XSS: Correctly escape the name of an object when it is displayed within an hyperlink

git-svn-id: http://svn.code.sf.net/p/itop/code/trunk@3994 a333f486-631f-4898-b8df-5754b55c2be0

core/dbobject.class.php

@@ -812,7 +812,7 @@ abstract class DBObject implements iDisplay
 			$oTmpObj = MetaModel::GetObject($sObjClass, $sObjKey, false);
 			if (is_object($oTmpObj))
 			{
-				$sLabel = $oTmpObj->GetName();
+				$sLabel = htmlentities($oTmpObj->GetName(), ENT_QUOTES, 'UTF-8');
 			}
 			else
 			{
@@ -821,6 +821,10 @@ abstract class DBObject implements iDisplay
 			}
 			//$sLabel = MetaModel::GetName($sObjClass)." #$sObjKey";
 		}
+		else
+		{
+			$sLabel = htmlentities($sLabel, ENT_QUOTES, 'UTF-8');
+		}
 		$sHint = MetaModel::GetName($sObjClass)."::$sObjKey";
 		$sUrl = ApplicationContext::MakeObjectUrl($sObjClass, $sObjKey, $sUrlMakerClass, $bWithNavigationContext);
 		if (strlen($sUrl) > 0)
@@ -3410,7 +3414,7 @@ abstract class DBObject implements iDisplay
 				{
 					throw new Exception("Unknown method ".get_class($this)."::".$sMethod.'()');
 				}
-				// Note: $oObjectToRead has been preserved when adding $aSourceObjects, so as to remain backward compatible with methods having only 1 parameter ($oObjectToReadà
+				// Note: $oObjectToRead has been preserved when adding $aSourceObjects, so as to remain backward compatible with methods having only 1 parameter ($oObjectToRead�
 				call_user_func($aCallSpec, $oObjectToRead, $aSourceObjects);
 				break;