1 files changed, 29 insertions, 21 deletions

diff --git a/views/default/output/url.php b/views/default/output/url.php
index 8ea84d3d6..81b02087d 100644
--- a/views/default/output/url.php
+++ b/views/default/output/url.php
@@ -8,41 +8,49 @@
  *
  * @uses string $vars['text']        The string between the <a></a> tags.
  * @uses string $vars['href']        The unencoded url string
- * @uses bool   $vars['encode_text'] Run $vars['text'] through htmlspecialchars()?
- * @uses bool   $vars['is_action']   Is this a link to an action?
- *
+ * @uses bool   $vars['encode_text'] Run $vars['text'] through htmlspecialchars() (false)
+ * @uses bool   $vars['is_action']   Is this a link to an action (false)
+ * @uses bool   $vars['is_trusted']  Is this link trusted (false)
  */
 
-$url = trim($vars['href']);
+$url = elgg_extract('href', $vars, null);
 if (!$url and isset($vars['value'])) {
 	$url = trim($vars['value']);
 	unset($vars['value']);
 }
 
-if (!empty($url)) {
-	if (isset($vars['text'])) {
-		if (isset($vars['encode_text']) && $vars['encode_text']) {
-			$text = htmlspecialchars($vars['text'], ENT_QUOTES, 'UTF-8');
-		} else {
-			$text = $vars['text'];
-		}
-
-		unset($vars['text']);
+if (isset($vars['text'])) {
+	if (elgg_extract('encode_text', $vars, false)) {
+		$text = htmlspecialchars($vars['text'], ENT_QUOTES, 'UTF-8', false);
 	} else {
-		$text = htmlspecialchars($url, ENT_QUOTES, 'UTF-8');
+		$text = $vars['text'];
 	}
+	unset($vars['text']);
+} else {
+	$text = htmlspecialchars($url, ENT_QUOTES, 'UTF-8', false);
+}
 
-	unset($vars['encode_text']);
+unset($vars['encode_text']);
 
+if ($url) {
 	$url = elgg_normalize_url($url);
 
-	if (isset($vars['is_action'])) {
-		$url = elgg_add_action_tokens_to_url($url, FALSE);
-		unset($vars['is_action']);
+	if (elgg_extract('is_action', $vars, false)) {
+		$url = elgg_add_action_tokens_to_url($url, false);
+	}
+
+	if (!elgg_extract('is_trusted', $vars, false)) {
+		if (!isset($vars['rel'])) {
+			$vars['rel'] = 'nofollow';
+			$url = strip_tags($url);
+		}
 	}
 
 	$vars['href'] = $url;
+}
+
+unset($vars['is_action']);
+unset($vars['is_trusted']);
 
-	$attributes = elgg_format_attributes($vars);
-	echo "<a $attributes>$text</a>";
-}
\ No newline at end of file
+$attributes = elgg_format_attributes($vars);
+echo "<a $attributes>$text</a>";