Changeset 13808

Timestamp:

04/26/2024 05:44:26 AM (2 years ago)

Author:

imath

Message:

Groups component: improve PHP code standards using WPCS

See #7228 (trunk)

Location:

trunk/src/bp-groups

Files:

• bp-groups-admin.php (modified) (24 diffs)
• bp-groups-blocks.php (modified) (1 diff)
• bp-groups-functions.php (modified) (12 diffs)
• bp-groups-notifications.php (modified) (3 diffs)
• bp-groups-template.php (modified) (126 diffs)
• bp-groups-widgets.php (modified) (1 diff)
• classes/class-bp-group-extension.php (modified) (2 diffs)
• classes/class-bp-groups-group-members-template.php (modified) (1 diff)
• classes/class-bp-groups-invite-template.php (modified) (1 diff)
• classes/class-bp-groups-list-table.php (modified) (17 diffs)
• classes/class-bp-groups-membership-requests-template.php (modified) (1 diff)
• classes/class-bp-groups-template.php (modified) (1 diff)
• classes/class-bp-groups-widget.php (modified) (1 diff)

trunk/src/bp-groups/bp-groups-admin.php

@@ -535 +535 @@
  */
 function bp_groups_admin_screen_options( $value, $option, $new_value ) {
-        if ( 'toplevel_page_bp_groups_per_page' != $option && 'toplevel_page_bp_groups_network_per_page' != $option )
+        if ( 'toplevel_page_bp_groups_per_page' != $option && 'toplevel_page_bp_groups_network_per_page' != $option ) {
                 return $value;
+        }
 
         // Per page.
         $new_value = (int) $new_value;
-        if ( $new_value < 1 || $new_value > 999 )
+        if ( $new_value < 1 || $new_value > 999 ) {
                 return $value;
+        }
 
         return $new_value;
@@ -576 +578 @@
 function bp_groups_admin_edit() {
 
-        if ( ! bp_current_user_can( 'bp_moderate' ) )
+        if ( ! bp_current_user_can( 'bp_moderate' ) ) {
                 die( '-1' );
+        }
 
         $messages = array();
 
         // If the user has just made a change to a group, build status messages.
-        if ( !empty( $_REQUEST['no_admins'] ) || ! empty( $_REQUEST['error'] ) || ! empty( $_REQUEST['updated'] ) || ! empty( $_REQUEST['error_new'] ) || ! empty( $_REQUEST['success_new'] ) || ! empty( $_REQUEST['error_modified'] ) || ! empty( $_REQUEST['success_modified'] ) ) {
+        if ( ! empty( $_REQUEST['no_admins'] ) || ! empty( $_REQUEST['error'] ) || ! empty( $_REQUEST['updated'] ) || ! empty( $_REQUEST['error_new'] ) || ! empty( $_REQUEST['success_new'] ) || ! empty( $_REQUEST['error_modified'] ) || ! empty( $_REQUEST['success_modified'] ) ) {
                 $no_admins        = ! empty( $_REQUEST['no_admins']        ) ? 1                                             : 0;
                 $errors           = ! empty( $_REQUEST['error']            ) ? $_REQUEST['error']                            : '';
@@ -653 +656 @@
 
         <div class="wrap">
-                <h1 class="wp-heading-inline"><?php _e( 'Edit Group', 'buddypress' ); ?></h1>
+                <h1 class="wp-heading-inline"><?php esc_html_e( 'Edit Group', 'buddypress' ); ?></h1>
 
                 <?php if ( is_user_logged_in() && bp_user_can_create_groups() ) : ?>
@@ -662 +665 @@
 
                 <?php // If the user has just made a change to an group, display the status messages. ?>
-                <?php if ( !empty( $messages ) ) : ?>
-                        <div id="moderated" class="<?php echo ( $is_error ) ? 'error' : 'updated'; ?> notice is-dismissible"><p><?php echo implode( "</p><p>", $messages ); ?></p></div>
+                <?php if ( ! empty( $messages ) ) : ?>
+                        <div id="moderated" class="<?php echo esc_attr( ( $is_error ) ? 'error' : 'updated' ); ?> notice is-dismissible"><p><?php echo implode( "</p><p>", array_map( 'esc_html', $messages ) ); ?></p></div>
                 <?php endif; ?>
 
@@ -675 +678 @@
                                                         <div id="postdiv">
                                                                 <div id="bp_groups_name" class="groupbox">
-                                                                        <h2><?php _e( 'Name and Description', 'buddypress' ); ?></h2>
+                                                                        <h2><?php esc_html_e( 'Name and Description', 'buddypress' ); ?></h2>
                                                                         <div class="inside">
-                                                                                <label for="bp-groups-name" class="screen-reader-text"><?php
-                                                                                        /* translators: accessibility text */
-                                                                                        _e( 'Group Name', 'buddypress' );
-                                                                                ?></label>
+                                                                                <label for="bp-groups-name" class="screen-reader-text">
+                                                                                        <?php
+                                                                                                /* translators: accessibility text */
+                                                                                                esc_html_e( 'Group Name', 'buddypress' );
+                                                                                        ?>
+                                                                                </label>
                                                                                 <input type="text" name="bp-groups-name" id="bp-groups-name" value="<?php echo esc_attr( stripslashes( $group_name ) ) ?>" />
                                                                                 <div id="bp-groups-permalink-box">
@@ -690 +695 @@
                                                                                 </div>
 
-                                                                                <label for="bp-groups-description" class="screen-reader-text"><?php
-                                                                                        /* translators: accessibility text */
-                                                                                        _e( 'Group Description', 'buddypress' );
-                                                                                ?></label>
+                                                                                <label for="bp-groups-description" class="screen-reader-text">
+                                                                                        <?php
+                                                                                                /* translators: accessibility text */
+                                                                                                esc_html_e( 'Group Description', 'buddypress' );
+                                                                                        ?>
+                                                                                </label>
                                                                                 <?php wp_editor( stripslashes( $group->description ), 'bp-groups-description', array( 'media_buttons' => false, 'teeny' => true, 'textarea_rows' => 5, 'quicktags' => array( 'buttons' => 'strong,em,link,block,del,ins,img,code,spell,close' ) ) ); ?>
                                                                         </div>
@@ -718 +725 @@
                 <?php else : ?>
 
-                        <p><?php
-                                printf(
-                                        '%1$s <a href="%2$s">%3$s</a>',
-                                        __( 'No group found with this ID.', 'buddypress' ),
-                                        esc_url( bp_get_admin_url( 'admin.php?page=bp-groups' ) ),
-                                        __( 'Go back and try again.', 'buddypress' )
-                                );
-                        ?></p>
+                        <p>
+                                <?php
+                                        printf(
+                                                '%1$s <a href="%2$s">%3$s</a>',
+                                                esc_html__( 'No group found with this ID.', 'buddypress' ),
+                                                esc_url( bp_get_admin_url( 'admin.php?page=bp-groups' ) ),
+                                                esc_html__( 'Go back and try again.', 'buddypress' )
+                                        );
+                                ?>
+                        </p>
 
                 <?php endif; ?>
@@ -765 +774 @@
         }
 
-        $base_url  = remove_query_arg( array( 'action', 'action2', 'paged', 's', '_wpnonce', 'gid' ), $_SERVER['REQUEST_URI'] ); ?>
+        $base_url = remove_query_arg( array( 'action', 'action2', 'paged', 's', '_wpnonce', 'gid' ), $_SERVER['REQUEST_URI'] ); ?>
 
         <div class="wrap">
-                <h1 class="wp-heading-inline"><?php _e( 'Delete Groups', 'buddypress' ) ?></h1>
+                <h1 class="wp-heading-inline"><?php esc_html_e( 'Delete Groups', 'buddypress' ) ?></h1>
                 <hr class="wp-header-end">
 
-                <p><?php _e( 'You are about to delete the following groups:', 'buddypress' ) ?></p>
+                <p><?php esc_html_e( 'You are about to delete the following groups:', 'buddypress' ) ?></p>
 
                 <ul class="bp-group-delete-list">
@@ -779 +788 @@
                 </ul>
 
-                <p><strong><?php _e( 'This action cannot be undone.', 'buddypress' ) ?></strong></p>
-
-                <a class="button-primary" href="<?php echo esc_url( wp_nonce_url( add_query_arg( array( 'action' => 'do_delete', 'gid' => implode( ',', $gids ) ), $base_url ), 'bp-groups-delete' ) ); ?>"><?php _e( 'Delete Permanently', 'buddypress' ) ?></a>
-                <a class="button" href="<?php echo esc_attr( $base_url ); ?>"><?php _e( 'Cancel', 'buddypress' ) ?></a>
+                <p><strong><?php esc_html_e( 'This action cannot be undone.', 'buddypress' ) ?></strong></p>
+
+                <a class="button-primary" href="<?php echo esc_url( wp_nonce_url( add_query_arg( array( 'action' => 'do_delete', 'gid' => implode( ',', $gids ) ), $base_url ), 'bp-groups-delete' ) ); ?>"><?php esc_html_e( 'Delete Permanently', 'buddypress' ) ?></a>
+                <a class="button" href="<?php echo esc_attr( $base_url ); ?>"><?php esc_html_e( 'Cancel', 'buddypress' ) ?></a>
         </div>
 
@@ -830 +839 @@
         <div class="wrap">
 
-                <h1 class="wp-heading-inline"><?php _e( 'Groups', 'buddypress' ); ?></h1>
+                <h1 class="wp-heading-inline"><?php esc_html_e( 'Groups', 'buddypress' ); ?></h1>
 
                 <?php if ( is_user_logged_in() && bp_user_can_create_groups() ) : ?>
@@ -836 +845 @@
                 <?php endif; ?>
 
-                <?php if ( !empty( $_REQUEST['s'] ) ) : ?>
-                        <span class="subtitle"><?php printf( __( 'Search results for &#8220;%s&#8221;', 'buddypress' ), wp_html_excerpt( esc_html( stripslashes( $_REQUEST['s'] ) ), 50 ) ); ?></span>
+                <?php if ( ! empty( $_REQUEST['s'] ) ) : ?>
+                        <span class="subtitle"><?php printf( esc_html__( 'Search results for &#8220;%s&#8221;', 'buddypress' ), esc_html( wp_html_excerpt( stripslashes( $_REQUEST['s'] ), 50 ) ) ); ?></span>
                 <?php endif; ?>
 
