fix: do not double-encode titles and authors when importing JSON (#9556)

* fix: do not double-encode titles and authors when importing JSON

FreshRSS exports titles and authors HTML-encoded, and the JSON import
encoded them again since #9168, so restoring a ZIP export turned
"Post & more" into "Post & more". Decode before encoding.

* Unit test

* Reduce comments

---------

Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>

app/Controllers/importExportController.php

@@ -516,7 +516,7 @@ class FreshRSS_importExport_Controller extends FreshRSS_ActionController {
 			}
 
 			$feed_id = $article_to_feed[$item['guid']];
-			$author = is_string($item['author'] ?? null) ? Minz_Helper::htmlspecialchars_utf8($item['author']) : '';
+			$author = is_string($item['author'] ?? null) ? Minz_Helper::htmlspecialchars_utf8(htmlspecialchars_decode($item['author'], ENT_QUOTES)) : '';
 			$is_starred = null; // null is used to preserve the current state if that item exists and is already starred
 			$is_read = null;
 			$tags = is_array($item['categories'] ?? null) ? $item['categories'] : [];
@@ -560,7 +560,7 @@ class FreshRSS_importExport_Controller extends FreshRSS_ActionController {
 			$url = Minz_Helper::htmlspecialchars_utf8(FreshRSS_http_Util::checkUrl($url) ?: '');
 
 			$title = is_string($item['title'] ?? null) ? $item['title'] : $url;
-			$title = Minz_Helper::htmlspecialchars_utf8($title);
+			$title = Minz_Helper::htmlspecialchars_utf8(htmlspecialchars_decode($title, ENT_QUOTES));
 
 			if (is_array($item['content'] ?? null) && is_string($item['content']['content'] ?? null)) {
 				$content = $item['content']['content'];

tests/app/Models/EntryTest.php

@@ -94,4 +94,19 @@ final class EntryTest extends \PHPUnit\Framework\TestCase {
 		self::assertStringContainsString('src="https://example.com/thumb.jpg"', $html);
 		self::assertStringContainsString('Hello', $html);
 	}
+
+	/** ZIP/JSON export/import */
+	public function test_toGReaderFreshRssExportRoundTripsEncoding(): void {
+		$feed = new FreshRSS_Feed('http://example.net/feed.xml', validate: false);
+		$feed->_id(1);
+		$feed->_name('Feed & me');
+
+		$entry = new FreshRSS_Entry(1, 'tag:example.net,2026:1', 'A & B', 'B & C', 'Hello', 'https://example.net/post-1', 1731312000);
+		$entry->_id('1731312000000000');
+		$entry->_feed($feed);
+
+		$item = $entry->toGReader('freshrss');
+		self::assertSame('A & B', $item['title']);
+		self::assertSame('B & C', $item['author']);
+	}
 }