		$this->class_prefix = apply_filters( 'liveblog_hashtag_class', $this->class_prefix );
 
+		// Set a better regex for hashtags to allow for hex values in content.
+		$this->set_regex( '~(?:(?<!\S)|>?)(?:(?<!&|&amp;))((?:' . implode( '|', $this->get_prefixes() ) . ')([0-9_\-\p{L}]*))~um' );
+
 		// This is the regex used to revert the
 		// generated hashtag html back to the
 		// raw input format (e.g #hashtag).
diff --git a/classes/class-wpcom-liveblog-rest-api.php b/classes/class-wpcom-liveblog-rest-api.php
index cc7691a5f..ae53f6254 100644
--- a/classes/class-wpcom-liveblog-rest-api.php
+++ b/classes/class-wpcom-liveblog-rest-api.php
@@ -651,7 +651,7 @@ public static function sanitize_numeric( $param, $request, $key ) {
 	 */
 	public static function get_json_param( $param, $json ) {
 		if ( isset( $json[ $param ] ) ) {
-			return $json[ $param ];
+			return html_entity_decode( $json[ $param ] );
 		}
 		return false;
 	}

From e1052e2eb37c2899d9876690d08e7ac094f6fe35 Mon Sep 17 00:00:00 2001
From: Jon McPartland <jon@bigbitecreative.com>
Date: Thu, 25 Oct 2018 14:30:47 +0100
Subject: [PATCH 2/2] Add documentation to hashtag regex

---
 ...liveblog-entry-extend-feature-hashtags.php | 27 +++++++++++++++++--
 1 file changed, 25 insertions(+), 2 deletions(-)

diff --git a/classes/class-wpcom-liveblog-entry-extend-feature-hashtags.php b/classes/class-wpcom-liveblog-entry-extend-feature-hashtags.php
index b1baffccb..f9a051207 100644
--- a/classes/class-wpcom-liveblog-entry-extend-feature-hashtags.php
+++ b/classes/class-wpcom-liveblog-entry-extend-feature-hashtags.php
@@ -39,8 +39,31 @@ public function load() {
 		// the generated hashtag class.
 		$this->class_prefix = apply_filters( 'liveblog_hashtag_class', $this->class_prefix );
 
-		// Set a better regex for hashtags to allow for hex values in content.
-		$this->set_regex( '~(?:(?<!\S)|>?)(?:(?<!&|&amp;))((?:' . implode( '|', $this->get_prefixes() ) . ')([0-9_\-\p{L}]*))~um' );
+		$prefixes = implode( '|', $this->get_prefixes() );
+
+		// Set a better regex for hashtags to allow for hex values in content -- see https://regex101.com/r/CLWsCo/
+		// phpcs:disable Squiz.Strings.ConcatenationSpacing.PaddingFound -- ignore indentation
+		$this->set_regex(
+			'~'
+			. '(?:'
+			.     '(?<!\S)'          // any visible character
+			. '|'
+			.     '>?'               // possible right angle bracket(s)
+			. ')'
+			. '(?:'
+			.     '(?<!'
+			.         '&'            // literal ampersand
+			.     '|'
+			.         '&amp;'        // encoded ampersand
+			.     ')'
+			. ')'
+			. '('
+			.     "(?:{$prefixes})"  // hashtag prefixes
+			.     '([0-9_\-\p{L}]*)' // 1: numerals, underscores, dashes, and any letter in any language
+			. ')'
+			. '~um'
+		);
+		// phpcs:enable
 
 		// This is the regex used to revert the
 		// generated hashtag html back to the