@@ -843 +852 @@
 
                 <?php // If the user has just made a change to an group, display the status messages. ?>
-                <?php if ( !empty( $messages ) ) : ?>
-                        <div id="moderated" class="<?php echo ( ! empty( $_REQUEST['error'] ) ) ? 'error' : 'updated'; ?> notice is-dismissible"><p><?php echo implode( "<br/>\n", $messages ); ?></p></div>
+                <?php if ( ! empty( $messages ) ) : ?>
+                        <div id="moderated" class="<?php echo esc_attr( ( ! empty( $_REQUEST['error'] ) ) ? 'error' : 'updated' ); ?> notice is-dismissible"><p><?php echo implode( "<br/>\n", array_map( 'esc_html', $messages ) ); ?></p></div>
                 <?php endif; ?>
 
@@ -851 +860 @@
 
                 <form id="bp-groups-form" action="" method="get">
-                        <?php $bp_groups_list_table->search_box( __( 'Search all Groups', 'buddypress' ), 'bp-groups' ); ?>
+                        <?php $bp_groups_list_table->search_box( esc_html__( 'Search all Groups', 'buddypress' ), 'bp-groups' ); ?>
                         <input type="hidden" name="page" value="<?php echo esc_attr( $plugin_page ); ?>" />
                         <?php $bp_groups_list_table->display(); ?>
@@ -874 +883 @@
         <?php if ( bp_is_active( 'forums' ) ) : ?>
                 <div class="bp-groups-settings-section" id="bp-groups-settings-section-forum">
-                        <label for="group-show-forum"><input type="checkbox" name="group-show-forum" id="group-show-forum" <?php checked( $item->enable_forum ) ?> /> <?php _e( 'Enable discussion forum', 'buddypress' ) ?></label>
+                        <label for="group-show-forum"><input type="checkbox" name="group-show-forum" id="group-show-forum" <?php checked( $item->enable_forum ) ?> /> <?php esc_html_e( 'Enable discussion forum', 'buddypress' ) ?></label>
                 </div>
         <?php endif; ?>
@@ -880 +889 @@
         <div class="bp-groups-settings-section" id="bp-groups-settings-section-status">
                 <fieldset>
-                        <legend><?php _e( 'Privacy', 'buddypress' ); ?></legend>
-
-                        <label for="bp-group-status-public"><input type="radio" name="group-status" id="bp-group-status-public" value="public" <?php checked( $item->status, 'public' ) ?> /><?php _e( 'Public', 'buddypress' ) ?></label>
-                        <label for="bp-group-status-private"><input type="radio" name="group-status" id="bp-group-status-private" value="private" <?php checked( $item->status, 'private' ) ?> /><?php _e( 'Private', 'buddypress' ) ?></label>
-                        <label for="bp-group-status-hidden"><input type="radio" name="group-status" id="bp-group-status-hidden" value="hidden" <?php checked( $item->status, 'hidden' ) ?> /><?php _e( 'Hidden', 'buddypress' ) ?></label>
+                        <legend><?php esc_html_e( 'Privacy', 'buddypress' ); ?></legend>
+
+                        <label for="bp-group-status-public"><input type="radio" name="group-status" id="bp-group-status-public" value="public" <?php checked( $item->status, 'public' ) ?> /><?php esc_html_e( 'Public', 'buddypress' ) ?></label>
+                        <label for="bp-group-status-private"><input type="radio" name="group-status" id="bp-group-status-private" value="private" <?php checked( $item->status, 'private' ) ?> /><?php esc_html_e( 'Private', 'buddypress' ) ?></label>
+                        <label for="bp-group-status-hidden"><input type="radio" name="group-status" id="bp-group-status-hidden" value="hidden" <?php checked( $item->status, 'hidden' ) ?> /><?php esc_html_e( 'Hidden', 'buddypress' ) ?></label>
                 </fieldset>
         </div>
@@ -890 +899 @@
         <div class="bp-groups-settings-section" id="bp-groups-settings-section-invite-status">
                 <fieldset>
-                        <legend><?php _e( 'Who can invite others to this group?', 'buddypress' ); ?></legend>
-
-                        <label for="bp-group-invite-status-members"><input type="radio" name="group-invite-status" id="bp-group-invite-status-members" value="members" <?php checked( $invite_status, 'members' ) ?> /><?php _e( 'All group members', 'buddypress' ) ?></label>
-                        <label for="bp-group-invite-status-mods"><input type="radio" name="group-invite-status" id="bp-group-invite-status-mods" value="mods" <?php checked( $invite_status, 'mods' ) ?> /><?php _e( 'Group admins and mods only', 'buddypress' ) ?></label>
-                        <label for="bp-group-invite-status-admins"><input type="radio" name="group-invite-status" id="bp-group-invite-status-admins" value="admins" <?php checked( $invite_status, 'admins' ) ?> /><?php _e( 'Group admins only', 'buddypress' ) ?></label>
+                        <legend><?php esc_html_e( 'Who can invite others to this group?', 'buddypress' ); ?></legend>
+
+                        <label for="bp-group-invite-status-members"><input type="radio" name="group-invite-status" id="bp-group-invite-status-members" value="members" <?php checked( $invite_status, 'members' ) ?> /><?php esc_html_e( 'All group members', 'buddypress' ) ?></label>
+                        <label for="bp-group-invite-status-mods"><input type="radio" name="group-invite-status" id="bp-group-invite-status-mods" value="mods" <?php checked( $invite_status, 'mods' ) ?> /><?php esc_html_e( 'Group admins and mods only', 'buddypress' ) ?></label>
+                        <label for="bp-group-invite-status-admins"><input type="radio" name="group-invite-status" id="bp-group-invite-status-admins" value="admins" <?php checked( $invite_status, 'admins' ) ?> /><?php esc_html_e( 'Group admins only', 'buddypress' ) ?></label>
                 </fieldset>
         </div>
@@ -919 +928 @@
         ?>
 
-        <label for="bp-groups-new-members" class="screen-reader-text"><?php
-                /* translators: accessibility text */
-                _e( 'Add new members', 'buddypress' );
-        ?></label>
+        <label for="bp-groups-new-members" class="screen-reader-text">
+                <?php
+                        /* translators: accessibility text */
+                        esc_html_e( 'Add new members', 'buddypress' );
+                ?>
+        </label>
         <input name="bp-groups-new-members" type="text" id="bp-groups-new-members" class="<?php echo esc_attr( $class ); ?>" placeholder="" />
         <?php if ( $notice ) : ?>
@@ -1007 +1018 @@
                 <div class="bp-groups-member-type" id="bp-groups-member-type-<?php echo esc_attr( $member_type ) ?>">
 
-                        <h3><?php switch ( $member_type ) :
+                        <h3>
+                                <?php
+                                switch ( $member_type ) :
                                         case 'admin'  : esc_html_e( 'Administrators', 'buddypress' ); break;
                                         case 'mod'    : esc_html_e( 'Moderators',     'buddypress' ); break;
                                         case 'member' : esc_html_e( 'Members',        'buddypress' ); break;
                                         case 'banned' : esc_html_e( 'Banned Members', 'buddypress' ); break;
-                        endswitch; ?></h3>
+                                endswitch;
+                                ?>
+                        </h3>
 
                         <div class="bp-group-admin-pagination table-top">
-                                <?php echo $pagination[ $member_type ] ?>
+                                <?php
+                                        // phpcs:ignore WordPress.Security.EscapeOutput
+                                        echo $pagination[ $member_type ];
+                                ?>
                         </div>
 
-                <?php if ( !empty( $type_users ) ) : ?>
+                <?php if ( ! empty( $type_users ) ) : ?>
 
                         <table class="widefat bp-group-members">
                                 <thead>
                                         <tr>
-                                                <th scope="col" class="uid-column"><?php _ex( 'ID', 'Group member user_id in group admin', 'buddypress' ); ?></th>
-                                                <th scope="col" class="uname-column"><?php _ex( 'Name', 'Group member name in group admin', 'buddypress' ); ?></th>
-                                                <th scope="col" class="urole-column"><?php _ex( 'Group Role', 'Group member role in group admin', 'buddypress' ); ?></th>
+                                                <th scope="col" class="uid-column"><?php echo esc_html_x( 'ID', 'Group member user_id in group admin', 'buddypress' ); ?></th>
+                                                <th scope="col" class="uname-column"><?php echo esc_html_x( 'Name', 'Group member name in group admin', 'buddypress' ); ?></th>
+                                                <th scope="col" class="urole-column"><?php echo esc_html_x( 'Group Role', 'Group member role in group admin', 'buddypress' ); ?></th>
                                         </tr>
                                 </thead>
@@ -1036 +1054 @@
 
                                                 <td class="uname-column">
-                                                        <a style="float: left;" href="<?php echo bp_members_get_user_url( $type_user->ID ); ?>"><?php echo bp_core_fetch_avatar( array(
-                                                                'item_id' => $type_user->ID,
-                                                                'width'   => '32',
-                                                                'height'  => '32'
-                                                        ) ); ?></a>
-
-                                                        <span style="margin: 8px; float: left;"><?php echo bp_core_get_userlink( $type_user->ID ); ?></span>
+                                                        <a style="float: left;" href="<?php echo esc_url( bp_members_get_user_url( $type_user->ID ) ); ?>">
+                                                                <?php
+                                                                        // phpcs:ignore WordPress.Security.EscapeOutput
+                                                                        echo bp_core_fetch_avatar(
+                                                                                array(
+                                                                                        'item_id' => $type_user->ID,
+                                                                                        'width'   => '32',
+                                                                                        'height'  => '32'
+                                                                                )
+                                                                        );
+                                                                ?>
+                                                        </a>
+
+                                                        <span style="margin: 8px; float: left;">
+                                                                <?php
+                                                                        // phpcs:ignore WordPress.Security.EscapeOutput
+                                                                        echo bp_core_get_userlink( $type_user->ID );
+                                                                ?>
+                                                        </span>
                                                 </td>
 
