Ticket #3146: patch.diff

bp-xprofile/bp-xprofile-classes.php

@@ -24 +24 @@
                         return false;
 
                 $this->id = $group->id;
-                $this->name = $group->name;
-                $this->description = $group->description;
+                $this->name = stripslashes($group->name);
+                $this->description = stripslashes($group->description);
                 $this->can_delete = $group->can_delete;
         }
 
@@ -750 +750 @@
                                 $result = $wpdb->query( $wpdb->prepare( "UPDATE {$bp->profile->table_name_data} SET value = %s, last_updated = %s WHERE user_id = %d AND field_id = %d", $this->value, $this->last_updated, $this->user_id, $this->field_id ) );
 
                         // Data removed, delete the entry.
-                        elseif ( $this->exists() && empty( $this->value ) )                             
+                        elseif ( $this->exists() && empty( $this->value ) )
                                 $result = $this->delete();
 
                         else

bp-xprofile/bp-xprofile-filters.php

@@ -2 +2 @@
 
 /* Apply WordPress defined filters */
 
+add_filter( 'bp_get_the_profile_group_name',          'wp_filter_kses', 1 );
+add_filter( 'bp_get_the_profile_group_description',   'wp_filter_kses', 1 );
 add_filter( 'bp_get_the_profile_field_value',         'wp_filter_kses', 1 );
 add_filter( 'bp_get_the_profile_field_name',          'wp_filter_kses', 1 );
 add_filter( 'bp_get_the_profile_field_edit_value',    'wp_filter_kses', 1 );
@@ -14 +16 @@
 add_filter( 'bp_get_the_profile_field_value',         'make_clickable'     );
 add_filter( 'bp_get_the_profile_field_value',         'force_balance_tags' );
 
+add_filter( 'bp_get_the_profile_group_name',          'stripslashes' );
+add_filter( 'bp_get_the_profile_group_description',   'stripslashes' );
 add_filter( 'bp_get_the_profile_field_value',         'stripslashes' );
 add_filter( 'bp_get_the_profile_field_edit_value',    'stripslashes' );
 add_filter( 'bp_get_the_profile_field_name',          'stripslashes' );