URLs in href attributes must always be htmlencoded.

diff --git a/framework/Url/lib/Horde/Url.php b/framework/Url/lib/Horde/Url.php
index 2c6661d..02422fd 100644 (file)
--- a/framework/Url/lib/Horde/Url.php
+++ b/framework/Url/lib/Horde/Url.php
@@ -280,7 +280,7 @@ class Horde_Url
      */
     public function link(array $attributes = array())
     {
-        $url = (string)$this;
+        $url = (string)$this->setRaw(false);
         $link = '<a';
         if (!empty($url)) {
             $link .= " href=\"$url\"";