                                                 <td class="urole-column">
-                                                        <label for="bp-groups-role-<?php echo esc_attr( $type_user->ID ); ?>" class="screen-reader-text"><?php
-                                                                /* translators: accessibility text */
-                                                                _e( 'Select group role for member', 'buddypress' );
-                                                        ?></label>
+                                                        <label for="bp-groups-role-<?php echo esc_attr( $type_user->ID ); ?>" class="screen-reader-text">
+                                                                <?php
+                                                                        /* translators: accessibility text */
+                                                                        esc_html_e( 'Select group role for member', 'buddypress' );
+                                                                ?>
+                                                        </label>
                                                         <select class="bp-groups-role" id="bp-groups-role-<?php echo esc_attr( $type_user->ID ); ?>" name="bp-groups-role[<?php echo esc_attr( $type_user->ID ); ?>]">
                                                                 <optgroup label="<?php esc_attr_e( 'Roles', 'buddypress' ); ?>">
                                                                         <option class="admin"  value="admin"  <?php selected( 'admin',  $member_type ); ?>><?php esc_html_e( 'Administrator', 'buddypress' ); ?></option>
-                                                                        <option class="mod"    value="mod"    <?php selected( 'mod',    $member_type ); ?>><?php esc_html_e( 'Moderator',     'buddypress' ); ?></option>
-                                                                        <option class="member" value="member" <?php selected( 'member', $member_type ); ?>><?php esc_html_e( 'Member',        'buddypress' ); ?></option>
+                                                                        <option class="mod"    value="mod"    <?php selected( 'mod',    $member_type ); ?>><?php esc_html_e( 'Moderator', 'buddypress' ); ?></option>
+                                                                        <option class="member" value="member" <?php selected( 'member', $member_type ); ?>><?php esc_html_e( 'Member', 'buddypress' ); ?></option>
+
                                                                         <?php if ( 'banned' === $member_type ) : ?>
-                                                                        <option class="banned" value="banned" <?php selected( 'banned', $member_type ); ?>><?php esc_html_e( 'Banned',        'buddypress' ); ?></option>
+                                                                                <option class="banned" value="banned" <?php selected( 'banned', $member_type ); ?>><?php esc_html_e( 'Banned', 'buddypress' ); ?></option>
                                                                         <?php endif; ?>
+
                                                                 </optgroup>
                                                                 <optgroup label="<?php esc_attr_e( 'Actions', 'buddypress' ); ?>">
                                                                         <option class="remove" value="remove"><?php esc_html_e( 'Remove', 'buddypress' ); ?></option>
+
                                                                         <?php if ( 'banned' !== $member_type ) : ?>
                                                                                 <option class="banned" value="banned"><?php esc_html_e( 'Ban', 'buddypress' ); ?></option>
                                                                         <?php endif; ?>
+
                                                                 </optgroup>
                                                         </select>
@@ -1121 +1157 @@
  */
 function bp_groups_admin_edit_metabox_status( $item ) {
-        $base_url = add_query_arg( array(
-                'page' => 'bp-groups',
-                'gid'  => $item->id
-        ), bp_get_admin_url( 'admin.php' ) ); ?>
+        $base_url = add_query_arg(
+                array(
+                        'page' => 'bp-groups',
+                        'gid'  => $item->id
+                ),
+                bp_get_admin_url( 'admin.php' )
+        );
+        ?>
 
         <div id="submitcomment" class="submitbox">
                 <div id="major-publishing-actions">
                         <div id="delete-action">
-                                <a class="submitdelete deletion" href="<?php echo esc_url( wp_nonce_url( add_query_arg( 'action', 'delete', $base_url ), 'bp-groups-delete' ) ); ?>"><?php _e( 'Delete Group', 'buddypress' ) ?></a>
+                                <a class="submitdelete deletion" href="<?php echo esc_url( wp_nonce_url( add_query_arg( 'action', 'delete', $base_url ), 'bp-groups-delete' ) ); ?>"><?php esc_html_e( 'Delete Group', 'buddypress' ) ?></a>
                         </div>
 
@@ -1161 +1201 @@
         ?>
 
-        <label for="bp-groups-group-type" class="screen-reader-text"><?php
-                /* translators: accessibility text */
-                esc_html_e( 'Select group type', 'buddypress' );
-        ?></label>
+        <label for="bp-groups-group-type" class="screen-reader-text">
+                <?php
+                        /* translators: accessibility text */
+                        esc_html_e( 'Select group type', 'buddypress' );
+                ?>
+        </label>
 
         <ul class="categorychecklist form-no-clear">
@@ -1265 +1307 @@
         $current_page_end   = $page * $per_page > intval( $query->total_users ) ? $query->total_users : $page * $per_page;
 
-        $pag_links = paginate_links( array(
-                'base'      => add_query_arg( $qs_key, '%#%', $url_base ),
-                'format'    => '',
-                'prev_text' => __( '&laquo;', 'buddypress' ),
-                'next_text' => __( '&raquo;', 'buddypress' ),
-                'total'     => ceil( $query->total_users / $per_page ),
-                'current'   => $page,
-        ) );
+        $pag_links = paginate_links(
+                array(
+                        'base'      => add_query_arg( $qs_key, '%#%', $url_base ),
+                        'format'    => '',
+                        'prev_text' => __( '&laquo;', 'buddypress' ),
+                        'next_text' => __( '&raquo;', 'buddypress' ),
+                        'total'     => ceil( $query->total_users / $per_page ),
+                        'current'   => $page,
+                )
+        );
 
         if ( 1 == $query->total_users ) {
@@ -1286 +1330 @@
         }
 
-        $pagination .= '<span class="bp-group-admin-pagination-viewing">' . $viewing_text . '</span>';
+        $pagination .= '<span class="bp-group-admin-pagination-viewing">' . esc_html( $viewing_text ) . '</span>';
+
+        // phpcs:ignore WordPress.Security.EscapeOutput
         $pagination .= '<span class="bp-group-admin-pagination-links">' . $pag_links . '</span>';
 
@@ -1331 +1377 @@
         }
 
-        $suggestions = bp_core_get_suggestions( array(
-                'group_id' => -$group_id,  // A negative value will exclude this group's members from the suggestions.
-                'limit'    => 10,
-                'term'     => $term,
-                'type'     => 'members',
-        ) );
+        $suggestions = bp_core_get_suggestions(
+                array(
+                        'group_id' => -$group_id,  // A negative value will exclude this group's members from the suggestions.
+                        'limit'    => 10,
+                        'term'     => $term,
+                        'type'     => 'members',
+                )
+        );
 
         $matches = array();

trunk/src/bp-groups/bp-groups-blocks.php

@@ -349 +349 @@
 
         // Include the common JS template.
+        // phpcs:ignore WordPress.Security.EscapeOutput
         echo bp_get_dynamic_template_part( 'assets/widgets/dynamic-groups.php' );
 

trunk/src/bp-groups/bp-groups-functions.php

@@ -330 +330 @@
         // Backward compatibility with old method of passing arguments.
         if ( ! is_array( $args ) || count( $function_args ) > 1 ) {
-                _deprecated_argument( __METHOD__, '2.9.0', sprintf( __( 'Arguments passed to %1$s should be in an associative array. See the inline documentation at %2$s for more details.', 'buddypress' ), __METHOD__, __FILE__ ) );
+                _deprecated_argument( __METHOD__, '2.9.0', sprintf( esc_html__( 'Arguments passed to %1$s should be in an associative array. See the inline documentation at %2$s for more details.', 'buddypress' ), __METHOD__, __FILE__ ) );
 
                 $old_args_keys = array(
@@ -813 +813 @@
         if ( ! is_array( $args ) || count( $function_args ) > 1 ) {
                 /* translators: 1: the name of the method. 2: the name of the file. */
-                _deprecated_argument( __METHOD__, '2.0.0', sprintf( __( 'Arguments passed to %1$s should be in an associative array. See the inline documentation at %2$s for more details.', 'buddypress' ), __METHOD__, __FILE__ ) );
+                _deprecated_argument( __METHOD__, '2.0.0', sprintf( esc_html__( 'Arguments passed to %1$s should be in an associative array. See the inline documentation at %2$s for more details.', 'buddypress' ), __METHOD__, __FILE__ ) );
 
                 $old_args_keys = array(
@@ -1832 +1832 @@
         // Backward compatibility with old method of passing arguments.
         if ( ! is_array( $args[0] ) || count( $args ) > 1 ) {
-                _deprecated_argument( __METHOD__, '5.0.0', sprintf( __( 'Arguments passed to %1$s should be in an associative array. See the inline documentation at %2$s for more details.', 'buddypress' ), __METHOD__, __FILE__ ) );
+                _deprecated_argument( __METHOD__, '5.0.0', sprintf( esc_html__( 'Arguments passed to %1$s should be in an associative array. See the inline documentation at %2$s for more details.', 'buddypress' ), __METHOD__, __FILE__ ) );
 
                 $old_args_keys = array(
@@ -2048 +2048 @@
 function groups_demote_member( $user_id, $group_id ) {
 
-        if ( ! bp_is_item_admin() )
+        if ( ! bp_is_item_admin() ) {
                 return false;
+        }
 
         $member = new BP_Groups_Member( $user_id, $group_id );
@@ -2077 +2078 @@
 function groups_ban_member( $user_id, $group_id ) {
 
-        if ( ! bp_is_item_admin() )
+        if ( ! bp_is_item_admin() ) {
                 return false;
+        }
 
         $member = new BP_Groups_Member( $user_id, $group_id );
@@ -2106 +2108 @@
 function groups_unban_member( $user_id, $group_id ) {
 
-        if ( ! bp_is_item_admin() )
+        if ( ! bp_is_item_admin() ) {
                 return false;
+        }
 
         $member = new BP_Groups_Member( $user_id, $group_id );
@@ -2176 +2179 @@
         // Backward compatibility with old method of passing arguments.
         if ( ! is_array( $args[0] ) || count( $args ) > 1 ) {
-                _deprecated_argument( __METHOD__, '5.0.0', sprintf( __( 'Arguments passed to %1$s should be in an associative array. See the inline documentation at %2$s for more details.', 'buddypress' ), __METHOD__, __FILE__ ) );
+                _deprecated_argument( __METHOD__, '5.0.0', sprintf( esc_html__( 'Arguments passed to %1$s should be in an associative array. See the inline documentation at %2$s for more details.', 'buddypress' ), __METHOD__, __FILE__ ) );
 
                 $old_args_keys = array(
@@ -2251 +2254 @@
         if ( ! empty( $membership_id ) ) {
                 /* translators: 1: the name of the method. 2: the name of the file. */
-                _deprecated_argument( __METHOD__, '5.0.0', sprintf( __( 'Argument `membership_id` passed to %1$s is deprecated. See the inline documentation at %2$s for more details.', 'buddypress' ), __METHOD__, __FILE__ ) );
+                _deprecated_argument( __METHOD__, '5.0.0', sprintf( esc_html__( 'Argument `membership_id` passed to %1$s is deprecated. See the inline documentation at %2$s for more details.', 'buddypress' ), __METHOD__, __FILE__ ) );
         }
 
