- sa-2006-002: XSS issues with username log and mission

1 files changed, 3 insertions, 3 deletions

diff --git a/includes/theme.inc b/includes/theme.inc
index ee499b65a..c0e4f3b0c 100644
--- a/includes/theme.inc
+++ b/includes/theme.inc
@@ -958,7 +958,7 @@ function theme_username($object) {
       $output = l($name, 'user/'. $object->uid, array('title' => t('View user profile.')));
     }
     else {
-      $output = $name;
+      $output = check_plain($name);
     }
   }
   else if ($object->name) {
@@ -967,10 +967,10 @@ function theme_username($object) {
     // aggregator modules). This clause enables modules to display
     // the true author of the content.
     if ($object->homepage) {
-      $output = '<a href="'. $object->homepage .'">'. $object->name .'</a>';
+      $output = l($object->name, $object->homepage);
     }
     else {
-      $output = $object->name;
+      $output = check_plain($object->name);
     }
 
     $output .= ' ('. t('not verified') .')';