#1134074 by dereine: Sanitize the prefix only with xss not check_plain

diff --git a/handlers/views_handler_field_numeric.inc b/handlers/views_handler_field_numeric.inc
index 61bc9ca..791747d 100644 (file)
--- a/handlers/views_handler_field_numeric.inc
+++ b/handlers/views_handler_field_numeric.inc
@@ -120,6 +120,6 @@ class views_handler_field_numeric extends views_handler_field {
       $value = format_plural($value, $this->options['format_plural_singular'], $this->options['format_plural_plural']);
     }
 
-    return check_plain($this->options['prefix'] . $value . $this->options['suffix']);
+    return filter_xss($this->options['prefix']) . check_plain($value) . filter_xss($this->options['suffix']);
   }
 }