@@ -2285 +2288 @@
         if ( ! empty( $membership_id ) ){
                 /* translators: 1: the name of the method. 2: the name of the file. */
-                _deprecated_argument( __METHOD__, '5.0.0', sprintf( __( 'Argument `membership_id` passed to %1$s is deprecated. See the inline documentation at %2$s for more details.', 'buddypress' ), __METHOD__, __FILE__ ) );
+                _deprecated_argument( __METHOD__, '5.0.0', sprintf( esc_html__( 'Argument `membership_id` passed to %1$s is deprecated. See the inline documentation at %2$s for more details.', 'buddypress' ), __METHOD__, __FILE__ ) );
         }
 
@@ -2323 +2326 @@
         if ( ! empty( $membership_id ) ){
                 /* translators: 1: the name of the method. 2: the name of the file. */
-                _deprecated_argument( __METHOD__, '5.0.0', sprintf( __( 'Argument `membership_id` passed to %1$s is deprecated. See the inline documentation at %2$s for more details.', 'buddypress' ), __METHOD__, __FILE__ ) );
+                _deprecated_argument( __METHOD__, '5.0.0', sprintf( esc_html__( 'Argument `membership_id` passed to %1$s is deprecated. See the inline documentation at %2$s for more details.', 'buddypress' ), __METHOD__, __FILE__ ) );
         }
 
@@ -2643 +2646 @@
  */
 function bp_group_type_tax_name() {
-        echo bp_get_group_type_tax_name();
+        echo esc_html( bp_get_group_type_tax_name() );
 }
 
@@ -2878 +2881 @@
 
         if ( isset( $bp->groups->types[ $group_type ] ) ) {
-                return new WP_Error( 'bp_group_type_exists', __( 'Group type already exists.', 'buddypress' ), $group_type );
+                return new WP_Error( 'bp_group_type_exists', esc_html__( 'Group type already exists.', 'buddypress' ), $group_type );
         }
 

trunk/src/bp-groups/bp-groups-notifications.php

@@ -1161 +1161 @@
 function groups_screen_notification_settings() {
 
-        if ( !$group_invite = bp_get_user_meta( bp_displayed_user_id(), 'notification_groups_invite', true ) )
+        if ( ! $group_invite = bp_get_user_meta( bp_displayed_user_id(), 'notification_groups_invite', true ) ) {
                 $group_invite  = 'yes';
-
-        if ( !$group_update = bp_get_user_meta( bp_displayed_user_id(), 'notification_groups_group_updated', true ) )
+        }
+
+        if ( ! $group_update = bp_get_user_meta( bp_displayed_user_id(), 'notification_groups_group_updated', true ) ) {
                 $group_update  = 'yes';
-
-        if ( !$group_promo = bp_get_user_meta( bp_displayed_user_id(), 'notification_groups_admin_promotion', true ) )
+        }
+
+        if ( ! $group_promo = bp_get_user_meta( bp_displayed_user_id(), 'notification_groups_admin_promotion', true ) ) {
                 $group_promo   = 'yes';
-
-        if ( !$group_request = bp_get_user_meta( bp_displayed_user_id(), 'notification_groups_membership_request', true ) )
+        }
+
+        if ( ! $group_request = bp_get_user_meta( bp_displayed_user_id(), 'notification_groups_membership_request', true ) ) {
                 $group_request = 'yes';
+        }
 
         if ( ! $group_request_completed = bp_get_user_meta( bp_displayed_user_id(), 'notification_membership_request_completed', true ) ) {
@@ -1182 +1186 @@
                         <tr>
                                 <th class="icon"></th>
-                                <th class="title"><?php _ex( 'Groups', 'Group settings on notification settings page', 'buddypress' ) ?></th>
-                                <th class="yes"><?php _e( 'Yes', 'buddypress' ) ?></th>
-                                <th class="no"><?php _e( 'No', 'buddypress' )?></th>
+                                <th class="title"><?php echo esc_html_x( 'Groups', 'Group settings on notification settings page', 'buddypress' ) ?></th>
+                                <th class="yes"><?php esc_html_e( 'Yes', 'buddypress' ) ?></th>
+                                <th class="no"><?php esc_html_e( 'No', 'buddypress' )?></th>
                         </tr>
                 </thead>
@@ -1191 +1195 @@
                         <tr id="groups-notification-settings-invitation">
                                 <td></td>
-                                <td><?php _ex( 'A member invites you to join a group', 'group settings on notification settings page','buddypress' ) ?></td>
+                                <td><?php echo esc_html_x( 'A member invites you to join a group', 'group settings on notification settings page','buddypress' ) ?></td>
                                 <td class="yes"><input type="radio" name="notifications[notification_groups_invite]" id="notification-groups-invite-yes" value="yes" <?php checked( $group_invite, 'yes', true ) ?>/><label for="notification-groups-invite-yes" class="bp-screen-reader-text"><?php
                                         /* translators: accessibility text */
-                                        _e( 'Yes, send email', 'buddypress' );
+                                        esc_html_e( 'Yes, send email', 'buddypress' );
                                 ?></label></td>
                                 <td class="no"><input type="radio" name="notifications[notification_groups_invite]" id="notification-groups-invite-no" value="no" <?php checked( $group_invite, 'no', true ) ?>/><label for="notification-groups-invite-no" class="bp-screen-reader-text"><?php
                                         /* translators: accessibility text */
-                                        _e( 'No, do not send email', 'buddypress' );
+                                        esc_html_e( 'No, do not send email', 'buddypress' );
                                 ?></label></td>
                         </tr>
                         <tr id="groups-notification-settings-info-updated">
                                 <td></td>
-                                <td><?php _ex( 'Group information is updated', 'group settings on notification settings page', 'buddypress' ) ?></td>
+                                <td><?php echo esc_html_x( 'Group information is updated', 'group settings on notification settings page', 'buddypress' ) ?></td>
                                 <td class="yes"><input type="radio" name="notifications[notification_groups_group_updated]" id="notification-groups-group-updated-yes" value="yes" <?php checked( $group_update, 'yes', true ) ?>/><label for="notification-groups-group-updated-yes" class="bp-screen-reader-text"><?php
                                         /* translators: accessibility text */
-                                        _e( 'Yes, send email', 'buddypress' );
+                                        esc_html_e( 'Yes, send email', 'buddypress' );
                                 ?></label></td>
                                 <td class="no"><input type="radio" name="notifications[notification_groups_group_updated]" id="notification-groups-group-updated-no" value="no" <?php checked( $group_update, 'no', true ) ?>/><label for="notification-groups-group-updated-no" class="bp-screen-reader-text"><?php
                                         /* translators: accessibility text */
-                                        _e( 'No, do not send email', 'buddypress' );
+                                        esc_html_e( 'No, do not send email', 'buddypress' );
                                 ?></label></td>
                         </tr>
                         <tr id="groups-notification-settings-promoted">
                                 <td></td>
-                                <td><?php _ex( 'You are promoted to a group administrator or moderator', 'group settings on notification settings page', 'buddypress' ) ?></td>
+                                <td><?php echo esc_html_x( 'You are promoted to a group administrator or moderator', 'group settings on notification settings page', 'buddypress' ) ?></td>
                                 <td class="yes"><input type="radio" name="notifications[notification_groups_admin_promotion]" id="notification-groups-admin-promotion-yes" value="yes" <?php checked( $group_promo, 'yes', true ) ?>/><label for="notification-groups-admin-promotion-yes" class="bp-screen-reader-text"><?php
                                         /* translators: accessibility text */
-                                        _e( 'Yes, send email', 'buddypress' );
+                                        esc_html_e( 'Yes, send email', 'buddypress' );
                                 ?></label></td>
                                 <td class="no"><input type="radio" name="notifications[notification_groups_admin_promotion]" id="notification-groups-admin-promotion-no" value="no" <?php checked( $group_promo, 'no', true ) ?>/><label for="notification-groups-admin-promotion-no" class="bp-screen-reader-text"><?php
                                         /* translators: accessibility text */
-                                        _e( 'No, do not send email', 'buddypress' );
+                                        esc_html_e( 'No, do not send email', 'buddypress' );
                                 ?></label></td>
                         </tr>
                         <tr id="groups-notification-settings-request">
                                 <td></td>
-                                <td><?php _ex( 'A member requests to join a private group for which you are an admin', 'group settings on notification settings page', 'buddypress' ) ?></td>
+                                <td><?php echo esc_html_x( 'A member requests to join a private group for which you are an admin', 'group settings on notification settings page', 'buddypress' ) ?></td>
                                 <td class="yes"><input type="radio" name="notifications[notification_groups_membership_request]" id="notification-groups-membership-request-yes" value="yes" <?php checked( $group_request, 'yes', true ) ?>/><label for="notification-groups-membership-request-yes" class="bp-screen-reader-text"><?php
                                         /* translators: accessibility text */
-                                        _e( 'Yes, send email', 'buddypress' );
+                                        esc_html_e( 'Yes, send email', 'buddypress' );
                                 ?></label></td>
                                 <td class="no"><input type="radio" name="notifications[notification_groups_membership_request]" id="notification-groups-membership-request-no" value="no" <?php checked( $group_request, 'no', true ) ?>/><label for="notification-groups-membership-request-no" class="bp-screen-reader-text"><?php
                                         /* translators: accessibility text */
-                                        _e( 'No, do not send email', 'buddypress' );
+                                        esc_html_e( 'No, do not send email', 'buddypress' );
                                 ?></label></td>
                         </tr>
                         <tr id="groups-notification-settings-request-completed">
                                 <td></td>
-                                <td><?php _ex( 'Your request to join a group has been approved or denied', 'group settings on notification settings page', 'buddypress' ) ?></td>
+                                <td><?php echo esc_html_x( 'Your request to join a group has been approved or denied', 'group settings on notification settings page', 'buddypress' ) ?></td>
                                 <td class="yes"><input type="radio" name="notifications[notification_membership_request_completed]" id="notification-groups-membership-request-completed-yes" value="yes" <?php checked( $group_request_completed, 'yes', true ) ?>/><label for="notification-groups-membership-request-completed-yes" class="bp-screen-reader-text"><?php
                                         /* translators: accessibility text */
-                                        _e( 'Yes, send email', 'buddypress' );
+                                        esc_html_e( 'Yes, send email', 'buddypress' );
                                 ?></label></td>
                                 <td class="no"><input type="radio" name="notifications[notification_membership_request_completed]" id="notification-groups-membership-request-completed-no" value="no" <?php checked( $group_request_completed, 'no', true ) ?>/><label for="notification-groups-membership-request-completed-no" class="bp-screen-reader-text"><?php
                                         /* translators: accessibility text */
-                                        _e( 'No, do not send email', 'buddypress' );
+                                        esc_html_e( 'No, do not send email', 'buddypress' );
                                 ?></label></td>
                         </tr>

