20 files changed, 509 insertions, 320 deletions

diff --git a/views/default/output/access.php b/views/default/output/access.php
new file mode 100644
index 000000000..5c8d62c4d
--- /dev/null
+++ b/views/default/output/access.php
@@ -0,0 +1,42 @@
+<?php
+/**
+ * Displays HTML for entity access levels.
+ * Requires an entity because some special logic for containers is used.
+ *
+ * @uses int $vars['entity'] - The entity whose access ID to display.
+ */
+
+//sort out the access level for display
+if (isset($vars['entity']) && elgg_instanceof($vars['entity'])) {
+	$access_id = $vars['entity']->access_id;
+	$access_class = 'elgg-access';
+	$access_id_string = get_readable_access_level($access_id);
+	$access_id_string = htmlspecialchars($access_id_string, ENT_QUOTES, 'UTF-8', false);
+
+	// if within a group or shared access collection display group name and open/closed membership status
+	// @todo have a better way to do this instead of checking against subtype / class.
+	$container = $vars['entity']->getContainerEntity();
+
+	if ($container && $container instanceof ElggGroup) {
+		// we decided to show that the item is in a group, rather than its actual access level
+		// not required. Group ACLs are prepended with "Group: " when written.
+		//$access_id_string = elgg_echo('groups:group') . $container->name;
+		$membership = $container->membership;
+
+		if ($membership == ACCESS_PUBLIC) {
+			$access_class .= ' elgg-access-group-open';
+		} else {
+			$access_class .= ' elgg-access-group-closed';
+		}
+
+		// @todo this is plugin specific code in core. Should be removed.
+	} elseif ($container && $container->getSubtype() == 'shared_access') {
+		$access_class .= ' shared_collection';
+	} elseif ($access_id == ACCESS_PRIVATE) {
+		$access_class .= ' elgg-access-private';
+	}
+
+	$help_text = elgg_echo('access:help');
+
+	echo "<span title=\"$help_text\" class=\"$access_class\">$access_id_string</span>";
+}
diff --git a/views/default/output/calendar.php b/views/default/output/calendar.php
index 336129aed..fa0bd0c04 100644
--- a/views/default/output/calendar.php
+++ b/views/default/output/calendar.php
@@ -1,24 +1,13 @@
 <?php
-
-	/**
-	 * Elgg calendar output
-	 * Displays a calendar output field
-	 * 
-	 * @package Elgg
-	 * @subpackage Core
-
-	 * @author Curverider Ltd
-
-	 * @link http://elgg.org/
-	 * 
-	 * @uses $vars['value'] The current value, if any
-	 * 
-	 */
-
-    if (is_int($vars['value'])) {
-        echo date("F j, Y", $vars['value']);
-    } else {
-        echo htmlentities($vars['value'], ENT_QUOTES, 'UTF-8');
-    }
-
-?>
\ No newline at end of file
+/**
+ * Elgg calendar output
+ * Displays a calendar output field
+ *
+ * @package Elgg
+ * @subpackage Core
+ *
+ * @uses $vars['value'] The current value, if any
+ *
+ */
+elgg_deprecated_notice('output/calendar was deprecated in favor of output/date', 1.8);
+echo elgg_view('output/date', $vars);
\ No newline at end of file
diff --git a/views/default/output/checkboxes.php b/views/default/output/checkboxes.php
index a93455e28..56d2588ac 100644
--- a/views/default/output/checkboxes.php
+++ b/views/default/output/checkboxes.php
@@ -1,19 +1,13 @@
 <?php
-
-	/**
-	 * Elgg text output
-	 * Displays some text that was input using a standard text field
-	 * 
-	 * @package Elgg
-	 * @subpackage Core
-
-	 * @author Curverider Ltd
-
-	 * @link http://elgg.org/
-	 * 
-	 * @uses $vars['text'] The text to display
-	 * 
-	 */
-
-    echo elgg_view('output/tags',$vars);
-?>
\ No newline at end of file
+/**
+ * Elgg text output
+ * Displays some text that was input using a standard text field
+ *
+ * @package Elgg
+ * @subpackage Core
+ *
+ * @uses $vars['text'] The text to display
+ *
+ */
+
+echo elgg_view('output/tags',$vars);
\ No newline at end of file
diff --git a/views/default/output/confirmlink.php b/views/default/output/confirmlink.php
index bb7e866f2..532790a38 100644
--- a/views/default/output/confirmlink.php
+++ b/views/default/output/confirmlink.php
@@ -1,42 +1,47 @@
 <?php
+/**
+ * Elgg confirmation link
+ * A link that displays a confirmation dialog before it executes
+ *
+ * @package Elgg
+ * @subpackage Core
+ *
+ * @uses $vars['text']        The text of the link
+ * @uses $vars['href']        The address
+ * @uses $vars['title']       The title text (defaults to confirm text)
+ * @uses $vars['confirm']     The dialog text
+ * @uses $vars['encode_text'] Run $vars['text'] through htmlspecialchars() (false)
+ */
 
