Fixed Unescaped phrase in \XF\Template\Templater::fnDisplayTotals()

[Kirby]

Affected version

2.1.0 Beta 2

Phrase there_are_x_items_in_total is not escaped when used in \XF\Template\Templater::fnDisplayTotals() for a title attribute.

return '<span class="js-displayTotals" data-count="' . $count . '" data-total="' . $total . '"'
    . ' data-xf-init="tooltip" title="' . \XF::phrase('there_are_x_items_in_total', ['total' => $params['total']]) . '">'
    . \XF::phrase($phrase, $params) . '</span>';

 

[XF Bug Bot]

Thank you for reporting this issue. The issue is now resolved and we are aiming to include that in a future XF release (2.0.12).

Change log:

Ensure usage of phrase within HTML attribute is escaped.

Any changes made as a result of this issue being resolved may not be rolled out here until later.