Make the Acceptable Ads link clickable

src/org/adblockplus/android/Preferences.java

 /*
  * This file is part of Adblock Plus <http://adblockplus.org/>,
  * Copyright (C) 2006-2013 Eyeo GmbH
  *
  * Adblock Plus is free software: you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 3 as
  * published by the Free Software Foundation.
  *
  * Adblock Plus is distributed in the hope that it will be useful,
  * but WITHOUT ANY WARRANTY; without even the implied warranty of
@@ skipping 135 matching lines @@
     if (subscriptions.length > 0)
     {
       current = subscriptions[0];
     }
 
     boolean firstRun = firstRunActionsPending && application.isFirstRun();
     firstRunActionsPending = false;
 
     if (firstRun && current != null)
     {
-      final String url = application.getAcceptableAdsUrl();
+      final String url = TextUtils.htmlEncode(application.getAcceptableAdsUrl());
       final String rawMessage = String.format(getString(R.string.msg_subscription_offer, current.title));
       final String message = TextUtils.htmlEncode(rawMessage)
           .replaceAll("&lt;a&gt;(.*?)&lt;/a&gt;", "<a href=\"" + url + "\">$1</a>");

[Wladimir Palant, 2013/11/26 10:48:57]

TextUtils.htmlEncode(url)?

[Felix Dahlke, 2013/11/26 13:11:46]

Why? That'd just mess up the link and it wouldn't work anymore. We get this
value from libadblockplus, so XSS is highly unlikely.

[Wladimir Palant, 2013/11/26 13:33:44]

No, it will make sure the link is properly encoded. Feel free to check the
following two links with an HTML validator of your choice:

<a href="http://example.com/?foo=bar&x=y">test</a>
<a href="http://example.com/?foo=bar&amp;x=y">test</a>

[Felix Dahlke, 2013/11/26 13:48:01]

Ouch, you're right.

       final TextView messageView = new TextView(this);
       messageView.setText(Html.fromHtml(message));
       messageView.setMovementMethod(LinkMovementMethod.getInstance());
       final int padding = 10;
       messageView.setPadding(padding, padding, padding, padding);
       new AlertDialog.Builder(this).setTitle(R.string.install_name)
           .setView(messageView)
           .setIcon(android.R.drawable.ic_dialog_info)
           .setPositiveButton(R.string.ok, null).create().show();
     }
@@ skipping 376 matching lines @@
         showConfigurationMsg(getString(R.string.msg_configuration));
     }
 
     public void onServiceDisconnected(ComponentName className)
     {
       proxyService = null;
       Log.d(TAG, "Proxy service disconnected");
     }
   };
 }