template escapes

diff --git a/include/conversation.php b/include/conversation.php
index b7fba91541e3219466b845a09fd927deb792b6d8..a4069c9fdbbb5ff2793fdb17b351ce3b0f25cbb6 100644 (file)
--- a/include/conversation.php
+++ b/include/conversation.php
@@ -214,18 +214,18 @@ function conversation(&$a, $items, $mode, $update) {
                                        '$linktitle' => sprintf( t('View %s\'s profile @ %s'), $profile_name, ((strlen($item['author-link'])) ? $item['author-link'] : $item['url'])),
                                        '$profile_url' => $profile_link,
                                        '$item_photo_menu' => item_photo_menu($item),
-                                       '$name' => $profile_name,
+                                       '$name' => template_escape($profile_name),
                                        '$sparkle' => $sparkle,
                                        '$lock' => $lock,
                                        '$thumb' => $profile_avatar,
-                                       '$title' => $item['title'],
-                                       '$body' => $body,
+                                       '$title' => template_escape($item['title']),
+                                       '$body' => template_escape($body),
                                        '$ago' => (($item['app']) ? sprintf( t('%s from %s'),relative_date($item['created']),$item['app']) : relative_date($item['created'])),
-                                       '$location' => $location,
+                                       '$location' => template_escape($location),
                                        '$indent' => '',
                                        '$owner_url' => $owner_url,
                                        '$owner_photo' => $owner_photo,
-                                       '$owner_name' => $owner_name,
+                                       '$owner_name' => template_escape($owner_name),
                                        '$star' => $star,
                                        '$drop' => $drop,
                                        '$conv' => '<a href="' . $a->get_baseurl() . '/display/' . $nickname . '/' . $item['id'] . '">' . t('View in context') . '</a>'