-	/**
-	 * Elgg confirmation link
-	 * A link that displays a confirmation dialog before it executes
-	 * 
-	 * @package Elgg
-	 * @subpackage Core
+$vars['rel'] = elgg_extract('confirm', $vars, elgg_echo('question:areyousure'));
+$vars['rel'] = addslashes($vars['rel']);
+$encode = elgg_extract('encode_text', $vars, false);
 
-	 * @author Curverider Ltd
+// always generate missing action tokens
+$vars['href'] = elgg_add_action_tokens_to_url(elgg_normalize_url($vars['href']), true);
 
-	 * @link http://elgg.org/
-	 * 
-	 * @uses $vars['text'] The text of the link
-	 * @uses $vars['href'] The address
-	 * @uses $vars['confirm'] The dialog text
-	 * 
-	 */
+$text = elgg_extract('text', $vars, '');
+if ($encode) {
+	$text = htmlspecialchars($text, ENT_QUOTES, 'UTF-8', false);
+}
 
-	$confirm = $vars['confirm'];
-	if (!$confirm)
-		$confirm = elgg_echo('question:areyousure');
-		
-	$link = $vars['href'];
-	
-	if ($vars['is_action'])
-	{
-		$ts = time();
-		$token = generate_action_token($ts);
-    	
-    	$sep = "?";
-		if (strpos($link, '?')>0) $sep = "&";
-		$link = "$link{$sep}__elgg_token=$token&__elgg_ts=$ts";
-	}
-	
-	if ($vars['class']) {
-		$class = 'class="' . $vars['class'] . '"';
-	} else {
-		$class = '';
+if (!isset($vars['title']) && isset($vars['confirm'])) {
+	$vars['title'] = $vars['rel'];
+}
+
+if (isset($vars['class'])) {
+	if (!is_array($vars['class'])) {
+		$vars['class'] = array($vars['class']);
 	}
-?>
-<a href="<?php echo $link; ?>" <?php echo $class; ?> onclick="return confirm('<?php echo addslashes($confirm); ?>');"><?php echo htmlentities($vars['text'], ENT_QUOTES, 'UTF-8'); ?></a>
\ No newline at end of file
+	$vars['class'][] = 'elgg-requires-confirmation';
+} else {
+	$vars['class'] = 'elgg-requires-confirmation';
+}
+
+unset($vars['encode_text']);
+unset($vars['text']);
+unset($vars['confirm']);
+unset($vars['is_trusted']);
+
+$attributes = elgg_format_attributes($vars);
+echo "<a $attributes>$text</a>";
diff --git a/views/default/output/date.php b/views/default/output/date.php
index d4fba97a0..1644a3480 100644
--- a/views/default/output/date.php
+++ b/views/default/output/date.php
@@ -1,21 +1,17 @@
 <?php
+/**
+ * Date
+ * Displays a properly formatted date
+ *
+ * @package Elgg
+ * @subpackage Core
+ *
+ * @uses $vars['value'] Date as text or a Unix timestamp in seconds
+ */
 
-	/**
-	 * Date
-	 * Displays a properly formatted date
-	 * 
-	 * @package Elgg
-	 * @subpackage Core
+// convert timestamps to text for display
+if (is_numeric($vars['value'])) {
+	$vars['value'] = gmdate('Y-m-d', $vars['value']);
+}
 
