From 4354ce21d193bc752002c3dec60a8ea38be03c01 Mon Sep 17 00:00:00 2001
From: Mikael Nordfeldth <mmn@hethane.se>
Date: Sun, 6 Sep 2015 01:53:11 +0200
Subject: [PATCH] introducing html_sprintf for easier sprintf'ing with
 htmlspecialchars

---
 lib/util.php                        |  9 +++++++++
 plugins/Activity/ActivityPlugin.php | 10 +++++-----
 2 files changed, 14 insertions(+), 5 deletions(-)

diff --git a/lib/util.php b/lib/util.php
index 1ff5b13b93..66847a4350 100644
--- a/lib/util.php
+++ b/lib/util.php
@@ -2429,3 +2429,12 @@ function common_strip_html($html, $trim=true, $save_whitespace=false)
     $text = html_entity_decode(strip_tags($html), ENT_QUOTES, 'UTF-8');
     return $trim ? trim($text) : $text;
 }
+
+function html_sprintf()
+{
+    $args = func_get_args();
+    for ($i=1; $i<count($args); $i++) {
+        $args[$i] = htmlspecialchars($args[$i]);
+    }
+    return call_user_func_array('sprintf', $args);
+}
diff --git a/plugins/Activity/ActivityPlugin.php b/plugins/Activity/ActivityPlugin.php
index 5144eb4666..d8f3c6c502 100644
--- a/plugins/Activity/ActivityPlugin.php
+++ b/plugins/Activity/ActivityPlugin.php
@@ -72,7 +72,7 @@ class ActivityPlugin extends Plugin
         // TRANS: Text for "started following" item in activity plugin.
         // TRANS: %1$s is a profile URL, %2$s is a profile name,
         // TRANS: %3$s is a profile URL, %4$s is a profile name.
-        $rendered = sprintf(_m('<a href="%1$s">%2$s</a> started following <a href="%3$s">%4$s</a>.'),
+        $rendered = html_sprintf(_m('<a href="%1$s">%2$s</a> started following <a href="%3$s">%4$s</a>.'),
                             $profile->getUrl(),
                             $profile->getBestName(),
                             $other->getUrl(),
@@ -110,7 +110,7 @@ class ActivityPlugin extends Plugin
         // TRANS: Text for "stopped following" item in activity plugin.
         // TRANS: %1$s is a profile URL, %2$s is a profile name,
         // TRANS: %3$s is a profile URL, %4$s is a profile name.
-        $rendered = sprintf(_m('<a href="%1$s">%2$s</a> stopped following <a href="%3$s">%4$s</a>.'),
+        $rendered = html_sprintf(_m('<a href="%1$s">%2$s</a> stopped following <a href="%3$s">%4$s</a>.'),
                             $profile->getUrl(),
                             $profile->getBestName(),
                             $other->getUrl(),
@@ -155,7 +155,7 @@ class ActivityPlugin extends Plugin
         // TRANS: Text for "stopped liking" item in activity plugin.
         // TRANS: %1$s is a profile URL, %2$s is a profile name,
         // TRANS: %3$s is a notice URL, %4$s is an author name.
-        $rendered = sprintf(_m('<a href="%1$s">%2$s</a> stopped liking <a href="%3$s">%4$s\'s update</a>.'),
+        $rendered = html_sprintf(_m('<a href="%1$s">%2$s</a> stopped liking <a href="%3$s">%4$s\'s update</a>.'),
                             $profile->getUrl(),
                             $profile->getBestName(),
                             $notice->getUrl(),
@@ -200,7 +200,7 @@ class ActivityPlugin extends Plugin
         // TRANS: Text for "joined group" item in activity plugin.
         // TRANS: %1$s is a profile URL, %2$s is a profile name,
         // TRANS: %3$s is a group URL, %4$s is a group name.
-        $rendered = sprintf(_m('<a href="%1$s">%2$s</a> joined the group <a href="%3$s">%4$s</a>.'),
+        $rendered = html_sprintf(_m('<a href="%1$s">%2$s</a> joined the group <a href="%3$s">%4$s</a>.'),
                             $profile->getUrl(),
                             $profile->getBestName(),
                             $group->homeUrl(),
@@ -241,7 +241,7 @@ class ActivityPlugin extends Plugin
         // TRANS: Text for "left group" item in activity plugin.
         // TRANS: %1$s is a profile URL, %2$s is a profile name,
         // TRANS: %3$s is a group URL, %4$s is a group name.
-        $rendered = sprintf(_m('<a href="%1$s">%2$s</a> left the group <a href="%3$s">%4$s</a>.'),
+        $rendered = html_sprintf(_m('<a href="%1$s">%2$s</a> left the group <a href="%3$s">%4$s</a>.'),
                             $profile->getUrl(),
                             $profile->getBestName(),
                             $group->homeUrl(),
-- 
2.39.5