trunk/src/bp-groups/bp-groups-template.php

@@ -17 +17 @@
  */
 function bp_groups_slug() {
-        echo bp_get_groups_slug();
+        echo esc_url( bp_get_groups_slug() );
 }
         /**
@@ -44 +44 @@
  */
 function bp_groups_root_slug() {
-        echo bp_get_groups_root_slug();
+        echo esc_url( bp_get_groups_root_slug() );
 }
         /**
@@ -227 +227 @@
  */
 function bp_group_type_directory_link( $group_type = '' ) {
+        // phpcs:ignore WordPress.Security.EscapeOutput
         echo bp_get_group_type_directory_link( $group_type );
 }
@@ -269 +270 @@
  * @since 2.7.0
  * @see   bp_get_group_type_list() for parameter documentation.
+ *
+ * @param integer $group_id The group ID.
+ * @param array   $r        List parameters.
  */
 function bp_group_type_list( $group_id = 0, $r = array() ) {
+        // phpcs:ignore WordPress.Security.EscapeOutput
         echo bp_get_group_type_list( $group_id, $r );
 }
@@ -657 +662 @@
  */
 function bp_group_id( $group = false ) {
-        echo bp_get_group_id( $group );
+        echo intval( bp_get_group_id( $group ) );
 }
         /**
@@ -696 +701 @@
  */
 function bp_group_class( $classes = array() ) {
+        // phpcs:ignore WordPress.Security.EscapeOutput
         echo bp_get_group_class( $classes );
 }
@@ -764 +770 @@
                  * @param array $classes Array of determined classes for the row.
                  */
-                $classes = apply_filters( 'bp_get_group_class', $classes );
+                $classes = array_map( 'sanitize_html_class', apply_filters( 'bp_get_group_class', $classes ) );
                 $classes = array_merge( $classes, array() );
                 $retval = 'class="' . join( ' ', $classes ) . '"';
@@ -780 +786 @@
  */
 function bp_group_name( $group = false ) {
+        // Escaping is made in `bp-groups/bp-groups-filters.php`.
+        // phpcs:ignore WordPress.Security.EscapeOutput
         echo bp_get_group_name( $group );
 }
@@ -820 +828 @@
  */
 function bp_group_type( $group = false ) {
-        echo bp_get_group_type( $group );
+        echo esc_html( bp_get_group_type( $group ) );
 }
         /**
@@ -870 +878 @@
  */
 function bp_group_status( $group = false ) {
-        echo bp_get_group_status( $group );
+        echo esc_html( bp_get_group_status( $group ) );
 }
         /**
@@ -914 +922 @@
  */
 function bp_group_avatar( $args = '', $group = false ) {
+        // phpcs:ignore WordPress.Security.EscapeOutput
         echo bp_get_group_avatar( $args, $group );
 }
@@ -1018 +1027 @@
  */
 function bp_group_avatar_thumb( $group = false ) {
+        // phpcs:ignore WordPress.Security.EscapeOutput
         echo bp_get_group_avatar_thumb( $group );
 }
@@ -1048 +1058 @@
  */
 function bp_group_avatar_mini( $group = false ) {
+        // phpcs:ignore WordPress.Security.EscapeOutput
         echo bp_get_group_avatar_mini( $group );
 }
@@ -1082 +1093 @@
  */
 function bp_group_avatar_url( $group = false, $type = 'full' ) {
-        echo bp_get_group_avatar_url( $group, $type );
+        echo esc_url( bp_get_group_avatar_url( $group, $type ) );
 }
         /**
@@ -1162 +1173 @@
  */
 function bp_group_last_active( $group = false, $args = array() ) {
-        echo bp_get_group_last_active( $group, $args );
+        echo esc_html( bp_get_group_last_active( $group, $args ) );
 }
         /**
@@ -1309 +1320 @@
  */
 function bp_group_link( $group = false ) {
+        // phpcs:ignore WordPress.Security.EscapeOutput
         echo bp_get_group_link( $group );
 }
@@ -1419 +1431 @@
  */
 function bp_group_slug( $group = false ) {
-        echo bp_get_group_slug( $group );
+        echo esc_url( bp_get_group_slug( $group ) );
 }
         /**
@@ -1459 +1471 @@
  */
 function bp_group_description( $group = false ) {
+        // Escaping is made in `bp-groups/bp-groups-filters.php`.
+        // phpcs:ignore WordPress.Security.EscapeOutput
         echo bp_get_group_description( $group );
 }
@@ -1499 +1513 @@
  */
 function bp_group_description_editable( $group = false ) {
-        echo bp_get_group_description_editable( $group );
+        echo esc_textarea( bp_get_group_description_editable( $group ) );
 }
         /**
@@ -1548 +1562 @@
  */
 function bp_group_description_excerpt( $group = false, $length = 225 ) {
+        // Escaping is made in `bp-groups/bp-groups-filters.php`.
+        // phpcs:ignore WordPress.Security.EscapeOutput
         echo bp_get_group_description_excerpt( $group, $length );
 }
@@ -1591 +1607 @@
  */
 function bp_group_date_created( $group = false, $args = array() ) {
-        echo bp_get_group_date_created( $group, $args );
+        echo esc_html( bp_get_group_date_created( $group, $args ) );
 }
         /**
@@ -1650 +1666 @@
  */
 function bp_group_creator_username( $group = false ) {
+        // Escaping is made in `bp-members/bp-members-functions.php`.
+        // phpcs:ignore WordPress.Security.EscapeOutput
         echo bp_get_group_creator_username( $group );
 }
@@ -1690 +1708 @@
  */
 function bp_group_creator_id( $group = false ) {
-        echo bp_get_group_creator_id( $group );
+        echo intval( bp_get_group_creator_id( $group ) );
 }
         /**
@@ -1730 +1748 @@
  */
 function bp_group_creator_permalink( $group = false ) {
-        echo bp_get_group_creator_permalink( $group );
+        echo esc_url( bp_get_group_creator_permalink( $group ) );
 }
         /**
@@ -1800 +1818 @@
  */
 function bp_group_creator_avatar( $group = false, $args = array() ) {
+        // phpcs:ignore WordPress.Security.EscapeOutput
         echo bp_get_group_creator_avatar( $group, $args );
 }
@@ -1911 +1930 @@
         $group = bp_get_group( $group );
 
+        // phpcs:disable WordPress.Security.EscapeOutput
         if ( ! empty( $group->admins ) ) { ?>
                 <ul id="group-admins">
@@ -1943 +1963 @@
         <?php } ?>
         <?php
+        // phpcs:enable
 }
 
@@ -1957 +1978 @@
         $group = bp_get_group( $group );
 
+        // phpcs:disable WordPress.Security.EscapeOutput
         if ( ! empty( $group->mods ) ) :
                 ?>
@@ -1989 +2011 @@
                 <?php
         endif;
+        // phpcs:enable
 }
 
@@ -2091 +2114 @@
  */
 function bp_groups_pagination_links() {
+        // Escaping is done in WordPress's `paginate_links()` function.
+        // phpcs:ignore WordPress.Security.EscapeOutput
         echo bp_get_groups_pagination_links();
 }
@@ -2121 +2146 @@
  */
 function bp_groups_pagination_count() {
-        echo bp_get_groups_pagination_count();
+        echo esc_html( bp_get_groups_pagination_count() );
 }
         /**
@@ -2191 +2216 @@
  */
 function bp_group_total_members( $group = false ) {
-        echo bp_get_group_total_members( $group );
+        echo intval( bp_get_group_total_members( $group ) );
 }
         /**
@@ -2231 +2256 @@
  */
 function bp_group_member_count( $group = false ) {
-        echo bp_get_group_member_count( $group );
+        echo esc_html( bp_get_group_member_count( $group ) );
 }
         /**
@@ -2509 +2534 @@
  */
 function bp_group_member_promote_mod_link( $args = '' ) {
-        echo bp_get_group_member_promote_mod_link( $args );
+        echo esc_url( bp_get_group_member_promote_mod_link( $args ) );
 }
         /**
@@ -2564 +2589 @@
  */
 function bp_group_member_promote_admin_link( $args = '' ) {
-        echo bp_get_group_member_promote_admin_link( $args );
+        echo esc_url( bp_get_group_member_promote_admin_link( $args ) );
 }
         /**
@@ -2622 +2647 @@
  */
 function bp_group_member_demote_link( $user_id = 0, $group = false ) {
-        echo bp_get_group_member_demote_link( $user_id, $group );
+        echo esc_url( bp_get_group_member_demote_link( $user_id, $group ) );
 }
         /**
@@ -2677 +2702 @@
  */
 function bp_group_member_ban_link( $user_id = 0, $group = false ) {
-        echo bp_get_group_member_ban_link( $user_id, $group );
+        echo esc_url( bp_get_group_member_ban_link( $user_id, $group ) );
 }
         /**
@@ -2731 +2756 @@
  */
 function bp_group_member_unban_link( $user_id = 0, $group = false ) {
-        echo bp_get_group_member_unban_link( $user_id, $group );
+        echo esc_url( bp_get_group_member_unban_link( $user_id, $group ) );
 }
         /**
@@ -2771 +2796 @@
                  * @param int             $user_id The user ID.
                  */
-                return apply_filters( 'bp_get_group_member_unban_link', $url,   $group, $user_id );
+                return apply_filters( 'bp_get_group_member_unban_link', $url, $group, $user_id );
         }
 
