Closes #1131: htmlentities in view around user text

git-svn-id: https://code.elgg.org/elgg/trunk@3408 36083f99-b078-4883-b0ff-0f9b5a30f544

diff --git a/mod/groups/views/default/object/groupforumtopic.php b/mod/groups/views/default/object/groupforumtopic.php
index a6d214fcf7d2535ea64347acf1c48d2754044ad6..a35aa3f874bfb054808c5978c55e9c16d5ca55e2 100644 (file)
--- a/mod/groups/views/default/object/groupforumtopic.php
+++ b/mod/groups/views/default/object/groupforumtopic.php
@@ -11,7 +11,7 @@
         */\r
         \r
     //get the required variables\r
-    $title = $vars['entity']->title;\r
+    $title = htmlentities($vars['entity']->title, ENT_QUOTES, 'UTF-8');\r
     //$description = get_entity($vars['entity']->description);\r
     $topic_owner = get_user($vars['entity']->owner_guid);\r
     $group = get_entity($vars['entity']->container_guid);\r
@@ -40,7 +40,7 @@
                $icon = elgg_view("profile/icon",array('entity' => $group, 'size' => 'small'));\r
            //get the group and topic title\r
            if ($group instanceof ElggGroup)\r
-               $info .= "<p>" . elgg_echo('group') . ": <a href=\"{$group->getURL()}\">{$group->name}</a></p>";\r
+               $info .= "<p>" . elgg_echo('group') . ": <a href=\"{$group->getURL()}\">".htmlentities($group->name, ENT_QUOTES, 'UTF-8') ."</a></p>";\r
            \r
                $info .= "<p>" . elgg_echo('topic') . ": <a href=\"{$vars['url']}mod/groups/topicposts.php?topic={$vars['entity']->guid}&group_guid={$group->guid}\">{$title}</a></p>";\r
                //get the forum description\r