ci-bonfire/Bonfire — pull request #546 by sourcejedi (2012-08-15 09:22:06+00:00)
Title: [v2] HTML escaping: a quick audit of the views

This is based on (some) commits from the branch "HTML escaping and validity fixes v2": https://github.com/ci-bonfire/Bonfire/pull/537 , but it's fine to pull this one first!

I scanned the views for attributes, i.e. '="', and variable references, i.e. '$' which needed escaping, e.g. e(). I noticed at least one of these as a very ripe target for XSS.

Also fix escaping in gravatar_link(), noticed during earlier testing.

---
(If github doesn't, you may want to strip the version information from the merge commit. It'll be a bit pointless in the Git history, without the previous version to refer to).

Changes from v1:
- "Escape form input values" now understands set_value(); it only needs to fix places where Bonfire was mis-using it. Fixing the misuse also improves the form's behaviour on validation failures.
- Escaping "text of
elements" is removed from the above commit, and added to "Escape variables that need it" instead.