@@ -2785 +2810 @@
  */
 function bp_group_member_remove_link( $user_id = 0, $group = false ) {
-        echo bp_get_group_member_remove_link( $user_id, $group );
+        echo esc_url( bp_get_group_member_remove_link( $user_id, $group ) );
 }
         /**
@@ -2885 +2910 @@
 
         if ( ! empty( $admin_tabs_backcompat ) ) {
-                _doing_it_wrong( "do_action( 'groups_admin_tabs' )", __( 'This action should not be used directly. Please use the BuddyPress Group Extension API to generate Manage tabs.', 'buddypress' ), '2.2.0' );
+                _doing_it_wrong( "do_action( 'groups_admin_tabs' )", esc_html__( 'This action should not be used directly. Please use the BuddyPress Group Extension API to generate Manage tabs.', 'buddypress' ), '2.2.0' );
                 $subnav_output .= $admin_tabs_backcompat;
         }
@@ -2898 +2923 @@
  */
 function bp_group_total_for_member() {
-        echo bp_get_group_total_for_member();
+        echo intval( bp_get_group_total_for_member() );
 }
         /**
@@ -2930 +2955 @@
  */
 function bp_group_form_action( $page, $group = false ) {
-        echo bp_get_group_form_action( $page, $group );
+        echo esc_url( bp_get_group_form_action( $page, $group ) );
 }
         /**
@@ -2983 +3008 @@
  */
 function bp_group_admin_form_action( $page = false, $group = false ) {
-        echo bp_get_group_admin_form_action( $page, $group );
+        echo esc_url( bp_get_group_admin_form_action( $page, $group ) );
 }
         /**
@@ -3185 +3210 @@
  */
 function bp_group_accept_invite_link() {
-        echo bp_get_group_accept_invite_link();
+        echo esc_url( bp_get_group_accept_invite_link() );
 }
         /**
@@ -3233 +3258 @@
  */
 function bp_group_reject_invite_link() {
-        echo bp_get_group_reject_invite_link();
+        echo esc_url( bp_get_group_reject_invite_link() );
 }
         /**
@@ -3281 +3306 @@
  */
 function bp_group_leave_confirm_link() {
-        echo bp_get_group_leave_confirm_link();
+        echo esc_url( bp_get_group_leave_confirm_link() );
 }
         /**
@@ -3327 +3352 @@
  */
 function bp_group_leave_reject_link() {
-        echo bp_get_group_leave_reject_link();
+        echo esc_url( bp_get_group_leave_reject_link() );
 }
         /**
@@ -3365 +3390 @@
  */
 function bp_group_send_invite_form_action() {
-        echo bp_get_group_send_invite_form_action();
+        echo esc_url( bp_get_group_send_invite_form_action() );
 }
         /**
@@ -3439 +3464 @@
  */
 function bp_group_join_button( $group = false ) {
+        // Escaping is done in `BP_Core_HTML_Element()`.
+        // phpcs:ignore WordPress.Security.EscapeOutput
         echo bp_get_group_join_button( $group );
 }
@@ -3637 +3664 @@
  */
 function bp_group_create_button() {
+        // Escaping is done in `BP_Core_HTML_Element()`.
+        // phpcs:ignore WordPress.Security.EscapeOutput
         echo bp_get_group_create_button();
 }
@@ -3683 +3712 @@
  */
 function bp_group_create_nav_item() {
+        // Escaping is done in `BP_Core_HTML_Element()`.
+        // phpcs:ignore WordPress.Security.EscapeOutput
         echo bp_get_group_create_nav_item();
 }
@@ -3798 +3829 @@
          * @param object $group   Group to get status message for.
          */
-        echo apply_filters( 'bp_group_status_message', $message, $group );
+        echo esc_html( apply_filters( 'bp_group_status_message', $message, $group ) );
 }
 
@@ -3830 +3861 @@
  */
 function bp_total_group_count() {
-        echo bp_get_total_group_count();
+        echo intval( bp_get_total_group_count() );
 }
         /**
@@ -3859 +3890 @@
  */
 function bp_total_group_count_for_user( $user_id = 0 ) {
-        echo bp_get_total_group_count_for_user( $user_id );
+        echo intval( bp_get_total_group_count_for_user( $user_id ) );
 }
         /**
@@ -4016 +4047 @@
  */
 function bp_group_member_avatar( $args = '' ) {
+        // phpcs:ignore WordPress.Security.EscapeOutput
         echo bp_get_group_member_avatar( $args );
 }
@@ -4061 +4093 @@
  */
 function bp_group_member_avatar_thumb( $args = '' ) {
+        // phpcs:ignore WordPress.Security.EscapeOutput
         echo bp_get_group_member_avatar_thumb( $args );
 }
@@ -4107 +4140 @@
  */
 function bp_group_member_avatar_mini( $width = 30, $height = 30 ) {
+        // phpcs:ignore WordPress.Security.EscapeOutput
         echo bp_get_group_member_avatar_mini( $width, $height );
 }
@@ -4153 +4187 @@
  */
 function bp_group_member_name() {
-        echo bp_get_group_member_name();
+        echo esc_html( bp_get_group_member_name() );
 }
         /**
@@ -4183 +4217 @@
  */
 function bp_group_member_url() {
-        echo bp_get_group_member_url();
+        echo esc_url( bp_get_group_member_url() );
 }
         /**
@@ -4213 +4247 @@
  */
 function bp_group_member_link() {
+        // phpcs:ignore WordPress.Security.EscapeOutput
         echo bp_get_group_member_link();
 }
@@ -4234 +4269 @@
                  * @param string $value HTML link for the current user.
                  */
-                return apply_filters( 'bp_get_group_member_link', '<a href="' . bp_members_get_user_url( $members_template->member->user_id ) . '">' . $members_template->member->display_name . '</a>' );
+                return apply_filters( 'bp_get_group_member_link', '<a href="' . esc_url( bp_members_get_user_url( $members_template->member->user_id ) ) . '">' . esc_html( $members_template->member->display_name ) . '</a>' );
         }
 
@@ -4243 +4278 @@
  */
 function bp_group_member_domain() {
-        echo bp_get_group_member_domain();
+        echo esc_url( bp_get_group_member_domain() );
 }
         /**
@@ -4273 +4308 @@
  */
 function bp_group_member_is_friend() {
-        echo bp_get_group_member_is_friend();
+        echo esc_html( bp_get_group_member_is_friend() );
 }
         /**
@@ -4311 +4346 @@
  */
 function bp_group_member_is_banned() {
+        // phpcs:ignore WordPress.Security.EscapeOutput
         echo bp_get_group_member_is_banned();
 }
@@ -4355 +4391 @@
                  * @param string $value HTML class to add.
                  */
-                echo apply_filters( 'bp_group_member_css_class', 'banned-user' );
+                echo esc_attr( apply_filters( 'bp_group_member_css_class', 'banned-user' ) );
         }
 }
@@ -4369 +4405 @@
  */
 function bp_group_member_joined_since( $args = array() ) {
-        echo bp_get_group_member_joined_since( $args );
+        echo esc_html( bp_get_group_member_joined_since( $args ) );
 }
         /**
@@ -4427 +4463 @@
  */
 function bp_group_member_id() {
-        echo bp_get_group_member_id();
+        echo intval( bp_get_group_member_id() );
 }
         /**
@@ -4474 +4510 @@
  */
 function bp_group_pag_id() {
-        echo bp_get_group_pag_id();
+        echo esc_url( bp_get_group_pag_id() );
 }
         /**
@@ -4499 +4535 @@
  */
 function bp_group_member_pagination() {
+        // Escaping is done in WordPress's `paginate_links()` function.
+        // phpcs:ignore WordPress.Security.EscapeOutput
         echo bp_get_group_member_pagination();
         wp_nonce_field( 'bp_groups_member_list', '_member_pag_nonce' );
@@ -4530 +4568 @@
  */
 function bp_group_member_pagination_count() {
-        echo bp_get_group_member_pagination_count();
+        echo esc_html( bp_get_group_member_pagination_count() );
 }
         /**
@@ -4575 +4613 @@
  */
 function bp_group_member_admin_pagination() {
+        // Escaping is done in WordPress's `paginate_links()` function.
+        // phpcs:ignore WordPress.Security.EscapeOutput
         echo bp_get_group_member_admin_pagination();
         wp_nonce_field( 'bp_groups_member_admin_list', '_member_admin_pag_nonce' );
@@ -4707 +4747 @@
         </div>
 
-        <h2 class="bp-screen-reader-text"><?php
-                /* translators: accessibility text */
-                _e( 'Members', 'buddypress' );
-        ?></h2>
+        <h2 class="bp-screen-reader-text">
+                <?php
+                        /* translators: accessibility text */
+                        esc_html_e( 'Members', 'buddypress' );
+                ?>
+        </h2>
 
         <div id="members-group-list" class="group_members dir-list">
@@ -4728 +4770 @@
         ?>
         <li id="group_members-order-select" class="last filter">
-                <label for="group_members-order-by"><?php _e( 'Order By:', 'buddypress' ); ?></label>
+                <label for="group_members-order-by"><?php esc_html_e( 'Order By:', 'buddypress' ); ?></label>
                 <select id="group_members-order-by">
-                        <option value="last_joined"><?php _e( 'Newest', 'buddypress' ); ?></option>
-                        <option value="first_joined"><?php _e( 'Oldest', 'buddypress' ); ?></option>
+                        <option value="last_joined"><?php esc_html_e( 'Newest', 'buddypress' ); ?></option>
+                        <option value="first_joined"><?php esc_html_e( 'Oldest', 'buddypress' ); ?></option>
 
                         <?php if ( bp_is_active( 'activity' ) ) : ?>
-                                <option value="group_activity"><?php _e( 'Group Activity', 'buddypress' ); ?></option>
+                                <option value="group_activity"><?php esc_html_e( 'Group Activity', 'buddypress' ); ?></option>
                         <?php endif; ?>
 
-                        <option value="alphabetical"><?php _e( 'Alphabetical', 'buddypress' ); ?></option>
+                        <option value="alphabetical"><?php esc_html_e( 'Alphabetical', 'buddypress' ); ?></option>
 
                         <?php
@@ -4832 +4874 @@
                 }
 
-
+                // phpcs:ignore WordPress.Security.EscapeOutput
                 printf( '<li%1$s>%2$s</li>', $current_class, $step_name );
                 $counter++;
@@ -4847 +4889 @@
 
 /**
+ * Output the group creation step's title.
+ *
  * @since 1.0.0
  */
@@ -4852 +4896 @@
         $bp = buddypress();
 
