Changeset 11149

Timestamp:

09/22/2016 12:16:30 AM (8 years ago)

Author:

r-a-y

Message:

Members: Escape various URL output functions.

Props espellcaste.

See #7132.

Location:

trunk/src

Files:

• bp-members/bp-members-template.php (modified) (4 diffs)
• bp-templates/bp-legacy/buddypress/members/index.php (modified) (1 diff)

trunk/src/bp-members/bp-members-template.php

@@ -830 +830 @@
  */
 function bp_member_permalink() {
-    echo bp_get_member_permalink();
+    echo esc_url( bp_get_member_permalink() );
 }
     /**
@@ -857 +857 @@
      * @since 1.2.0
      */
-    function bp_member_link() { echo bp_get_member_permalink(); }
+    function bp_member_link() { echo esc_url( bp_get_member_permalink() ); }
 
     /**
@@ -1758 +1758 @@
  */
 function bp_loggedin_user_link() {
-    echo bp_get_loggedin_user_link();
+    echo esc_url( bp_get_loggedin_user_link() );
 }
     /**
@@ -1785 +1785 @@
  */
 function bp_displayed_user_link() {
-    echo bp_get_displayed_user_link();
+    echo esc_url( bp_get_displayed_user_link() );
 }
     /**

trunk/src/bp-templates/bp-legacy/buddypress/members/index.php

@@ -62 +62 @@
 
                 <?php if ( is_user_logged_in() && bp_is_active( 'friends' ) && bp_get_total_friend_count( bp_loggedin_user_id() ) ) : ?>
-                    <li id="members-personal"><a href="<?php echo bp_loggedin_user_domain() . bp_get_friends_slug() . '/my-friends/'; ?>"><?php printf( __( 'My Friends %s', 'buddypress' ), '<span>' . bp_get_total_friend_count( bp_loggedin_user_id() ) . '</span>' ); ?></a></li>
+                    <li id="members-personal"><a href="<?php echo esc_url( bp_loggedin_user_domain() . bp_get_friends_slug() . '/my-friends/' ); ?>"><?php printf( __( 'My Friends %s', 'buddypress' ), '<span>' . bp_get_total_friend_count( bp_loggedin_user_id() ) . '</span>' ); ?></a></li>
                 <?php endif; ?>