From 5efa9426d40326b8d31c152dd2a433076b490308 Mon Sep 17 00:00:00 2001
From: Steve Clay <steve@mrclay.org>
Date: Sun, 9 Sep 2012 01:52:09 -0400
Subject: Fixes #4593: All titles are HTML-escaped plain text

---
 mod/pages/actions/pages/edit.php | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

(limited to 'mod/pages')

diff --git a/mod/pages/actions/pages/edit.php b/mod/pages/actions/pages/edit.php
index a32e4a4ba..fe5754d76 100644
--- a/mod/pages/actions/pages/edit.php
+++ b/mod/pages/actions/pages/edit.php
@@ -8,9 +8,10 @@
 $variables = elgg_get_config('pages');
 $input = array();
 foreach ($variables as $name => $type) {
-	$input[$name] = get_input($name);
 	if ($name == 'title') {
-		$input[$name] = strip_tags($input[$name]);
+		$input[$name] = htmlspecialchars(get_input($name, '', false), ENT_QUOTES, 'UTF-8');
+	} else {
+		$input[$name] = get_input($name);
 	}
 	if ($type == 'tags') {
 		$input[$name] = string_to_tag_array($input[$name]);
-- 
cgit v1.2.3