See http://api.drupal.org/api/drupal/includes%21common.inc/function/format_u...
Return value
An unsanitized string with the username to display. The code receiving this result must ensure that check_plain() is called on it before it is printed to the page.
This issue is safe to be reported in public since this module has no official public release and only a dev release. This issue should block a stable release of this module because if this is not fixed then this requires an official security announcement to fix.
| Comment | File | Size | Author |
|---|---|---|---|
| #1 | 1580802-foramt-username-unescaped.patch | 2.33 KB | dave reid |
Comments
Comment #1
dave reidComment #2
sunwow.
All other format_* functions return a sanitized string: http://api.drupal.org/api/search/7/format_
Let's pretty please open an at least major bug against Drupal core to fix that format_username() mess/confusion.
Comment #3
dave reidWell really we should be getting rid of format_username() calls and people should be calling entity_label('user', $account) or $entity->label instead. Both of those should be assumed to be unsanitized output like the rest of entity properties.
Comment #4
dave reidCross-linking #983734: Deprecate format_username() for entity_label() and add hook_entity_label_alter()
Comment #5
jody lynnCommitted.