-	 * @author Curverider Ltd
-
-	 * @link http://elgg.org/
-	 * 
-	 * @uses $vars['value'] A UNIX epoch timestamp
-	 * 
-	 */
-
-    if ($vars['value'] > 86400) {
-        echo date("F j, Y",$vars['value']);
-    }
-?>
\ No newline at end of file
+echo $vars['value'];
diff --git a/views/default/output/dropdown.php b/views/default/output/dropdown.php
new file mode 100644
index 000000000..8d68508ca
--- /dev/null
+++ b/views/default/output/dropdown.php
@@ -0,0 +1,13 @@
+<?php
+/**
+ * Elgg dropdown display
+ * Displays a value that was entered into the system via a dropdown
+ *
+ * @package Elgg
+ * @subpackage Core
+ *
+ * @uses $vars['text'] The text to display
+ *
+ */
+
+echo htmlspecialchars($vars['value'], ENT_QUOTES, 'UTF-8', false);
diff --git a/views/default/output/email.php b/views/default/output/email.php
index 2d454213f..f5a8bc4b8 100644
--- a/views/default/output/email.php
+++ b/views/default/output/email.php
@@ -1,21 +1,17 @@
 <?php
+/**
+ * Elgg email output
+ * Displays an email address that was entered using an email input field
+ *
+ * @package Elgg
+ * @subpackage Core
+ *
+ * @uses $vars['value'] The email address to display
+ *
+ */
 
-	/**
-	 * Elgg email output
-	 * Displays an email address that was entered using an email input field
-	 * 
-	 * @package Elgg
-	 * @subpackage Core
+$encoded_value = htmlspecialchars($vars['value'], ENT_QUOTES, 'UTF-8');
 
