TYPO3 Core

trying to include a php-generated variable css file with multiple GET-parameters produces an URL with '&' instead of '&'.
the called PHP gets wrong GET-parameters.

using this typoscript:
page {
includeCSS {
varcss = fileadmin/css/csscalc.php?col1=ff0000&col2=0000ff
// neccessary for include without check for existence
// as the paramters does not belong to the filename:
varcss.external = 1
:
}
:
}

the resulting HTML is:
<link rel="stylesheet" type="text/css" href="fileadmin/css/csscalc.php?col1=ff0000&col2=0000ff" media="screen" />

inside the php a call to 'print_r($_GET)' showes the wrong parameters:
GET=Array
(
[col1] => ff0000
[amp;col2] => 0000ff
)

the same may occur with includeJS*

looking in the source of V4.3.2 I found in class.tslib_pagegen.php at line 546 the functioncall htmlspecialchars() which changes the '&' into '&'

I think this should not be called. At least if external is true.

this may be fixed for CSS by changing only this line to
$GLOBALS['TSFE']->pSetup['includeCSS.'][$key . '.']['external'] ? $ss : htmlspecialchars($ss) ,
(for my needs it worked)

maybe some more lines have to be changed.
and please check for similar uses with includeJS*.
(issue imported from #M13757)