Browse Source

Use htmlspecialchars when parsing a URL see #7564.

Julio Montoya 10 years ago
parent
commit
ba947ae637
1 changed files with 2 additions and 1 deletions
  1. 2 1
      main/inc/lib/display.lib.php

+ 2 - 1
main/inc/lib/display.lib.php

@@ -832,7 +832,8 @@ class Display
     public static function url($name, $url, $extra_attributes = array())
     {
         if (!empty($url)) {
-            $extra_attributes['href']= $url;
+            $url = htmlspecialchars($url, ENT_QUOTES, 'UTF-8');
+            $extra_attributes['href'] = $url;
         }
         return self::tag('a', $name, $extra_attributes);
     }