Escape variables in googleauth module

Jamie Snape · Jamie Snape · commit 5fda63b531d0 · 2014-12-08T09:20:01.000-05:00
diff --git a/modules/googleauth/Notification.php b/modules/googleauth/Notification.php
@@ -64,7 +64,7 @@ public function googleAuthLink()
         $userNs->oauthToken = $csrfToken;
         session_write_close();
 
-        return '<div style="margin-top: 10px; display: inline-block;">Or '.'<a class="googleauth-login" style="text-decoration: underline;" href="'.$href.'">'.'Login with your Google account</a></div><script type="text/javascript"'.' src="'.$fc->getBaseUrl(
+        return '<div style="margin-top: 10px; display: inline-block;">Or '.'<a class="googleauth-login" style="text-decoration: underline;" href="'.htmlspecialchars($href, ENT_QUOTES, 'UTF-8').'">'.'Login with your Google account</a></div><script type="text/javascript"'.' src="'.$fc->getBaseUrl(
         ).'/modules/'.$this->moduleName.'/public/js/login/googleauth.login.js"></script>';
     }
 

Original file line number	Diff line number	Diff line change
`@@ -64,7 +64,7 @@ public function googleAuthLink()`
`64`	`64`	`$userNs->oauthToken = $csrfToken;`
`65`	`65`	`session_write_close();`
`66`	`66`
`67`		`- return '<div style="margin-top: 10px; display: inline-block;">Or '.'<a class="googleauth-login" style="text-decoration: underline;" href="'.$href.'">'.'Login with your Google account</a></div><script type="text/javascript"'.' src="'.$fc->getBaseUrl(`
	`67`	`+ return '<div style="margin-top: 10px; display: inline-block;">Or '.'<a class="googleauth-login" style="text-decoration: underline;" href="'.htmlspecialchars($href, ENT_QUOTES, 'UTF-8').'">'.'Login with your Google account</a></div><script type="text/javascript"'.' src="'.$fc->getBaseUrl(`
`68`	`68`	`).'/modules/'.$this->moduleName.'/public/js/login/googleauth.login.js"></script>';`
`69`	`69`	`}`
`70`	`70`