In og.field.inc, og_field_formatter_view() generates a label for a group from og_label(), which is then passed to theme_link(). The problem with this is og_label_multiple() by default calls filter_xss() on the text, which escapes any entities; theme_link calls check_plain() on the text it's given, which also escapes any entities.

The correction is very simple, as og_label_multiple() does allow for values to not be sanitized. Patch will be attached which corrects the issue.

Support from Acquia helps fund testing for Drupal Acquia logo

Comments

timcosgrove’s picture

Patch attached. This is against current 7.x-1.x.

timcosgrove’s picture

Status: Active » Needs review
amitaibu’s picture

Maybe we should pass html => TRUE to the theme_link(), as we prefer filter_xss() than check_plain() for cases the group name is for example "H&M".

timcosgrove’s picture

Cool, no problem.

amitaibu’s picture

bulldozer2003’s picture

Status: Needs review » Reviewed & tested by the community

I like it! Thanks.

franz’s picture

+1 to this, works.

amitaibu’s picture

Status: Reviewed & tested by the community » Fixed

Committed, thanks.

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.