-        /**
-         * Filters the group creation stage title.
-         *
-         * @since 1.1.0
-         *
-         * @param string $value HTML markup for the group creation stage title.
-         */
-        echo apply_filters( 'bp_group_creation_stage_title', '<span>&mdash; ' . $bp->groups->group_creation_steps[bp_get_groups_current_create_step()]['name'] . '</span>' );
-}
-
-/**
+        // phpcs:ignore WordPress.Security.EscapeOutput
+        echo apply_filters(
+                /**
+                 * Filters the group creation stage title.
+                 *
+                 * @since 1.1.0
+                 *
+                 * @param string $value HTML markup for the group creation stage title.
+                 */
+                'bp_group_creation_stage_title',
+                '<span>&mdash; ' . esc_html( $bp->groups->group_creation_steps[bp_get_groups_current_create_step()]['name'] ) . '</span>'
+        );
+}
+
+/**
+ * Output the group's creation form action URL.
+ *
  * @since 1.1.0
  */
 function bp_group_creation_form_action() {
-        echo bp_get_group_creation_form_action();
-}
-
-/**
+        echo esc_url( bp_get_group_creation_form_action() );
+}
+
+/**
+ * Get the group's creation form action URL.
+ *
  * @since 1.1.0
  *
- * @return mixed|void
+ * @return string The group's creation form action URL.
  */
         function bp_get_group_creation_form_action() {
@@ -4900 +4952 @@
 
 /**
+ * Check the requested creation step is the current one.
+ *
  * @since 1.1.0
  *
- * @param string $step_slug
+ * @param string $step_slug The group creation step's slug.
  *
  * @return bool
@@ -4917 +4971 @@
         // If this the first step, we can just accept and return true.
         $keys = array_keys( $bp->groups->group_creation_steps );
-        if ( !bp_action_variable( 1 ) && array_shift( $keys ) == $step_slug ) {
+        if ( ! bp_action_variable( 1 ) && array_shift( $keys ) == $step_slug ) {
                 return true;
         }
@@ -4923 +4977 @@
         // Before allowing a user to see a group creation step we must make sure
         // previous steps are completed.
-        if ( !bp_is_first_group_creation_step() ) {
-                if ( !bp_are_previous_group_creation_steps_complete( $step_slug ) ) {
+        if ( ! bp_is_first_group_creation_step() ) {
+                if ( ! bp_are_previous_group_creation_steps_complete( $step_slug ) ) {
                         return false;
                 }
@@ -4938 +4992 @@
 
 /**
+ * Check the requested creation step is completed.
+ *
  * @since 1.1.0
  *
- * @param array $step_slugs
+ * @param array $step_slugs The list of group creation step slugs.
  *
  * @return bool
@@ -4947 +5003 @@
         $bp = buddypress();
 
-        if ( !isset( $bp->groups->completed_create_steps ) ) {
+        if ( ! isset( $bp->groups->completed_create_steps ) ) {
                 return false;
         }
@@ -4955 +5011 @@
 
                 foreach ( (array) $step_slugs as $step_slug ) {
-                        if ( !in_array( $step_slug, $bp->groups->completed_create_steps ) ) {
+                        if ( ! in_array( $step_slug, $bp->groups->completed_create_steps ) ) {
                                 $found = false;
                         }
@@ -4969 +5025 @@
 
 /**
+ * Check previous steps compared to the requested creation step are completed.
+ *
  * @since 1.1.0
  *
- * @param string $step_slug
+ * @param string $step_slug The group creation step's slug.
  *
  * @return bool
@@ -5001 +5059 @@
 
 /**
+ * Outputs the new group ID.
+ *
  * @since 1.1.0
  */
 function bp_new_group_id() {
-        echo bp_get_new_group_id();
+        echo intval( bp_get_new_group_id() );
 }
 
@@ -5029 +5089 @@
 
 /**
+ * Output the new group's name.
+ *
  * @since 1.1.0
  */
 function bp_new_group_name() {
+        // Escaping is made in `bp-groups/bp-groups-filters.php`.
+        // phpcs:ignore WordPress.Security.EscapeOutput
         echo bp_get_new_group_name();
 }
 
         /**
+         * Get the new group's name.
+         *
          * @since 1.1.0
          *
-         * @return mixed|void
+         * @return string The new group's name.
          */
         function bp_get_new_group_name() {
@@ -5057 +5123 @@
 
 /**
+ * Output the new group's description.
+ *
  * @since 1.1.0
  */
 function bp_new_group_description() {
+        // Escaping is made in `bp-groups/bp-groups-filters.php`.
+        // phpcs:ignore WordPress.Security.EscapeOutput
         echo bp_get_new_group_description();
 }
 
         /**
+         * Get the new group's description.
+         *
          * @since 1.1.0
          *
-         * @return mixed|void
+         * @return string The new group's description.
          */
         function bp_get_new_group_description() {
@@ -5085 +5157 @@
 
 /**
+ * Outputs 1 if the new group has a forum.
+ *
+ * @todo deprecate
  * @since 1.1.0
  */
 function bp_new_group_enable_forum() {
-        echo bp_get_new_group_enable_forum();
-}
-
-        /**
+        echo intval( bp_get_new_group_enable_forum() );
+}
+
+        /**
+         * Checks whether a new group has a forum or not.
+         *
+         * @todo deprecate
          * @since 1.1.0
          *
-         * @return int
+         * @return int 1 if the new group has a forum. O otherwise.
          */
         function bp_get_new_group_enable_forum() {
@@ -5113 +5191 @@
 
 /**
+ * Outputs the new group's status.
+ *
  * @since 1.1.0
  */
 function bp_new_group_status() {
-        echo bp_get_new_group_status();
-}
-
-        /**
+        echo esc_html( bp_get_new_group_status() );
+}
+
+        /**
+         * Gets the new group's status.
+         *
          * @since 1.1.0
          *
-         * @return mixed|void
+         * @return string The new group's status.
          */
         function bp_get_new_group_status() {
@@ -5150 +5232 @@
  */
 function bp_new_group_avatar( $args = '' ) {
+        // phpcs:ignore WordPress.Security.EscapeOutput
         echo bp_get_new_group_avatar( $args );
 }
@@ -5265 +5348 @@
  */
 function bp_groups_current_create_step() {
-        echo bp_get_groups_current_create_step();
+        echo esc_html( bp_get_groups_current_create_step() );
 }
         /**
@@ -5374 +5457 @@
  */
 function bp_new_group_invite_friend_list( $args = array() ) {
+        // phpcs:ignore WordPress.Security.EscapeOutput
         echo bp_get_new_group_invite_friend_list( $args );
 }
@@ -5461 +5545 @@
 
 /**
+ * Outputs a search form for the Groups directory.
+ *
  * @since 1.0.0
  */
@@ -5475 +5561 @@
         $search_form_html = '<form action="" method="get" id="search-groups-form">
                 <label for="groups_search"><input type="text" name="' . esc_attr( $query_arg ) . '" id="groups_search" placeholder="'. esc_attr( $search_value ) .'" /></label>
-                <input type="submit" id="groups_search_submit" name="groups_search_submit" value="'. __( 'Search', 'buddypress' ) .'" />
+                <input type="submit" id="groups_search_submit" name="groups_search_submit" value="'. esc_html__( 'Search', 'buddypress' ) .'" />
         </form>';
 
-        /**
-         * Filters the HTML markup for the groups search form.
-         *
-         * @since 1.9.0
-         *
-         * @param string $search_form_html HTML markup for the search form.
-         */
-        echo apply_filters( 'bp_directory_groups_search_form', $search_form_html );
-
+        // phpcs:ignore WordPress.Security.EscapeOutput
+        echo apply_filters(
+                /**
+                 * Filters the HTML markup for the groups search form.
+                 *
+                 * @since 1.9.0
+                 *
+                 * @param string $search_form_html HTML markup for the search form.
+                 */
+                'bp_directory_groups_search_form',
+                $search_form_html
+        );
 }
 
@@ -5495 +5584 @@
  */
 function bp_current_group_directory_type_message() {
-        echo bp_get_current_group_directory_type_message();
+        echo wp_kses( bp_get_current_group_directory_type_message(), array( 'strong' =>  true ) );
 }
         /**
@@ -5538 +5627 @@
  */
 function bp_group_current_admin_tab() {
-        echo bp_get_group_current_admin_tab();
+        echo esc_html( bp_get_group_current_admin_tab() );
 }
         /**
@@ -5575 +5664 @@
  */
 function bp_group_current_avatar( $type = 'thumb' ) {
+        // phpcs:ignore WordPress.Security.EscapeOutput
         echo bp_get_group_current_avatar( $type );
 }
@@ -5640 +5730 @@
 
 /**
+ * Outputs the URL to delete a group avatar.
+ *
  * @since 1.1.0
  */
 function bp_group_avatar_delete_link() {
-        echo bp_get_group_avatar_delete_link();
-}
-
-        /**
+        echo esc_url( bp_get_group_avatar_delete_link() );
+}
+
+        /**
+         * Gets the URL to delete a group avatar.
+         *
          * @since 1.1.0
          *
-         * @return mixed|void
+         * @return string The URL to delete a group avatar.
          */
         function bp_get_group_avatar_delete_link() {
@@ -5672 +5766 @@
 
 /**
+ * Fires a hook to let 3rd party plugins add some html content to group's home page.
+ *
  * @since 1.0.0
  */
@@ -5679 +5775 @@
 
 /**
+ * Fires a hook to let 3rd party plugins add custom group admin tabs.
+ *
+ * @todo deprecate.
  * @since 1.0.0
  */
@@ -5686 +5785 @@
 
 /**
+ * Fires a hook to let 3rd party plugins add custom group editable fields.
+ *
+ * @todo deprecate.
  * @since 1.0.0
  */
@@ -5693 +5795 @@
 
 /**
+ * Fires a hook to let 3rd party plugins add custom group fields.
+ *
+ * @todo deprecate.
  * @since 1.0.0
  */
@@ -5769 +5874 @@
         global $requests_template;
 
-        /**
-         * Filters the requesting user's avatar thumbnail.
-         *
-         * @since 1.0.0
-         *
-         * @param string $value HTML markup for the user's avatar thumbnail.
-         */
+        // phpcs:ignore WordPress.Security.EscapeOutput
         echo apply_filters(
+                /**
+                 * Filters the requesting user's avatar thumbnail.
+                 *
+                 * @since 1.0.0
+                 *
+                 * @param string $value HTML markup for the user's avatar thumbnail.
+                 */
                 'bp_group_request_user_avatar_thumb',
                 bp_core_fetch_avatar(
@@ -5790 +5896 @@
 
