Ticket #1728: 1728.004.diff

bp-activity.php

@@ -172 +172 @@
                 if ( is_user_logged_in() )
                         bp_core_redirect( $bp->loggedin_user->domain );
                 else
-                        bp_core_redirect( site_url( 'wp-login.php?redirect_to=' . clean_url( $bp->root_domain . '/' . $bp->activity->slug . '/p/' . $bp->current_action ) ) );
+                        bp_core_redirect( site_url( 'wp-login.php?redirect_to=' . esc_url( $bp->root_domain . '/' . $bp->activity->slug . '/p/' . $bp->current_action ) ) );
         }
 
         bp_core_load_template( apply_filters( 'bp_activity_template_profile_activity_permalink', 'members/single/activity/permalink' ) );

bp-core/bp-core-signup.php

@@ -531 +531 @@
 
 function bp_core_signup_send_validation_email( $user_id, $user_email, $key ) {
         $activate_url = bp_get_activation_page() ."?key=$key";
-        $activate_url = clean_url( $activate_url );
+        $activate_url = esc_url( $activate_url );
         $admin_email = get_site_option( "admin_email" );
 
         if ( empty( $admin_email ) )

bp-core/bp-core-filters.php

@@ -174 +174 @@
 
         // Send email with activation link.
         $activate_url = bp_get_activation_page() ."?key=$key";
-        $activate_url = clean_url($activate_url);
+        $activate_url = esc_url($activate_url);
 
         $admin_email = get_site_option( "admin_email" );
 
@@ -183 +183 @@
 
         $from_name = ( '' == get_site_option( "site_name" ) ) ? 'WordPress' : wp_specialchars( get_site_option( "site_name" ) );
         $message_headers = "MIME-Version: 1.0\n" . "From: \"{$from_name}\" <{$admin_email}>\n" . "Content-Type: text/plain; charset=\"" . get_option('blog_charset') . "\"\n";
-        $message = sprintf(__("Thanks for registering! To complete the activation of your account and blog, please click the following link:\n\n%1$s\n\n\n\nAfter you activate, you can visit your blog here:\n\n%2$s", 'buddypress' ), $activate_url, clean_url("http://{$domain}{$path}" ) );
-        $subject = '[' . $from_name . '] ' . sprintf(__('Activate %s', 'buddypress' ), clean_url('http://' . $domain . $path));
+        $message = sprintf(__("Thanks for registering! To complete the activation of your account and blog, please click the following link:\n\n%1$s\n\n\n\nAfter you activate, you can visit your blog here:\n\n%2$s", 'buddypress' ), $activate_url, esc_url("http://{$domain}{$path}" ) );
+        $subject = '[' . $from_name . '] ' . sprintf(__('Activate %s', 'buddypress' ), esc_url('http://' . $domain . $path));
 
         /* Send the message */
         $to = apply_filters( 'bp_core_activation_signup_blog_notification_to', $user_email );
@@ -203 +203 @@
         global $current_site;
 
         $activate_url = bp_get_activation_page() ."?key=$key";
-        $activate_url = clean_url($activate_url);
+        $activate_url = esc_url($activate_url);
         $admin_email = get_site_option( "admin_email" );
 
         if ( empty( $admin_email ) )
@@ -215 +215 @@
 
         $from_name = ( '' == get_site_option( "site_name" ) ) ? 'WordPress' : wp_specialchars( get_site_option( "site_name" ) );
         $message_headers = "MIME-Version: 1.0\n" . "From: \"{$from_name}\" <{$admin_email}>\n" . "Content-Type: text/plain; charset=\"" . get_option('blog_charset') . "\"\n";
-        $message = sprintf( __( "Thanks for registering! To complete the activation of your account please click the following link:\n\n%s\n\n", 'buddypress' ), $activate_url . $email, clean_url("http://{$domain}{$path}" ) );
+        $message = sprintf( __( "Thanks for registering! To complete the activation of your account please click the following link:\n\n%s\n\n", 'buddypress' ), $activate_url . $email, esc_url("http://{$domain}{$path}" ) );
         $subject = '[' . $from_name . '] ' . __( 'Activate Your Account', 'buddypress' );
 
         /* Send the message */

bp-core/bp-core-catchuri.php

@@ -45 +45 @@
         if ( strpos( $_SERVER['REQUEST_URI'], 'wp-load.php' ) )
                 $path = bp_core_referrer();
         else
-                $path = clean_url( $_SERVER['REQUEST_URI'] );
+                $path = esc_url( $_SERVER['REQUEST_URI'] );
 
         $path = apply_filters( 'bp_uri', $path );