ci-bonfire/Bonfire — pull request #544 by sourcejedi (2012-08-11 17:32:06+00:00)
Title: HTML escaping: a quick audit of the views

This is based on (some) commits from the branch "HTML escaping and validity fixes v2": https://github.com/ci-bonfire/Bonfire/pull/537 , but it's fine to pull this one first!

I scanned the views for attributes, i.e. '="', and variable references, i.e. '$' which needed escaping, i.e. e( ). I noticed at least one of these as a very ripe target for XSS.

Also fix escaping in gravatar_link(), noticed during earlier testing.