Fixes #1835. Passing tagcloud URLs through output/url for proper escaping.

diff --git a/views/default/output/tagcloud.php b/views/default/output/tagcloud.php
index 22b6cf49d7ee1ec113564268052553b0f46c31fa..a212becd8aa691800cc15726705c2a78252fc731 100644 (file)
--- a/views/default/output/tagcloud.php
+++ b/views/default/output/tagcloud.php
@@ -47,9 +47,15 @@ if (!empty($vars['tagcloud']) && is_array($vars['tagcloud'])) {
                if ($size < 100) {
                        $size = 100;
                }
-               $url = elgg_get_site_url()."search?q=". urlencode($tag->tag) . "&search_type=tags$type$subtype";
-               $url = elgg_format_url($url);
-               $cloud .= "<a href=\"$url\" style=\"font-size: $size%\" title=\"".addslashes($tag->tag)." ($tag->total)\">" . htmlspecialchars($tag->tag, ENT_QUOTES, 'UTF-8') . "</a>";
+               $url = "search?q=". urlencode($tag->tag) . "&search_type=tags$type$subtype";
+
+               $cloud .= elgg_view('output/url', array(
+                       'text' => $tag->tag,
+                       'href' => $url,
+                       'style' => "font-size: $size%;",
+                       'title' => "$tag->tag ($tag->total)",
+                       'rel' => 'tag'
+               ));
        }
        
        $cloud .= elgg_view('tagcloud/extend');