Changeset 11803 for trunk/src/bp-xprofile/bp-xprofile-filters.php

Timestamp:

01/10/2018 12:42:10 PM (7 years ago)

Author:

djpaul

Message:

xprofile: fix HTML entities in semi-colon seperated field values rendering incorrectly when auto-link is enabled.

bp_xprofile_escape_field_data() runs before the function, which often runs esc_html().
In turn, that encodes HTML entities in the string (";" becomes "'").

Before splitting on the ";" character, decode the HTML entities, and re-encode after.

Fixes #7459

File:

• trunk/src/bp-xprofile/bp-xprofile-filters.php (modified) (1 diff)

trunk/src/bp-xprofile/bp-xprofile-filters.php

@@ -359 +359 @@
 
     if ( strpos( $field_value, ',' ) !== false ) {
+        // Comma-separated lists.
         $list_type = 'comma';
-        $values    = explode( ',', $field_value ); // Comma-separated lists.
+        $values    = explode( ',', $field_value );
     } else {
-        $list_type = 'semicolon';
-        $values = explode( ';', $field_value ); // Semicolon-separated lists.
+        /*
+         * Semicolon-separated lists.
+         *
+         * bp_xprofile_escape_field_data() runs before this function, which often runs esc_html().
+         * In turn, that encodes HTML entities in the string (";" becomes "'").
+         *
+         * Before splitting on the ";" character, decode the HTML entities, and re-encode after.
+         * This prevents input like "O'Hara" rendering as "O' Hara" (with each of those parts
+         * having a seperate HTML link).
+         */
+        $list_type   = 'semicolon';
+        $field_value = wp_specialchars_decode( $field_value, ENT_QUOTES );
+        $values      = explode( ';', $field_value );
+
+        array_walk( $values, function( &$value, $key ) use ( $field_type, $field ) {
+            $value = bp_xprofile_escape_field_data( $value, $field_type, $field->id );
+        } );
     }