encode email in Formatter

avoid XSS with emails in format "Carsten Brandt <mail@cebe.cc>"

encode email in Formatter
f3ab5d99 · Carsten Brandt · 248e0cb9 · f3ab5d99
Commit f3ab5d99 authored Nov 21, 2013 by Carsten Brandt
Hide whitespace changes
Inline Side-by-side

Showing with 1 addition and 1 deletion

Formatter.php framework/yii/base/Formatter.php +1 -1

No files found.
--- a/framework/yii/base/Formatter.php
+++ b/framework/yii/base/Formatter.php
@@ -190,7 +190,7 @@ class Formatter extends Component
 		if ($value === null) {
 			return $this->nullDisplay;
 		}
-		return Html::mailto($value);
+		return Html::mailto(Html::encode($value), $value);
 	}

 	/**