-	 * @author Curverider Ltd
-
-	 * @link http://elgg.org/
-	 * 
-	 * @uses $vars['value'] The email address to display
-	 * 
-	 */
-
-    if (!empty($vars['value'])) {
-    	echo "<a href=\"mailto:" . $vars['value'] . "\">". htmlentities($vars['value'], ENT_QUOTES, 'UTF-8') ."</a>";
-    }
-?>
\ No newline at end of file
+if (!empty($vars['value'])) {
+	echo "<a href=\"mailto:$encoded_value\">$encoded_value</a>";
+}
\ No newline at end of file
diff --git a/views/default/output/friendlytime.php b/views/default/output/friendlytime.php
new file mode 100644
index 000000000..22f60d517
--- /dev/null
+++ b/views/default/output/friendlytime.php
@@ -0,0 +1,12 @@
+<?php
+/**
+ * Friendly time
+ * Translates an epoch time into a human-readable time.
+ * 
+ * @uses string $vars['time'] Unix-style epoch timestamp
+ */
+
+$friendly_time = elgg_get_friendly_time($vars['time']);
+$timestamp = htmlspecialchars(date(elgg_echo('friendlytime:date_format'), $vars['time']));
+
+echo "<acronym title=\"$timestamp\">$friendly_time</acronym>";
diff --git a/views/default/output/friendlytitle.php b/views/default/output/friendlytitle.php
new file mode 100644
index 000000000..fbc4f39de
--- /dev/null
+++ b/views/default/output/friendlytitle.php
@@ -0,0 +1,19 @@
+<?php
+/**
+ * Friendly title
+ * Makes a URL-friendly title.
+ * 
+ * @uses string $vars['title'] Title to create from.
+ */
+
+
+$title = $vars['title'];
+
+//$title = iconv('UTF-8', 'ASCII//TRANSLIT', $title);
+$title = preg_replace("/[^\w ]/","",$title);
+$title = str_replace(" ","-",$title);
+$title = str_replace("--","-",$title);
+$title = trim($title);
+$title = strtolower($title);
+
+echo $title;
diff --git a/views/default/output/iframe.php b/views/default/output/iframe.php
index eb0cea0b4..7df9332f1 100644
--- a/views/default/output/iframe.php
+++ b/views/default/output/iframe.php
@@ -1,15 +1,13 @@
 <?php
-	/**
-	 * Display a page in an embedded window
-	 * 
-	 * @package Elgg
-	 * @subpackage Core
-	 * @author Curverider Ltd
-	 * @link http://elgg.org/
-	 * 
-	 * @uses $vars['value'] Source of the page
-	 * 
-	 */
+/**
+ * Display a page in an embedded window
+ *
+ * @package Elgg
+ * @subpackage Core
+ *
+ * @uses $vars['value'] Source of the page
+ *
+ */
 ?>
 <iframe src="<?php echo $vars['value']; ?>">
 </iframe>
\ No newline at end of file
diff --git a/views/default/output/img.php b/views/default/output/img.php
new file mode 100644
index 000000000..d3f596801
--- /dev/null
+++ b/views/default/output/img.php
@@ -0,0 +1,12 @@
+<?php
+/**
+ * Elgg image view
+ *
+ * @uses string $vars['src'] The image src url.
+ */
+
+$vars['src'] = elgg_normalize_url($vars['src']);
+$vars['src'] = elgg_format_url($vars['src']);
+
+$attributes = elgg_format_attributes($vars);
+echo "<img $attributes/>";
diff --git a/views/default/output/location.php b/views/default/output/location.php
new file mode 100644
index 000000000..e1009f17d
--- /dev/null
+++ b/views/default/output/location.php
@@ -0,0 +1,19 @@
+<?php
+/**
+ * Display a location
+ *
+ * @uses $vars['entity'] The ElggEntity that has a location
+ * @uses $vars['value']  The location string if the entity is not passed
+ */
+
+if (isset($vars['entity'])) {
+	$vars['value'] = $vars['entity']->location;
+	unset($vars['entity']);
+}
+
+// Fixes #4566 we used to allow arrays of strings for location
+if (is_array($vars['value'])) {
+	$vars['value'] = implode(', ', $vars['value']);
+}
+
+echo elgg_view('output/tag', $vars);
diff --git a/views/default/output/longtext.php b/views/default/output/longtext.php
index 3d130359a..589100c4f 100644
--- a/views/default/output/longtext.php
+++ b/views/default/output/longtext.php
@@ -1,21 +1,38 @@
 <?php
+/**
+ * Elgg display long text
+ * Displays a large amount of text, with new lines converted to line breaks
+ *
+ * @package Elgg
+ * @subpackage Core
+ *
+ * @uses $vars['value'] The text to display
+ * @uses $vars['parse_urls'] Whether to turn urls into links. Default is true.
+ * @uses $vars['class']
+ */
 
-	/**
-	 * Elgg display long text
-	 * Displays a large amount of text, with new lines converted to line breaks
-	 * 
-	 * @package Elgg
-	 * @subpackage Core
+$class = 'elgg-output';
+$additional_class = elgg_extract('class', $vars, '');
+if ($additional_class) {
+	$vars['class'] = "$class $additional_class";
+} else {
+	$vars['class'] = $class;
+}
 
-	 * @author Curverider Ltd
+$parse_urls = elgg_extract('parse_urls', $vars, true);
+unset($vars['parse_urls']);
 
-	 * @link http://elgg.org/
-	 * 
-	 * @uses $vars['text'] The text to display
-	 * 
-	 */
+$text = $vars['value'];
+unset($vars['value']);
 
