Changeset 12338 for trunk/src/bp-templates/bp-nouveau/includes/messages/ajax.php

Timestamp:

02/20/2019 03:06:18 PM (7 years ago)

Author:

boonebgorges

Message:

Improve character escaping in Messages AJAX.

File:

• trunk/src/bp-templates/bp-nouveau/includes/messages/ajax.php (modified) (6 diffs)

trunk/src/bp-templates/bp-nouveau/includes/messages/ajax.php

@@ -163 +163 @@
     $reply = array(
         'id'            => bp_get_the_thread_message_id(),
-        'content'       => html_entity_decode( do_shortcode( bp_get_the_thread_message_content() ) ),
+        'content'       => do_shortcode( bp_get_the_thread_message_content() ),
         'sender_id'     => bp_get_the_thread_message_sender_id(),
         'sender_name'   => esc_html( bp_get_the_thread_message_sender_name() ),
         'sender_link'   => bp_get_the_thread_message_sender_link(),
-        'sender_avatar' => htmlspecialchars_decode( bp_core_fetch_avatar( array(
+        'sender_avatar' => esc_url( bp_core_fetch_avatar( array(
             'item_id' => bp_get_the_thread_message_sender_id(),
             'object'  => 'user',
@@ -270 +270 @@
             'id'            => bp_get_message_thread_id(),
             'message_id'    => (int) $last_message_id,
-            'subject'       => html_entity_decode( bp_get_message_thread_subject() ),
-            'excerpt'       => html_entity_decode( bp_get_message_thread_excerpt() ),
-            'content'       => html_entity_decode( do_shortcode( bp_get_message_thread_content() ) ),
+            'subject'       => strip_tags( bp_get_message_thread_subject() ),
+            'excerpt'       => strip_tags( bp_get_message_thread_excerpt() ),
+            'content'       => do_shortcode( bp_get_message_thread_content() ),
             'unread'        => bp_message_thread_has_unread(),
             'sender_name'   => bp_core_get_user_displayname( $messages_template->thread->last_sender_id ),
             'sender_link'   => bp_core_get_userlink( $messages_template->thread->last_sender_id, false, true ),
-            'sender_avatar' => htmlspecialchars_decode( bp_core_fetch_avatar( array(
+            'sender_avatar' => esc_url( bp_core_fetch_avatar( array(
                 'item_id' => $messages_template->thread->last_sender_id,
                 'object'  => 'user',
@@ -292 +292 @@
             foreach ( $messages_template->thread->recipients as $recipient ) {
                 $threads->threads[ $i ]['recipients'][] = array(
-                    'avatar' => htmlspecialchars_decode( bp_core_fetch_avatar( array(
+                    'avatar' => esc_url( bp_core_fetch_avatar( array(
                         'item_id' => $recipient->user_id,
                         'object'  => 'user',
@@ -430 +430 @@
         $thread->thread = array(
             'id'      => bp_get_the_thread_id(),
-            'subject' => html_entity_decode( bp_get_the_thread_subject() ),
+            'subject' => strip_tags( bp_get_the_thread_subject() ),
         );
 
@@ -436 +436 @@
             foreach ( $thread_template->thread->recipients as $recipient ) {
                 $thread->thread['recipients'][] = array(
-                    'avatar' => htmlspecialchars_decode( bp_core_fetch_avatar( array(
+                    'avatar' => esc_url( bp_core_fetch_avatar( array(
                         'item_id' => $recipient->user_id,
                         'object'  => 'user',
@@ -457 +457 @@
         $thread->messages[ $i ] = array(
             'id'            => bp_get_the_thread_message_id(),
-            'content'       => html_entity_decode( do_shortcode( bp_get_the_thread_message_content() ) ),
+            'content'       => do_shortcode( bp_get_the_thread_message_content() ),
             'sender_id'     => bp_get_the_thread_message_sender_id(),
             'sender_name'   => esc_html( bp_get_the_thread_message_sender_name() ),
             'sender_link'   => bp_get_the_thread_message_sender_link(),
-            'sender_avatar' => htmlspecialchars_decode( bp_core_fetch_avatar( array(
+            'sender_avatar' => esc_url( bp_core_fetch_avatar( array(
                 'item_id' => bp_get_the_thread_message_sender_id(),
                 'object'  => 'user',