aboutsummaryrefslogtreecommitdiff
path: root/views/default/output
diff options
context:
space:
mode:
authorSem <sembrestels@riseup.net>2014-01-22 03:37:52 +0100
committerSem <sembrestels@riseup.net>2014-01-22 03:37:52 +0100
commit4a2ed114bb18c5363f594a380676c5654f4165a4 (patch)
tree3a37094b249c40e3e6bf122691db53115f65f8f0 /views/default/output
parent673932bc46a3918293a28c2c2fc622b3e5ff6bde (diff)
parent0dd36c458d41e77521c36ae572fe73114ad4bc5a (diff)
downloadelgg-4a2ed114bb18c5363f594a380676c5654f4165a4.tar.gz
elgg-4a2ed114bb18c5363f594a380676c5654f4165a4.tar.bz2
Merge tag '1.8.18' of git://github.com/Elgg/Elgg into develop
1.8.18 Conflicts: mod/tinymce/vendor/tinymce/jscripts/tiny_mce/langs/en.js mod/tinymce/vendor/tinymce/jscripts/tiny_mce/themes/advanced/langs/en_dlg.js
Diffstat (limited to 'views/default/output')
-rw-r--r--views/default/output/access.php2
-rw-r--r--views/default/output/tag.php17
-rw-r--r--views/default/output/tagcloud.php2
-rw-r--r--views/default/output/tags.php19
4 files changed, 22 insertions, 18 deletions
diff --git a/views/default/output/access.php b/views/default/output/access.php
index 91c5c721e..5c8d62c4d 100644
--- a/views/default/output/access.php
+++ b/views/default/output/access.php
@@ -11,7 +11,7 @@ if (isset($vars['entity']) && elgg_instanceof($vars['entity'])) {
$access_id = $vars['entity']->access_id;
$access_class = 'elgg-access';
$access_id_string = get_readable_access_level($access_id);
- $access_id_string = htmlentities($access_id_string, ENT_QUOTES, 'UTF-8');
+ $access_id_string = htmlspecialchars($access_id_string, ENT_QUOTES, 'UTF-8', false);
// if within a group or shared access collection display group name and open/closed membership status
// @todo have a better way to do this instead of checking against subtype / class.
diff --git a/views/default/output/tag.php b/views/default/output/tag.php
index 3c002a31b..6bd9a72a7 100644
--- a/views/default/output/tag.php
+++ b/views/default/output/tag.php
@@ -8,24 +8,25 @@
*
*/
+if (!empty($vars['type'])) {
+ $type = "&type=" . rawurlencode($vars['type']);
+} else {
+ $type = "";
+}
if (!empty($vars['subtype'])) {
- $subtype = "&subtype=" . urlencode($vars['subtype']);
+ $subtype = "&subtype=" . rawurlencode($vars['subtype']);
} else {
$subtype = "";
}
if (!empty($vars['object'])) {
- $object = "&object=" . urlencode($vars['object']);
+ $object = "&object=" . rawurlencode($vars['object']);
} else {
$object = "";
}
if (isset($vars['value'])) {
- if (!empty($vars['type'])) {
- $type = "&type={$vars['type']}";
- } else {
- $type = "";
- }
- $url = elgg_get_site_url() . 'search?q=' . urlencode($vars['value']) . "&search_type=tags{$type}{$subtype}{$object}";
+ $url = elgg_get_site_url() . 'search?q=' . rawurlencode($vars['value']) . "&search_type=tags{$type}{$subtype}{$object}";
+ $vars['value'] = htmlspecialchars($vars['value'], ENT_QUOTES, 'UTF-8', false);
echo elgg_view('output/url', array(
'href' => $url,
'text' => $vars['value'],
diff --git a/views/default/output/tagcloud.php b/views/default/output/tagcloud.php
index a212becd8..2fbf1cd0a 100644
--- a/views/default/output/tagcloud.php
+++ b/views/default/output/tagcloud.php
@@ -39,6 +39,8 @@ if (!empty($vars['tagcloud']) && is_array($vars['tagcloud'])) {
$cloud = '';
foreach ($vars['tagcloud'] as $tag) {
+ $tag->tag = htmlspecialchars($tag->tag, ENT_QUOTES, 'UTF-8', false);
+
if ($cloud != '') {
$cloud .= ', ';
}
diff --git a/views/default/output/tags.php b/views/default/output/tags.php
index 3082dd41e..db096a3be 100644
--- a/views/default/output/tags.php
+++ b/views/default/output/tags.php
@@ -17,13 +17,18 @@ if (isset($vars['entity'])) {
unset($vars['entity']);
}
+if (!empty($vars['type'])) {
+ $type = "&type=" . rawurlencode($vars['type']);
+} else {
+ $type = "";
+}
if (!empty($vars['subtype'])) {
- $subtype = "&subtype=" . urlencode($vars['subtype']);
+ $subtype = "&subtype=" . rawurlencode($vars['subtype']);
} else {
$subtype = "";
}
if (!empty($vars['object'])) {
- $object = "&object=" . urlencode($vars['object']);
+ $object = "&object=" . rawurlencode($vars['object']);
} else {
$object = "";
}
@@ -53,15 +58,11 @@ if (!empty($vars['tags'])) {
$icon_class = elgg_extract('icon_class', $vars);
$list_items = '<li>' . elgg_view_icon('tag', $icon_class) . '</li>';
-
+
foreach($vars['tags'] as $tag) {
- if (!empty($vars['type'])) {
- $type = "&type={$vars['type']}";
- } else {
- $type = "";
- }
- $url = elgg_get_site_url() . 'search?q=' . urlencode($tag) . "&search_type=tags{$type}{$subtype}{$object}";
+ $url = elgg_get_site_url() . 'search?q=' . rawurlencode($tag) . "&search_type=tags{$type}{$subtype}{$object}";
if (is_string($tag)) {
+ $tag = htmlspecialchars($tag, ENT_QUOTES, 'UTF-8', false);
$list_items .= "<li class=\"$item_class\">";
$list_items .= elgg_view('output/url', array('href' => $url, 'text' => $tag, 'rel' => 'tag'));
$list_items .= '</li>';