Merge pull request #327 from cakephp/master-fix-output-escape

markstory · markstory · commit 3bf185f1f3c1 · 2015-04-19T13:57:48.000-04:00
Escape key
diff --git a/src/View/Helper/ToolbarHelper.php b/src/View/Helper/ToolbarHelper.php
@@ -78,7 +78,7 @@ public function makeNeatArray($values, $openDepth = 0, $currentDepth = 0, $doubl
             $values[] = '(empty)';
         }
         foreach ($values as $key => $value) {
-            $out .= '<li><strong>' . $key . '</strong>';
+            $out .= '<li><strong>' . h($key, $doubleEncode) . '</strong>';
             if (is_array($value) && count($value) > 0) {
                 $out .= '(array)';
             } elseif (is_object($value)) {

Original file line number	Diff line number	Diff line change
`@@ -78,7 +78,7 @@ public function makeNeatArray($values, $openDepth = 0, $currentDepth = 0, $doubl`
`78`	`78`	`$values[] = '(empty)';`
`79`	`79`	`}`
`80`	`80`	`foreach ($values as $key => $value) {`
`81`		`- $out .= '<li><strong>' . $key . '</strong>';`
	`81`	`+ $out .= '<li><strong>' . h($key, $doubleEncode) . '</strong>';`
`82`	`82`	`if (is_array($value) && count($value) > 0) {`
`83`	`83`	`$out .= '(array)';`
`84`	`84`	`} elseif (is_object($value)) {`