From dd579937e36ec494372d8d99b49d0943ea2b721d Mon Sep 17 00:00:00 2001
From: Frederic Guillot <fred@kanboard.net>
Date: Thu, 23 Feb 2017 18:51:11 -0500
Subject: Add helper method to use implode() with HTML escaping

---
 app/Helper/TextHelper.php                     | 13 +++++++++++++
 app/Template/project_overview/information.php |  4 ++--
 2 files changed, 15 insertions(+), 2 deletions(-)

(limited to 'app')

diff --git a/app/Helper/TextHelper.php b/app/Helper/TextHelper.php
index 66583cd1..89c1a8f3 100644
--- a/app/Helper/TextHelper.php
+++ b/app/Helper/TextHelper.php
@@ -24,6 +24,19 @@ class TextHelper extends Base
         return htmlspecialchars($value, ENT_QUOTES, 'UTF-8', false);
     }
 
+    /**
+     * Join with HTML escaping
+     *
+     * @param  $glue
+     * @param  array $list
+     * @return string
+     */
+    public function implode($glue, array $list)
+    {
+        array_walk($list, function (&$value) { $value = htmlspecialchars($value, ENT_QUOTES, 'UTF-8', false); });
+        return implode($glue, $list);
+    }
+
     /**
      * Markdown transformation
      *
diff --git a/app/Template/project_overview/information.php b/app/Template/project_overview/information.php
index 0fe53e08..e8c20903 100644
--- a/app/Template/project_overview/information.php
+++ b/app/Template/project_overview/information.php
@@ -13,8 +13,8 @@
                     <?php foreach ($roles as $role => $role_name): ?>
                         <?php if (isset($users[$role])): ?>
                             <li>
-                                <?= $role_name ?>:
-                                <strong><?= implode(', ', $users[$role]) ?></strong>
+                                <?= $this->text->e($role_name) ?>:
+                                <strong><?= $this->text->implode(', ', $users[$role]) ?></strong>
                             </li>
                         <?php endif ?>
                     <?php endforeach ?>
-- 
cgit v1.2.3