Escape breadcrumb titles (#186)

Titles containing non-alphanumeric characters can break the layout or formatting when rendered in breadcrumbs. Escaping them on output with html entities fixes this for existing and future titles.
tsugiproject · Sep 27, 2024 · 0bd5c98 · 0bd5c98
1 parent 02b19b8
commit 0bd5c98
Show file tree

Hide file tree

Showing 4 changed files with 4 additions and 4 deletions.
diff --git a/lti/store/details.php b/lti/store/details.php
@@ -280,7 +280,7 @@
     <div class="header-back-nav">
         <ol class="breadcrumb">
         <li><a href="../index.php">Store</a></li>
-        <li class="active"><?= $title ?></li>
+        <li class="active"><?= htmlent_utf8($title) ?></li>
         </ol>
     </div>
     <div class="detail-header">

diff --git a/lti/store/test.php b/lti/store/test.php
@@ -176,7 +176,7 @@
     <div class="header-back-nav">
         <ol class="breadcrumb">
             <li><a href="../index.php">Store</a></li>
-            <li><a href="<?= $rest_path->parent ?>/details/<?= urlencode($install) ?>"><?= $title; ?></a></li>
+            <li><a href="<?= $rest_path->parent ?>/details/<?= urlencode($install) ?>"><?= htmlent_utf8($title); ?></a></li>
             <li class="active">Try It</li>
         </ol>
     </div>

diff --git a/store/details.php b/store/details.php
@@ -198,7 +198,7 @@
 <div class="header-back-nav">
     <ol class="breadcrumb">
     <li><a href="<?= $rest_path->parent; ?>">Store</a></li>
-    <li class="active"><?= $title ?></li>
+    <li class="active"><?= htmlent_utf8($title) ?></li>
     </ol>
 </div>
 <div class="detail-header">

diff --git a/store/test.php b/store/test.php
@@ -127,7 +127,7 @@
     <div class="header-back-nav">
         <ol class="breadcrumb">
             <li><a href="<?= $rest_path->parent; ?>">Store</a></li>
-            <li><a href="<?= $rest_path->parent ?>/details/<?= urlencode($install) ?>"><?= $title; ?></a></li>
+            <li><a href="<?= $rest_path->parent ?>/details/<?= urlencode($install) ?>"><?= htmlent_utf8($title); ?></a></li>
             <li class="active">Try It</li>
         </ol>
     </div>