1 files changed, 40 insertions, 17 deletions
diff --git a/views/default/output/url.php b/views/default/output/url.php
index 190b08c21..81b02087d 100644
--- a/views/default/output/url.php
+++ b/views/default/output/url.php
@@ -5,29 +5,52 @@
  *
  * @package Elgg
  * @subpackage Core
- * @author Curverider Ltd
- * @link http://elgg.org/
- *
- * @uses $vars['value'] The URL to display
  *
+ * @uses string $vars['text']        The string between the <a></a> tags.
+ * @uses string $vars['href']        The unencoded url string
+ * @uses bool   $vars['encode_text'] Run $vars['text'] through htmlspecialchars() (false)
+ * @uses bool   $vars['is_action']   Is this a link to an action (false)
+ * @uses bool   $vars['is_trusted']  Is this link trusted (false)
  */
 
-$val = trim($vars['value']);
-if (!empty($val)) {
-	if ((substr_count($val, "http://") == 0) && (substr_count($val, "https://") == 0)) {
-		$val = "http://" . $val;
+$url = elgg_extract('href', $vars, null);
+if (!$url and isset($vars['value'])) {
+	$url = trim($vars['value']);
+	unset($vars['value']);
+}
+
+if (isset($vars['text'])) {
+	if (elgg_extract('encode_text', $vars, false)) {
+		$text = htmlspecialchars($vars['text'], ENT_QUOTES, 'UTF-8', false);
+	} else {
+		$text = $vars['text'];
 	}
+	unset($vars['text']);
+} else {
+	$text = htmlspecialchars($url, ENT_QUOTES, 'UTF-8', false);
+}
 
-	if ($vars['is_action']) {
-		$ts = time();
-		$token = generate_action_token($ts);
+unset($vars['encode_text']);
 
-		$sep = "?";
-		if (strpos($val, '?')>0) {
-			$sep = "&";
+if ($url) {
+	$url = elgg_normalize_url($url);
+
+	if (elgg_extract('is_action', $vars, false)) {
+		$url = elgg_add_action_tokens_to_url($url, false);
+	}
+
+	if (!elgg_extract('is_trusted', $vars, false)) {
+		if (!isset($vars['rel'])) {
+			$vars['rel'] = 'nofollow';
+			$url = strip_tags($url);
 		}
-		$val = "$val{$sep}__elgg_token=$token&__elgg_ts=$ts";
 	}
 
-	echo "<a href=\"{$val}\" target=\"_blank\">". htmlentities($val, ENT_QUOTES, 'UTF-8'). "</a>";
-}
-\ No newline at end of file
+	$vars['href'] = $url;
+}
+
+unset($vars['is_action']);
+unset($vars['is_trusted']);
+
+$attributes = elgg_format_attributes($vars);
+echo "<a $attributes>$text</a>";