Fixes #2036: using htmlspecialchars in output views

git-svn-id: http://code.elgg.org/elgg/trunk@7368 36083f99-b078-4883-b0ff-0f9b5a30f544

diff --git a/views/default/output/calendar.php b/views/default/output/calendar.php
index f791d435ed774642e06205ed5ebecb58d52c6631..8729fa1c55c3c6fbcdb76ad4f68e68b566391700 100644 (file)
--- a/views/default/output/calendar.php
+++ b/views/default/output/calendar.php
@@ -13,5 +13,5 @@
 if (is_int($vars['value'])) {
        echo date("F j, Y", $vars['value']);
 } else {
-       echo htmlentities($vars['value'], ENT_QUOTES, 'UTF-8');
+       echo htmlspecialchars($vars['value'], ENT_QUOTES, 'UTF-8');
 }
\ No newline at end of file

diff --git a/views/default/output/confirmlink.php b/views/default/output/confirmlink.php
index 4d1bc0ab9d22cf7fc18a7ef0c37f587487e5a981..bce06305ad7be2fd8af4170b41906df5d792cd76 100644 (file)
--- a/views/default/output/confirmlink.php
+++ b/views/default/output/confirmlink.php
@@ -26,4 +26,4 @@ if (isset($vars['class']) && $vars['class']) {
        $class = '';
 }
 ?>
-<a href="<?php echo $link; ?>" <?php echo $class; ?> onclick="return confirm('<?php echo addslashes($confirm); ?>');"><?php echo htmlentities($vars['text'], ENT_QUOTES, 'UTF-8'); ?></a>
+<a href="<?php echo $link; ?>" <?php echo $class; ?> onclick="return confirm('<?php echo addslashes($confirm); ?>');"><?php echo htmlspecialchars($vars['text'], ENT_QUOTES, 'UTF-8'); ?></a>

diff --git a/views/default/output/email.php b/views/default/output/email.php
index 02d2e67e08e03a23434478112aa0c1a3a4f18c97..8f5c092b9931bae8baf5da6e28d3bca1e4d88baf 100644 (file)
--- a/views/default/output/email.php
+++ b/views/default/output/email.php
@@ -11,5 +11,5 @@
  */
 
 if (!empty($vars['value'])) {
-       echo "<a href=\"mailto:" . $vars['value'] . "\">". htmlentities($vars['value'], ENT_QUOTES, 'UTF-8') ."</a>";
+       echo "<a href=\"mailto:" . $vars['value'] . "\">". htmlspecialchars($vars['value'], ENT_QUOTES, 'UTF-8') ."</a>";
 }
\ No newline at end of file

diff --git a/views/default/output/friendlytime.php b/views/default/output/friendlytime.php
index 710079c2a062e5719a6f82af56d6cee202ec519b..22f60d5178d5d0906b751dea58f6d07d05f93379 100644 (file)
--- a/views/default/output/friendlytime.php
+++ b/views/default/output/friendlytime.php
@@ -7,6 +7,6 @@
  */
 
 $friendly_time = elgg_get_friendly_time($vars['time']);
-$timestamp = htmlentities(date(elgg_echo('friendlytime:date_format'), $vars['time']));
+$timestamp = htmlspecialchars(date(elgg_echo('friendlytime:date_format'), $vars['time']));
 
 echo "<acronym title=\"$timestamp\">$friendly_time</acronym>";

diff --git a/views/default/output/pulldown.php b/views/default/output/pulldown.php
index df58bebfed4d39159df30599f728d8d17fc764c2..c597eb5c9fec6ad8996701c04871027d0cdda6c9 100644 (file)
--- a/views/default/output/pulldown.php
+++ b/views/default/output/pulldown.php
@@ -10,4 +10,4 @@
  *
  */
 
