Fixes #4023 escaping alt and title attributes in icon views

diff --git a/mod/file/views/default/icon/object/file.php b/mod/file/views/default/icon/object/file.php
index ff729da94d99a1c2fc17e55b6ad547641b10705c..51a4469e9135bc0c243f195f64f247fadbe98a92 100644 (file)
--- a/mod/file/views/default/icon/object/file.php
+++ b/mod/file/views/default/icon/object/file.php
@@ -5,7 +5,7 @@
  * @uses $vars['entity']     The entity the icon represents - uses getIconURL() method
  * @uses $vars['size']       topbar, tiny, small, medium (default), large, master
  * @uses $vars['href']       Optional override for link
- * @uses $vars['link_class'] Optional CSS class added to img
+ * @uses $vars['link_class'] Optional CSS class added to link
  */
 
 $entity = $vars['entity'];
@@ -17,6 +17,7 @@ if (!in_array($vars['size'], $sizes)) {
 }
 
 $title = $entity->title;
+$title = htmlspecialchars($title, ENT_QUOTES, 'UTF-8', false);
 
 $url = $entity->getURL();
 if (isset($vars['href'])) {

diff --git a/views/default/icon/default.php b/views/default/icon/default.php
index 533b92c433ea0b66da05e95208212a4611a407a8..6aeef204b837fa2147efdff56cca20dc51842308 100644 (file)
--- a/views/default/icon/default.php
+++ b/views/default/icon/default.php
@@ -5,9 +5,9 @@
  * @package Elgg
  * @subpackage Core
  *
- * @uses $vars['entity'] The entity the icon represents - uses getIconURL() method
- * @uses $vars['size']   topbar, tiny, small, medium (default), large, master
- * @uses $vars['href']   Optional override for link
+ * @uses $vars['entity']     The entity the icon represents - uses getIconURL() method
+ * @uses $vars['size']       topbar, tiny, small, medium (default), large, master
+ * @uses $vars['href']       Optional override for link
  * @uses $vars['img_class']  Optional CSS class added to img
  */
 
@@ -26,6 +26,7 @@ if (isset($entity->name)) {
 } else {
        $title = $entity->title;
 }
+$title = htmlspecialchars($title, ENT_QUOTES, 'UTF-8', false);
 
 $url = $entity->getURL();
 if (isset($vars['href'])) {

diff --git a/views/default/icon/user/default.php b/views/default/icon/user/default.php
index 0eb3691bd3271cfa603459b777128cde1ed0ea30..906371cf8386857d9edb6cc74a05fd0aea614bf7 100644 (file)
--- a/views/default/icon/user/default.php
+++ b/views/default/icon/user/default.php
@@ -26,7 +26,7 @@ if (!($user instanceof ElggUser)) {
        return true;
 }
 
-$name = htmlspecialchars($user->name, ENT_QUOTES, 'UTF-8');
+$name = htmlspecialchars($user->name, ENT_QUOTES, 'UTF-8', false);
 $username = $user->username;
 
 $icontime = $user->icontime;