-	global $CONFIG;
+if ($parse_urls) {
+	$text = parse_urls($text);
+}
 
-    echo autop(parse_urls(filter_tags($vars['value'])));
-?>
\ No newline at end of file
+$text = filter_tags($text);
+
+$text = elgg_autop($text);
+
+$attributes = elgg_format_attributes($vars);
+
+echo "<div $attributes>$text</div>";
diff --git a/views/default/output/pulldown.php b/views/default/output/pulldown.php
index 60b365b11..7097a9a8d 100644
--- a/views/default/output/pulldown.php
+++ b/views/default/output/pulldown.php
@@ -1,19 +1,14 @@
 <?php
-
-	/**
-	 * Elgg pulldown display
-	 * Displays a value that was entered into the system via a pulldown
-	 * 
-	 * @package Elgg
-	 * @subpackage Core
-
-	 * @author Curverider Ltd
-
-	 * @link http://elgg.org/
-	 * 
-	 * @uses $vars['text'] The text to display
-	 * 
-	 */
-
-    echo htmlentities($vars['value'], ENT_QUOTES, 'UTF-8'); //$vars['value'];
-?>
\ No newline at end of file
+/**
+ * Elgg pulldown display
+ * Displays a value that was entered into the system via a pulldown
+ *
+ * @package Elgg
+ * @subpackage Core
+ *
+ * @uses $vars['text'] The text to display
+ *
+ * @deprecated 1.8 Use output/dropdown
+ */
+
+echo elgg_view('output/dropdown', $vars);
\ No newline at end of file
diff --git a/views/default/output/radio.php b/views/default/output/radio.php
index 78723b555..0fae9977b 100644
--- a/views/default/output/radio.php
+++ b/views/default/output/radio.php
@@ -1,19 +1,13 @@
 <?php
-
-	/**
-	 * Elgg text output
-	 * Displays some text that was input using a standard text field
-	 * 
-	 * @package Elgg
-	 * @subpackage Core
-
-	 * @author Curverider Ltd
-
-	 * @link http://elgg.org/
-	 * 
-	 * @uses $vars['text'] The text to display
-	 * 
-	 */
-
-    echo elgg_view('output/text',$vars);
-?>
\ No newline at end of file
+/**
+ * Elgg text output
+ * Displays some text that was input using a standard text field
+ *
+ * @package Elgg
+ * @subpackage Core
+ *
+ * @uses $vars['text'] The text to display
+ *
+ */
+
+echo elgg_view('output/text', $vars);
\ No newline at end of file
diff --git a/views/default/output/tag.php b/views/default/output/tag.php
new file mode 100644
index 000000000..6bd9a72a7
--- /dev/null
+++ b/views/default/output/tag.php
@@ -0,0 +1,35 @@
+<?php
+/**
+ * Elgg single tag output
+ *
+ * @uses $vars['value']   String
+ * @uses $vars['type']    The entity type, optional
+ * @uses $vars['subtype'] The entity subtype, optional
+ *
+ */
+
+if (!empty($vars['type'])) {
+	$type = "&type=" . rawurlencode($vars['type']);
+} else {
+	$type = "";
+}
+if (!empty($vars['subtype'])) {
+	$subtype = "&subtype=" . rawurlencode($vars['subtype']);
+} else {
+	$subtype = "";
+}
+if (!empty($vars['object'])) {
+	$object = "&object=" . rawurlencode($vars['object']);
+} else {
+	$object = "";
+}
+
+if (isset($vars['value'])) {
+	$url = elgg_get_site_url() . 'search?q=' . rawurlencode($vars['value']) . "&search_type=tags{$type}{$subtype}{$object}";
+	$vars['value'] = htmlspecialchars($vars['value'], ENT_QUOTES, 'UTF-8', false);
+	echo elgg_view('output/url', array(
+		'href' => $url,
+		'text' => $vars['value'],
+		'rel' => 'tag',
+	));
+}
diff --git a/views/default/output/tagcloud.php b/views/default/output/tagcloud.php
index 27d49b089..2fbf1cd0a 100644
--- a/views/default/output/tagcloud.php
+++ b/views/default/output/tagcloud.php
@@ -1,52 +1,66 @@
 <?php
+/**
+ * Elgg tagcloud
+ * Displays a tagcloud
+ *
+ * @package Elgg
+ * @subpackage Core
+ *
+ * @uses $vars['tagcloud'] An array of stdClass objects with two elements: 'tag' (the text of the tag) and 'total' (the number of elements with this tag)
+ * @uses $vars['value'] Sames as tagcloud
+ * @uses $vars['type'] Entity type
+ * @uses $vars['subtype'] Entity subtype
+ */
 
-	/**
-	 * Elgg tagcloud
-	 * Displays a tagcloud
-	 * 
-	 * @package Elgg
-	 * @subpackage Core
+if (!empty($vars['subtype'])) {
+	$subtype = "&entity_subtype=" . urlencode($vars['subtype']);
+} else {
+	$subtype = "";
+}
+if (!empty($vars['type'])) {
+	$type = "&entity_type=" . urlencode($vars['type']);
+} else {
+	$type = "";
+}
 
