Ticket #7895: 7895.patch

src/bp-templates/bp-nouveau/buddypress/members/single/profile/change-avatar.php

@@ -15 +15 @@
 
         <p class="bp-feedback info">
                 <span class="bp-icon" aria-hidden="true"></span>
-                <span class="bp-help-text"><?php esc_html_e( 'Your profile photo will be used on your profile and throughout the site. If there is a <a href="https://gravatar.com">Gravatar</a> associated with your account email we will use that, or you can upload an image from your computer.', 'buddypress' ); ?></span>
+                <span class="bp-help-text"><?php echo bp_nouveau_sanitize_feedback( __( 'Your profile photo will be used on your profile and throughout the site. If there is a <a href="https://gravatar.com">Gravatar</a> associated with your account email we will use that, or you can upload an image from your computer.', 'buddypress' ) ); ?></span>
         </p>
 
         <form action="" method="post" id="avatar-upload-form" class="standard-form" enctype="multipart/form-data">

src/bp-templates/bp-nouveau/includes/functions.php

@@ -1391 +1391 @@
 
         return true;
 }
+
+/**
+ * Sanitize the feedback output.
+ *
+ * @since 3.2.0
+ *
+ * @param  string $text The feedback message.
+ * @return string       The sanitized feedback message.
+ */
+function bp_nouveau_sanitize_feedback( $text ) {
+        foreach ( array( 'wp_kses_data', 'wp_unslash', 'wptexturize', 'convert_smilies', 'convert_chars' ) as $filter ) {
+                $text = call_user_func( $filter, $text );
+        }
+
+        return $text;
+}

src/bp-templates/bp-nouveau/includes/template-tags.php

@@ -203 +203 @@
                         $user_feedback = $bp_nouveau->user_feedback['message'];
 
                         // @TODO: why is this treated differently?
-                        foreach ( array( 'wp_kses_data', 'wp_unslash', 'wptexturize', 'convert_smilies', 'convert_chars' ) as $filter ) {
-                                $user_feedback = call_user_func( $filter, $user_feedback );
-                        }
-
-                        return '<p>' . $user_feedback . '</p>';
+                        return '<p>' . bp_nouveau_sanitize_feedback( $user_feedback ) . '</p>';
 
                 } elseif ( ! empty( $bp_nouveau->template_message['message'] ) ) {
                         /**