Ticket #7962: 7962.patch

src/bp-templates/bp-nouveau/js/buddypress-nouveau.js

@@ -161 +161 @@
                         return params;
                 },
 
+                /**
+                 * URL Decode a query variable.
+                 *
+                 * @param  {string} qv    The query variable to decode.
+                 * @param  {object} chars The specific characters to use. Optionnal.
+                 * @return {string}       The URL decoded variable.
+                 */
+                urlDecode: function( qv, chars ) {
+                        var specialChars = chars || {
+                                amp: '&',
+                                lt: '<',
+                                gt: '>',
+                                quot: '"',
+                                '#039': "'"
+                        };
+
+                        return decodeURIComponent( qv.replace( /\+/g, " " ) ).replace( /&([^;]+);/g, function( v, q ) {
+                                return specialChars[q] || '';
+                        } );
+                },
+
                 /**
                  * [ajax description]
                  * @param  {[type]} post_data [description]
@@ -238 +259 @@
                                 return;
                         }
 
+                        // Prepare the search terms for the request
+                        if ( data.search_terms ) {
+                                data.search_terms = data.search_terms.replace( /\</g, "&lt;" ).replace( /\>/g, "&gt;" );
+                        }
+
                         // Set session's data
                         if ( null !== data.scope ) {
                                 this.setStorage( 'bp-' + data.object, 'scope', data.scope );
@@ -357 +383 @@
                                         }
 
                                         if ( search_terms ) {
-                                                search_terms = decodeURIComponent( search_terms.replace( /\+/g, ' ' ) );
+                                                search_terms = self.urlDecode( search_terms );
                                                 $( '#buddypress [data-bp-search="' + object + '"] input[type=search]' ).val( search_terms );
                                         }
                                 }