-	 * @author Curverider Ltd
+if (empty($vars['tagcloud']) && !empty($vars['value'])) {
+	$vars['tagcloud'] = $vars['value'];
+}
 
-	 * @link http://elgg.org/
-	 * 
-	 * @uses $vars['tagcloud'] An array of stdClass objects with two elements: 'tag' (the text of the tag) and 'total' (the number of elements with this tag) 
-	 * 
-	 */
-    
-	if (!empty($vars['subtype'])) {
-		$subtype = "&subtype=" . urlencode($vars['subtype']);
-	} else {
-		$subtype = "";
-	}
-	if (!empty($vars['object'])) {
-		$object = "&object=" . urlencode($vars['object']);
-	} else {
-		$object = "";
+if (!empty($vars['tagcloud']) && is_array($vars['tagcloud'])) {
+	$counter = 0;
+	$max = 0;
+	
+	foreach ($vars['tagcloud'] as $tag) {
+		if ($tag->total > $max) {
+			$max = $tag->total;
+		}
 	}
 	
-	if (empty($vars['tagcloud']) && !empty($vars['value']))
-		$vars['tagcloud'] = $vars['value'];
+	$cloud = '';
+	foreach ($vars['tagcloud'] as $tag) {
+		$tag->tag = htmlspecialchars($tag->tag, ENT_QUOTES, 'UTF-8', false);
+
+		if ($cloud != '') {
+			$cloud .= ', ';
+		}
+		// protecting against division by zero warnings
+		$size = round((log($tag->total) / log($max + .0001)) * 100) + 30;
+		if ($size < 100) {
+			$size = 100;
+		}
+		$url = "search?q=". urlencode($tag->tag) . "&search_type=tags$type$subtype";
 
-    if (!empty($vars['tagcloud']) && is_array($vars['tagcloud'])) {
-        
-        $counter = 0;
-        $cloud = "";
-        $max = 0;
-        foreach($vars['tagcloud'] as $tag) {
-        	if ($tag->total > $max) {
-        		$max = $tag->total;
-        	}
-        }
-        foreach($vars['tagcloud'] as $tag) {
-            if (!empty($cloud)) $cloud .= ", ";
-            $size = round((log($tag->total) / log($max)) * 100) + 30;
-            if ($size < 60) $size = 60;
-            $cloud .= "<a href=\"" . $vars['url'] . "search/?tag=". urlencode($tag->tag) . $object . $subtype . "\" style=\"font-size: {$size}%\" title=\"".addslashes($tag->tag)." ({$tag->total})\" style=\"text-decoration:none;\">" . htmlentities($tag->tag, ENT_QUOTES, 'UTF-8') . "</a>";
-        }
-        echo $cloud;
+		$cloud .= elgg_view('output/url', array(
+			'text' => $tag->tag,
+			'href' => $url,
+			'style' => "font-size: $size%;",
+			'title' => "$tag->tag ($tag->total)",
+			'rel' => 'tag'
+		));
+	}
+	
+	$cloud .= elgg_view('tagcloud/extend');
 
-    }
-     
-?>
\ No newline at end of file
+	echo "<div class=\"elgg-tagcloud\">$cloud</div>";
+}
diff --git a/views/default/output/tags.php b/views/default/output/tags.php
index 901fa806b..db096a3be 100644
--- a/views/default/output/tags.php
+++ b/views/default/output/tags.php
@@ -1,55 +1,82 @@
 <?php
+/**
+ * Elgg tags
+ * Tags can be a single string (for one tag) or an array of strings
+ *
+ * @uses $vars['value']   Array of tags or a string
+ * @uses $vars['type']    The entity type, optional
+ * @uses $vars['subtype'] The entity subtype, optional
+ * @uses $vars['entity']  Optional. Entity whose tags are being displayed (metadata ->tags)
+ * @uses $vars['list_class'] Optional. Additional classes to be passed to <ul> element
+ * @uses $vars['item_class'] Optional. Additional classes to be passed to <li> elements
+ * @uses $vars['icon_class'] Optional. Additional classes to be passed to tags icon image
+ */
 