-echo htmlentities($vars['value'], ENT_QUOTES, 'UTF-8'); //$vars['value'];
\ No newline at end of file
+echo htmlspecialchars($vars['value'], ENT_QUOTES, 'UTF-8'); //$vars['value'];
\ No newline at end of file

diff --git a/views/default/output/tagcloud.php b/views/default/output/tagcloud.php
index c7e87f6888f650e7c9d13d9c50452cf343e3e672..d28fbf05ff641b85e72d903f72837f97ce739ee5 100644 (file)
--- a/views/default/output/tagcloud.php
+++ b/views/default/output/tagcloud.php
@@ -58,7 +58,7 @@ if (!empty($vars['tagcloud']) && is_array($vars['tagcloud'])) {
                        $size = 100;
                }
                $url = elgg_get_site_url()."pg/search/?q=". urlencode($tag->tag) . "&search_type=tags$type$subtype";
-               $list .= "<a href=\"$url\" style=\"font-size: $size%\" title=\"".addslashes($tag->tag)." ($tag->total)\" style=\"text-decoration:none;\">" . htmlentities($tag->tag, ENT_QUOTES, 'UTF-8') . "</a>";
+               $list .= "<a href=\"$url\" style=\"font-size: $size%\" title=\"".addslashes($tag->tag)." ($tag->total)\" style=\"text-decoration:none;\">" . htmlspecialchars($tag->tag, ENT_QUOTES, 'UTF-8') . "</a>";
        }
        
        $cloud .= "$list</div>";

diff --git a/views/default/output/tags.php b/views/default/output/tags.php
index 6c8115d543dcd5e120a2c9a4ceb099f3d738971b..1dbf14a7d93e6d66d87b7dc9604c6cfa7fb0618f 100644 (file)
--- a/views/default/output/tags.php
+++ b/views/default/output/tags.php
@@ -43,7 +43,7 @@ if (!empty($vars['tags'])) {
                        $type = "";
                }
                if (is_string($tag)) {
-                       $tagstr .= "<a rel=\"tag\" href=\"".elgg_get_site_url()."pg/search/?q=".urlencode($tag) . "&search_type=tags{$type}{$subtype}{$object}\">" . htmlentities($tag, ENT_QUOTES, 'UTF-8') . "</a>";
+                       $tagstr .= "<a rel=\"tag\" href=\"".elgg_get_site_url()."pg/search/?q=".urlencode($tag) . "&search_type=tags{$type}{$subtype}{$object}\">" . htmlspecialchars($tag, ENT_QUOTES, 'UTF-8') . "</a>";
                }
        }
        echo $tagstr;

diff --git a/views/default/output/text.php b/views/default/output/text.php
index e0194099bfa73886eb9a8ea28609598f0be04638..f95e2d7fd7602b7270182a3d285ee1965f45c5e3 100644 (file)
--- a/views/default/output/text.php
+++ b/views/default/output/text.php
@@ -10,4 +10,4 @@
  *
  */
 
-echo htmlentities($vars['value'], ENT_QUOTES, 'UTF-8'); // $vars['value'];
\ No newline at end of file
+echo htmlspecialchars($vars['value'], ENT_QUOTES, 'UTF-8'); // $vars['value'];
\ No newline at end of file

diff --git a/views/default/output/url.php b/views/default/output/url.php
index 23b77419891fd56fc47ee994a56251c0e300b528..6e77a1984973221bff9b1cfa7674f445610aa339 100644 (file)
--- a/views/default/output/url.php
+++ b/views/default/output/url.php
@@ -7,7 +7,7 @@
  * @subpackage Core
  *
  * @uses string $vars['text']        The string between the <a></a> tags.
- * @uses bool   $vars['encode_text'] Run $vars['text'] through htmlentities()?
+ * @uses bool   $vars['encode_text'] Run $vars['text'] through htmlspecialchars()?
  * @uses bool   $vars['is_action']   Is this a link to an action?
  *
  */
@@ -21,14 +21,14 @@ if (!$url and isset($vars['value'])) {
 if (!empty($url)) {\r
        if (isset($vars['text'])) {
                if (isset($vars['encode_text']) && $vars['encode_text']) {
-                       $text = htmlentities($vars['text'], ENT_QUOTES, 'UTF-8');
+                       $text = htmlspecialchars($vars['text'], ENT_QUOTES, 'UTF-8');
                } else {
                        $text = $vars['text'];
                }
 
                unset($vars['text']);
        } else {
-               $text = htmlentities($url, ENT_QUOTES, 'UTF-8');
+               $text = htmlspecialchars($url, ENT_QUOTES, 'UTF-8');
        }
 
        unset($vars['encode_text']);