aboutsummaryrefslogtreecommitdiff
path: root/views/default
diff options
context:
space:
mode:
authorCash Costello <cash.costello@gmail.com>2013-03-05 07:34:18 -0500
committerCash Costello <cash.costello@gmail.com>2013-03-05 07:34:18 -0500
commit597c0a4e519e14ba42c77b518a44789e3a8067b0 (patch)
tree4c21e494088299fbe83106017cf2300d81a67046 /views/default
parentd149c0038d335133ed1628c105328b1e7a6681ea (diff)
downloadelgg-597c0a4e519e14ba42c77b518a44789e3a8067b0.tar.gz
elgg-597c0a4e519e14ba42c77b518a44789e3a8067b0.tar.bz2
Fixes #5165 handling html tags passed as tags
Diffstat (limited to 'views/default')
-rw-r--r--views/default/output/tag.php1
-rw-r--r--views/default/output/tagcloud.php2
-rw-r--r--views/default/output/tags.php1
3 files changed, 4 insertions, 0 deletions
diff --git a/views/default/output/tag.php b/views/default/output/tag.php
index 3c002a31b..3e1f1c320 100644
--- a/views/default/output/tag.php
+++ b/views/default/output/tag.php
@@ -20,6 +20,7 @@ if (!empty($vars['object'])) {
}
if (isset($vars['value'])) {
+ $vars['value'] = htmlspecialchars($vars['value'], ENT_QUOTES, 'UTF-8', false);
if (!empty($vars['type'])) {
$type = "&type={$vars['type']}";
} else {
diff --git a/views/default/output/tagcloud.php b/views/default/output/tagcloud.php
index a212becd8..2fbf1cd0a 100644
--- a/views/default/output/tagcloud.php
+++ b/views/default/output/tagcloud.php
@@ -39,6 +39,8 @@ if (!empty($vars['tagcloud']) && is_array($vars['tagcloud'])) {
$cloud = '';
foreach ($vars['tagcloud'] as $tag) {
+ $tag->tag = htmlspecialchars($tag->tag, ENT_QUOTES, 'UTF-8', false);
+
if ($cloud != '') {
$cloud .= ', ';
}
diff --git a/views/default/output/tags.php b/views/default/output/tags.php
index 3082dd41e..41fd5f168 100644
--- a/views/default/output/tags.php
+++ b/views/default/output/tags.php
@@ -55,6 +55,7 @@ if (!empty($vars['tags'])) {
$list_items = '<li>' . elgg_view_icon('tag', $icon_class) . '</li>';
foreach($vars['tags'] as $tag) {
+ $tag = htmlspecialchars($tag, ENT_QUOTES, 'UTF-8', false);
if (!empty($vars['type'])) {
$type = "&type={$vars['type']}";
} else {