From 9f41e8b1a34044d654ce3c6381efe3b3e2030c35 Mon Sep 17 00:00:00 2001 From: ewinslow Date: Sat, 20 Nov 2010 08:25:52 +0000 Subject: Fixes #2036: using htmlspecialchars in output views git-svn-id: http://code.elgg.org/elgg/trunk@7368 36083f99-b078-4883-b0ff-0f9b5a30f544 --- views/default/output/calendar.php | 2 +- views/default/output/confirmlink.php | 2 +- views/default/output/email.php | 2 +- views/default/output/friendlytime.php | 2 +- views/default/output/pulldown.php | 2 +- views/default/output/tagcloud.php | 2 +- views/default/output/tags.php | 2 +- views/default/output/text.php | 2 +- views/default/output/url.php | 6 +++--- 9 files changed, 11 insertions(+), 11 deletions(-) (limited to 'views/default') diff --git a/views/default/output/calendar.php b/views/default/output/calendar.php index f791d435e..8729fa1c5 100644 --- a/views/default/output/calendar.php +++ b/views/default/output/calendar.php @@ -13,5 +13,5 @@ if (is_int($vars['value'])) { echo date("F j, Y", $vars['value']); } else { - echo htmlentities($vars['value'], ENT_QUOTES, 'UTF-8'); + echo htmlspecialchars($vars['value'], ENT_QUOTES, 'UTF-8'); } \ No newline at end of file diff --git a/views/default/output/confirmlink.php b/views/default/output/confirmlink.php index 4d1bc0ab9..bce06305a 100644 --- a/views/default/output/confirmlink.php +++ b/views/default/output/confirmlink.php @@ -26,4 +26,4 @@ if (isset($vars['class']) && $vars['class']) { $class = ''; } ?> - onclick="return confirm('');"> + onclick="return confirm('');"> diff --git a/views/default/output/email.php b/views/default/output/email.php index 02d2e67e0..8f5c092b9 100644 --- a/views/default/output/email.php +++ b/views/default/output/email.php @@ -11,5 +11,5 @@ */ if (!empty($vars['value'])) { - echo "". htmlentities($vars['value'], ENT_QUOTES, 'UTF-8') .""; + echo "". htmlspecialchars($vars['value'], ENT_QUOTES, 'UTF-8') .""; } \ No newline at end of file diff --git a/views/default/output/friendlytime.php b/views/default/output/friendlytime.php index 710079c2a..22f60d517 100644 --- a/views/default/output/friendlytime.php +++ b/views/default/output/friendlytime.php @@ -7,6 +7,6 @@ */ $friendly_time = elgg_get_friendly_time($vars['time']); -$timestamp = htmlentities(date(elgg_echo('friendlytime:date_format'), $vars['time'])); +$timestamp = htmlspecialchars(date(elgg_echo('friendlytime:date_format'), $vars['time'])); echo "$friendly_time"; diff --git a/views/default/output/pulldown.php b/views/default/output/pulldown.php index df58bebfe..c597eb5c9 100644 --- a/views/default/output/pulldown.php +++ b/views/default/output/pulldown.php @@ -10,4 +10,4 @@ * */ -echo htmlentities($vars['value'], ENT_QUOTES, 'UTF-8'); //$vars['value']; \ No newline at end of file +echo htmlspecialchars($vars['value'], ENT_QUOTES, 'UTF-8'); //$vars['value']; \ No newline at end of file diff --git a/views/default/output/tagcloud.php b/views/default/output/tagcloud.php index c7e87f688..d28fbf05f 100644 --- a/views/default/output/tagcloud.php +++ b/views/default/output/tagcloud.php @@ -58,7 +58,7 @@ if (!empty($vars['tagcloud']) && is_array($vars['tagcloud'])) { $size = 100; } $url = elgg_get_site_url()."pg/search/?q=". urlencode($tag->tag) . "&search_type=tags$type$subtype"; - $list .= "tag)." ($tag->total)\" style=\"text-decoration:none;\">" . htmlentities($tag->tag, ENT_QUOTES, 'UTF-8') . ""; + $list .= "tag)." ($tag->total)\" style=\"text-decoration:none;\">" . htmlspecialchars($tag->tag, ENT_QUOTES, 'UTF-8') . ""; } $cloud .= "$list"; diff --git a/views/default/output/tags.php b/views/default/output/tags.php index 6c8115d54..1dbf14a7d 100644 --- a/views/default/output/tags.php +++ b/views/default/output/tags.php @@ -43,7 +43,7 @@ if (!empty($vars['tags'])) { $type = ""; } if (is_string($tag)) { - $tagstr .= "" . htmlentities($tag, ENT_QUOTES, 'UTF-8') . ""; + $tagstr .= "" . htmlspecialchars($tag, ENT_QUOTES, 'UTF-8') . ""; } } echo $tagstr; diff --git a/views/default/output/text.php b/views/default/output/text.php index e0194099b..f95e2d7fd 100644 --- a/views/default/output/text.php +++ b/views/default/output/text.php @@ -10,4 +10,4 @@ * */ -echo htmlentities($vars['value'], ENT_QUOTES, 'UTF-8'); // $vars['value']; \ No newline at end of file +echo htmlspecialchars($vars['value'], ENT_QUOTES, 'UTF-8'); // $vars['value']; \ No newline at end of file diff --git a/views/default/output/url.php b/views/default/output/url.php index 23b774198..6e77a1984 100644 --- a/views/default/output/url.php +++ b/views/default/output/url.php @@ -7,7 +7,7 @@ * @subpackage Core * * @uses string $vars['text'] The string between the tags. - * @uses bool $vars['encode_text'] Run $vars['text'] through htmlentities()? + * @uses bool $vars['encode_text'] Run $vars['text'] through htmlspecialchars()? * @uses bool $vars['is_action'] Is this a link to an action? * */ @@ -21,14 +21,14 @@ if (!$url and isset($vars['value'])) { if (!empty($url)) { if (isset($vars['text'])) { if (isset($vars['encode_text']) && $vars['encode_text']) { - $text = htmlentities($vars['text'], ENT_QUOTES, 'UTF-8'); + $text = htmlspecialchars($vars['text'], ENT_QUOTES, 'UTF-8'); } else { $text = $vars['text']; } unset($vars['text']); } else { - $text = htmlentities($url, ENT_QUOTES, 'UTF-8'); + $text = htmlspecialchars($url, ENT_QUOTES, 'UTF-8'); } unset($vars['encode_text']); -- cgit v1.2.3