TYPO3 Core

The function: template::getTabMenu produces following HTML output as example: index.php?&id=1&tab=1

obviously & is converted to & then to &

This bug is analogue to #14547 in the FE.

The problem is template::getTabMenu() generates the url, and passes it
through "htmlspecialchars". Then calls template::getTabMenuRaw(), which
will then render the A-tag, but will pass the url again through
htmlspecialchars. My comment from on #14547 from 10.11.05 17:00 you can
see that if we follow my 4-step instructions, we need to: generate the
URL in its raw mode in getTabMenu() and then just pass it through
htmlspecialchars right before generating the A-tag.

So the fix would be to remove the "htmlspecialchars()" call in
getTabMenu(), leaving it just in getTabMenuRaw().

(Ernest on 4.1.06 in typo3.dev)
(issue imported from #M2178)