-	/**
-	 * Elgg tags
-	 * Displays a list of tags, separated by commas
-	 * 
-	 * Tags can be a single string (for one tag) or an array of strings
-	 * 
-	 * @package Elgg
-	 * @subpackage Core
-
-	 * @author Curverider Ltd
-
-	 * @link http://elgg.org/
-	 * 
-	 * @uses $vars['tags'] The tags to display
-	 * @uses $vars['tagtype'] The tagtype, optionally
-	 */
-
-	if (!empty($vars['subtype'])) {
-		$subtype = "&subtype=" . urlencode($vars['subtype']);
-	} else {
-		$subtype = "";
+if (isset($vars['entity'])) {
+	$vars['tags'] = $vars['entity']->tags;
+	unset($vars['entity']);
+}
+
+if (!empty($vars['type'])) {
+	$type = "&type=" . rawurlencode($vars['type']);
+} else {
+	$type = "";
+}
+if (!empty($vars['subtype'])) {
+	$subtype = "&subtype=" . rawurlencode($vars['subtype']);
+} else {
+	$subtype = "";
+}
+if (!empty($vars['object'])) {
+	$object = "&object=" . rawurlencode($vars['object']);
+} else {
+	$object = "";
+}
+
+if (empty($vars['tags']) && !empty($vars['value'])) {
+	$vars['tags'] = $vars['value'];
+}
+
+if (empty($vars['tags']) && isset($vars['entity'])) {
+	$vars['tags'] = $vars['entity']->tags;
+}
+
+if (!empty($vars['tags'])) {
+	if (!is_array($vars['tags'])) {
+		$vars['tags'] = array($vars['tags']);
 	}
-	if (!empty($vars['object'])) {
-		$object = "&object=" . urlencode($vars['object']);
-	} else {
-		$object = "";
+
+	$list_class = "elgg-tags";
+	if (isset($vars['list_class'])) {
+		$list_class = "$list_class {$vars['list_class']}";
 	}
 
-	if (empty($vars['tags']) && !empty($vars['value']))
-		$vars['tags'] = $vars['value'];
-    if (!empty($vars['tags'])) {
-        
-        $tagstr = "";
-        if (!is_array($vars['tags']))
-        	$vars['tags'] = array($vars['tags']);
-
-        foreach($vars['tags'] as $tag) {
-            if (!empty($tagstr)) {
-                $tagstr .= ", ";
-            }
-           if (!empty($vars['type'])) {
-               $type = "&type={$vars['type']}";
-           } else {
-               $type = "";
-           }
-           if (is_string($tag)) { 
-               $tagstr .= "<a rel=\"tag\" href=\"{$vars['url']}tag/".urlencode($tag) . "{$type}{$subtype}{$object}\">" . htmlentities($tag, ENT_QUOTES, 'UTF-8') . "</a>";
-           }
-        }
-         echo $tagstr;
-        
-    }
-?>
\ No newline at end of file
+	$item_class = "elgg-tag";
+	if (isset($vars['item_class'])) {
+		$item_class = "$item_class {$vars['item_class']}";
+	}
+
+	$icon_class = elgg_extract('icon_class', $vars);
+	$list_items = '<li>' . elgg_view_icon('tag', $icon_class) . '</li>';
+		
+	foreach($vars['tags'] as $tag) {
+		$url = elgg_get_site_url() . 'search?q=' . rawurlencode($tag) . "&search_type=tags{$type}{$subtype}{$object}";
+		if (is_string($tag)) {
+			$tag = htmlspecialchars($tag, ENT_QUOTES, 'UTF-8', false);
+			$list_items .= "<li class=\"$item_class\">";
+			$list_items .= elgg_view('output/url', array('href' => $url, 'text' => $tag, 'rel' => 'tag'));
+			$list_items .= '</li>';
+		}
+	}
+
+	$list = <<<___HTML
+		<div class="clearfix">
+			<ul class="$list_class">
+				$list_items
+			</ul>
+		</div>
+___HTML;
+
+	echo $list;
+}
+
diff --git a/views/default/output/text.php b/views/default/output/text.php
index 080b81d68..5cbfc35b0 100644
--- a/views/default/output/text.php
+++ b/views/default/output/text.php
@@ -1,19 +1,12 @@
 <?php
-
-	/**
-	 * Elgg text output
-	 * Displays some text that was input using a standard text field
-	 * 
-	 * @package Elgg
-	 * @subpackage Core
-
-	 * @author Curverider Ltd
-
-	 * @link http://elgg.org/
-	 * 
-	 * @uses $vars['text'] The text to display
-	 * 
-	 */
-
-    echo htmlentities($vars['value'], ENT_QUOTES, 'UTF-8'); // $vars['value'];
-?>
\ No newline at end of file
+/**
+ * Elgg text output
+ * Displays some text that was input using a standard text field
+ *
+ * @package Elgg
+ * @subpackage Core
+ *
+ * @uses $vars['value'] The text to display
+ */
+
+echo htmlspecialchars($vars['value'], ENT_QUOTES, 'UTF-8', false);
\ No newline at end of file
diff --git a/views/default/output/url.php b/views/default/output/url.php
index 7f72f0dce..81b02087d 100644
--- a/views/default/output/url.php
+++ b/views/default/output/url.php
@@ -1,37 +1,56 @@
 <?php
+/**
+ * Elgg URL display
+ * Displays a URL as a link
+ *
+ * @package Elgg
+ * @subpackage Core
+ *
+ * @uses string $vars['text']        The string between the <a></a> tags.
+ * @uses string $vars['href']        The unencoded url string
+ * @uses bool   $vars['encode_text'] Run $vars['text'] through htmlspecialchars() (false)
+ * @uses bool   $vars['is_action']   Is this a link to an action (false)
+ * @uses bool   $vars['is_trusted']  Is this link trusted (false)
+ */
 
