From 03a9ed70b2386aeb9dca616f833b589cf7b3cf24 Mon Sep 17 00:00:00 2001
From: Qiang Xue <qiang.xue@gmail.com>
Date: Wed, 17 Dec 2014 22:08:20 -0500
Subject: [PATCH] Fixes #6557: Link URLs generated by `yii\widgets\Menu` are not encoded
---
framework/CHANGELOG.md | 1 +
framework/widgets/Menu.php | 2 +-
2 files changed, 2 insertions(+), 1 deletion(-)
diff --git a/framework/CHANGELOG.md b/framework/CHANGELOG.md
index e0a0a77..4956d4c 100644
--- a/framework/CHANGELOG.md
+++ b/framework/CHANGELOG.md
@@ -6,6 +6,7 @@ Yii Framework 2 Change Log
- Bug #6080: Oracle DB schema did not load column types correctly (wenbin1989)
- Bug #6404: advanced application template `Alert` widget was generating duplicate IDs in case of multiple flashes (SDKiller)
+- Bug #6557: Link URLs generated by `yii\widgets\Menu` are not encoded (qiangxue)
- Enh #6247: Logger and error handler are now using slightly less memory (stepanselyuk, samdark)
- Enh #6434: Added `yii\behaviors\SluggableBehavior::immutable` to support keeping the generated slug unchanged (trntv)
- Enh #6467: `ActiveForm` will scroll to the nearest visible element when the first error input is hidden (newartix)
diff --git a/framework/widgets/Menu.php b/framework/widgets/Menu.php
index 22db30d..85452f1 100644
--- a/framework/widgets/Menu.php
+++ b/framework/widgets/Menu.php
@@ -230,7 +230,7 @@ class Menu extends Widget
$template = ArrayHelper::getValue($item, 'template', $this->linkTemplate);
return strtr($template, [
- '{url}' => Url::to($item['url']),
+ '{url}' => Html::encode(Url::to($item['url'])),
'{label}' => $item['label'],
]);
} else {
--
libgit2 0.27.1