Fix '% Visit' datatable column header bug by using |raw and make sure goal names are escaped in HtmlTable::setShowGoalsColumnsProperties.

1 files changed, 4 insertions, 0 deletions

diff --git a/plugins/CoreVisualizations/Visualizations/HtmlTable.php b/plugins/CoreVisualizations/Visualizations/HtmlTable.php
index 64b2012e7f..9ffc3393eb 100644
--- a/plugins/CoreVisualizations/Visualizations/HtmlTable.php
+++ b/plugins/CoreVisualizations/Visualizations/HtmlTable.php
@@ -376,6 +376,7 @@ class HtmlTable extends DataTableVisualization
         // get all goals to display info for
         $allGoals = array();
 
+        // add the ecommerce goal if ecommerce is enabled for the site
         if (Site::isEcommerceEnabledFor($idSite)) {
             $ecommerceGoal = array(
                 'idgoal' => Piwik::LABEL_ID_GOAL_IS_ECOMMERCE_ORDER,
@@ -385,8 +386,11 @@ class HtmlTable extends DataTableVisualization
             $allGoals[$ecommerceGoal['idgoal']] = $ecommerceGoal;
         }
 
+        // add the site's goals (and escape all goal names)
         $siteGoals = Goals_API::getInstance()->getGoals($idSite);
         foreach ($siteGoals as &$goal) {
+            $goal['name'] = Common::sanitizeInputValue($goal['name']);
+
             $goal['quoted_name'] = '"' . $goal['name'] . '"';
             $allGoals[$goal['idgoal']] = $goal;
         }