[BUGFIX] Prevent output escaping in AvatarViewHelper

As the AvatarViewHelper returns HTML, the output should not be escaped.

Resolves: #76111
Releases: master
Change-Id: I4853de751c23dd726c30c11730b4c365625be5d0
Reviewed-on: https://review.typo3.org/48058

Reviewed-by: Markus Klein <markus.klein@typo3.org>
Tested-by: Markus Klein <markus.klein@typo3.org>
Reviewed-by: Wouter Wolters <typo3@wouterwolters.nl>
Reviewed-by: Adrian Mot <adrian.mot@gmail.com>
Reviewed-by: Daniel Goerz <ervaude@gmail.com>
Tested-by: Daniel Goerz <ervaude@gmail.com>
Reviewed-by: Helmut Hummel <helmut.hummel@typo3.org>
Tested-by: Helmut Hummel <helmut.hummel@typo3.org>

typo3/sysext/backend/Classes/ViewHelpers/AvatarViewHelper.php

@@ -23,6 +23,13 @@ use TYPO3Fluid\Fluid\Core\Rendering\RenderingContextInterface;
  */
 class AvatarViewHelper extends AbstractViewHelper
 {
+    /**
+     * As this ViewHelper renders HTML, the output must not be escaped.
+     *
+     * @var bool
+     */
+    protected $escapeOutput = false;
+
     /**
      * Resolve user avatar from backend user id.
      *