-	/**
-	 * Elgg URL display
-	 * Displays a URL as a link
-	 * 
-	 * @package Elgg
-	 * @subpackage Core
-
-	 * @author Curverider Ltd
-
-	 * @link http://elgg.org/
-	 * 
-	 * @uses $vars['value'] The URL to display
-	 * 
-	 */
-
-    $val = trim($vars['value']);
-    if (!empty($val)) {
-	    if ((substr_count($val, "http://") == 0) && (substr_count($val, "https://") == 0)) {
-	        $val = "http://" . $val;
-	    }
-	    
-	    if ($vars['is_action'])
-		{
-			$ts = time();
-			$token = generate_action_token($ts);
-	    	
-	    	$sep = "?";
-			if (strpos($val, '?')>0) $sep = "&";
-			$val = "$val{$sep}__elgg_token=$token&__elgg_ts=$ts";
+$url = elgg_extract('href', $vars, null);
+if (!$url and isset($vars['value'])) {
+	$url = trim($vars['value']);
+	unset($vars['value']);
+}
+
+if (isset($vars['text'])) {
+	if (elgg_extract('encode_text', $vars, false)) {
+		$text = htmlspecialchars($vars['text'], ENT_QUOTES, 'UTF-8', false);
+	} else {
+		$text = $vars['text'];
+	}
+	unset($vars['text']);
+} else {
+	$text = htmlspecialchars($url, ENT_QUOTES, 'UTF-8', false);
+}
+
+unset($vars['encode_text']);
+
+if ($url) {
+	$url = elgg_normalize_url($url);
+
+	if (elgg_extract('is_action', $vars, false)) {
+		$url = elgg_add_action_tokens_to_url($url, false);
+	}
+
+	if (!elgg_extract('is_trusted', $vars, false)) {
+		if (!isset($vars['rel'])) {
+			$vars['rel'] = 'nofollow';
+			$url = strip_tags($url);
 		}
-	    
-	    echo "<a href=\"{$val}\" target=\"_blank\">". htmlentities($val, ENT_QUOTES, 'UTF-8'). "</a>";
-    }
+	}
+
+	$vars['href'] = $url;
+}
+
+unset($vars['is_action']);
+unset($vars['is_trusted']);
 
-?>
\ No newline at end of file
+$attributes = elgg_format_attributes($vars);
+echo "<a $attributes>$text</a>";