 /**
+ * Outputs the URL to reject a group membership request.
+ *
  * @since 1.0.0
  */
 function bp_group_request_reject_link() {
-        echo bp_get_group_request_reject_link();
-}
-
-        /**
+        echo esc_url( bp_get_group_request_reject_link() );
+}
+
+        /**
+         * Gets the URL to reject a group membership request.
+         *
          * @since 1.2.6
          *
-         * @return mixed|void
+         * @return string The URL to reject a group membership request.
          */
         function bp_get_group_request_reject_link() {
@@ -5827 +5937 @@
 
 /**
+ * Outputs the URL to accept a group membership request.
+ *
  * @since 1.0.0
  */
 function bp_group_request_accept_link() {
-        echo bp_get_group_request_accept_link();
-}
-
-        /**
+        echo esc_url( bp_get_group_request_accept_link() );
+}
+
+        /**
+         * Gets the URL to reject a group membership request.
+         *
          * @since 1.2.6
-         * @return mixed|void
+         *
+         * @return string The URL to reject a group membership request.
          */
         function bp_get_group_request_accept_link() {
@@ -5863 +5978 @@
 
 /**
+ * Outputs the link to reach the requesting user's profile page.
+ *
  * @since 1.0.0
  */
 function bp_group_request_user_link() {
+        // phpcs:ignore WordPress.Security.EscapeOutput
         echo bp_get_group_request_user_link();
 }
 
         /**
+         * Gets the link to reach the requesting user's profile page.
+         *
          * @since 1.2.6
          *
-         * @return mixed|void
+         * @return string HTML output.
          */
         function bp_get_group_request_user_link() {
@@ -5888 +6008 @@
 
 /**
+ * Outputs the elapsed time since the group membership request was made.
+ *
  * @since 1.0.0
  */
@@ -5893 +6015 @@
         global $requests_template;
 
-        /**
-         * Filters the formatted time since membership was requested.
-         *
-         * @since 1.0.0
-         *
-         * @param string $value Formatted time since membership was requested.
-         */
-        echo apply_filters(
-                'bp_group_request_time_since_requested',
-                /* translators: %s: human time diff */
-                sprintf( __( 'requested %s', 'buddypress' ), bp_core_time_since( $requests_template->request->date_modified ) )
+        // phpcs:ignore WordPress.Security.EscapeOutput
+        echo esc_html(
+                /**
+                 * Filters the formatted time since membership was requested.
+                 *
+                 * @since 1.0.0
+                 *
+                 * @param string $value Formatted time since membership was requested.
+                 */
+                apply_filters(
+                        'bp_group_request_time_since_requested',
+                        /* translators: %s: human time diff */
+                        sprintf( __( 'requested %s', 'buddypress' ), bp_core_time_since( $requests_template->request->date_modified ) )
+                )
         );
 }
 
 /**
+ * Outputs the comment a member sent with their membership request.
+ *
  * @since 1.0.0
  */
@@ -5920 +6047 @@
          * @param string $value Membership request comment left by user.
          */
-        echo apply_filters( 'bp_group_request_comment', strip_tags( stripslashes( $requests_template->request->comments ) ) );
+        echo esc_html( apply_filters( 'bp_group_request_comment', stripslashes( $requests_template->request->comments ) ) );
 }
 
@@ -5929 +6056 @@
  */
 function bp_group_requests_pagination_links() {
+        // Escaping is done in WordPress's `paginate_links()` function.
+        // phpcs:ignore WordPress.Security.EscapeOutput
         echo bp_get_group_requests_pagination_links();
 }
@@ -5957 +6086 @@
  */
 function bp_group_requests_pagination_count() {
-        echo bp_get_group_requests_pagination_count();
+        echo esc_html( bp_get_group_requests_pagination_count() );
 }
         /**
@@ -6074 +6203 @@
  */
 function bp_group_invite_item_id() {
-        echo bp_get_group_invite_item_id();
+        echo esc_attr( bp_get_group_invite_item_id() );
 }
 
@@ -6099 +6228 @@
  */
 function bp_group_invite_user_avatar() {
+        // phpcs:ignore WordPress.Security.EscapeOutput
         echo bp_get_group_invite_user_avatar();
 }
@@ -6124 +6254 @@
  */
 function bp_group_invite_user_link() {
+        // phpcs:ignore WordPress.Security.EscapeOutput
         echo bp_get_group_invite_user_link();
 }
@@ -6149 +6280 @@
  */
 function bp_group_invite_user_last_active() {
-        echo bp_get_group_invite_user_last_active();
+        echo esc_html( bp_get_group_invite_user_last_active() );
 }
 
@@ -6174 +6305 @@
  */
 function bp_group_invite_user_remove_invite_url() {
-        echo bp_get_group_invite_user_remove_invite_url();
+        echo esc_url( bp_get_group_invite_user_remove_invite_url() );
 }
 
@@ -6209 +6340 @@
  */
 function bp_group_invite_pagination_links() {
+        // Escaping is done in WordPress's `paginate_links()` function.
+        // phpcs:ignore WordPress.Security.EscapeOutput
         echo bp_get_group_invite_pagination_links();
 }
@@ -6238 +6371 @@
  */
 function bp_group_invite_pagination_count() {
-        echo bp_get_group_invite_pagination_count();
+        echo esc_html( bp_get_group_invite_pagination_count() );
 }
         /**
@@ -6278 +6411 @@
         if ( ! bp_is_active( 'groups' ) || ! bp_is_active( 'activity' ) || ! bp_is_group() ) {
                 return;
-        } ?>
-
-        <link rel="alternate" type="application/rss+xml" title="<?php bloginfo( 'name' ) ?> | <?php echo esc_attr( bp_get_current_group_name() ); ?> | <?php _e( 'Group Activity RSS Feed', 'buddypress' ) ?>" href="<?php bp_group_activity_feed_link() ?>" />
-
-<?php
+        }
+        ?>
+        <link rel="alternate" type="application/rss+xml" title="<?php bloginfo( 'name' ) ?> | <?php echo esc_attr( bp_get_current_group_name() ); ?> | <?php esc_html_e( 'Group Activity RSS Feed', 'buddypress' ) ?>" href="<?php bp_group_activity_feed_link(); ?>" />
+        <?php
 }
 add_action( 'bp_head', 'bp_groups_activity_feed' );
@@ -6292 +6424 @@
  */
 function bp_group_activity_feed_link() {
-        echo bp_get_group_activity_feed_link();
+        echo esc_url( bp_get_group_activity_feed_link() );
 }
         /**
@@ -6325 +6457 @@
  */
 function bp_current_group_id() {
-        echo bp_get_current_group_id();
+        echo intval( bp_get_current_group_id() );
 }
         /**
@@ -6355 +6487 @@
  */
 function bp_current_group_slug() {
-        echo bp_get_current_group_slug();
+        echo esc_url( bp_get_current_group_slug() );
 }
         /**
@@ -6385 +6517 @@
  */
 function bp_current_group_name() {
+        // Escaping is made in `bp-groups/bp-groups-filters.php`.
+        // phpcs:ignore WordPress.Security.EscapeOutput
         echo bp_get_current_group_name();
 }
@@ -6415 +6549 @@
  */
 function bp_current_group_description() {
+        // Escaping is made in `bp-groups/bp-groups-filters.php`.
+        // phpcs:ignore WordPress.Security.EscapeOutput
         echo bp_get_current_group_description();
 }
@@ -6461 +6597 @@
  */
 function bp_groups_action_link( $action = '', $query_args = '', $nonce = false ) {
-        echo bp_get_groups_action_link( $action, $query_args, $nonce );
+        echo esc_url( bp_get_groups_action_link( $action, $query_args, $nonce ) );
 }
         /**
@@ -6531 +6667 @@
  */
 function bp_groups_profile_stats( $args = '' ) {
-        echo bp_groups_get_profile_stats( $args );
+        echo wp_kses(
+                bp_groups_get_profile_stats( $args ),
+                array(
+                        'li'     => array( 'class' => true ),
+                        'div'    => array( 'class' => true ),
+                        'strong' => true,
+                        'a'      => array( 'href' => true ),
+                )
+        );
 }
 add_action( 'bp_members_admin_user_stats', 'bp_groups_profile_stats', 8, 1 );

trunk/src/bp-groups/bp-groups-widgets.php

@@ -12 +12 @@
 defined( 'ABSPATH' ) || exit;
 
-_deprecated_file( basename( __FILE__ ), '12.0.0', '', __( 'BuddyPress does not include Legacy Widgets anymore, you can restore it using the BP Classic plugin', 'buddypress' ) );
+_deprecated_file( basename( __FILE__ ), '12.0.0', '', esc_html__( 'BuddyPress does not include Legacy Widgets anymore, you can restore it using the BP Classic plugin', 'buddypress' ) );

trunk/src/bp-groups/classes/class-bp-group-extension.php

@@ -1330 +1330 @@
                 ob_end_clean();
 
+                // phpcs:ignore WordPress.Security.EscapeOutput
                 echo $this->maybe_add_submit_button( $screen );
 
@@ -1426 +1427 @@
                 return $screen . sprintf(
                         '<div id="%s"><input type="submit" name="save" value="%s" id="%s"></div>',
-                        'bp-group-edit-' . $this->slug . '-submit-wrapper',
-                        $this->screens['edit']['submit_text'],
-                        'bp-group-edit-' . $this->slug . '-submit'
+                        'bp-group-edit-' . esc_attr( $this->slug ) . '-submit-wrapper',
+                        esc_attr( $this->screens['edit']['submit_text'] ),
+                        'bp-group-edit-' . esc_attr( $this->slug ) . '-submit'
                 );
         }

trunk/src/bp-groups/classes/class-bp-groups-group-members-template.php

@@ -122 +122 @@
                 if ( ! is_array( $args ) || count( $function_args ) > 1 ) {
                         /* translators: 1: the name of the method. 2: the name of the file. */
-                        _deprecated_argument( __METHOD__, '2.0.0', sprintf( __( 'Arguments passed to %1$s should be in an associative array. See the inline documentation at %2$s for more details.', 'buddypress' ), __METHOD__, __FILE__ ) );
+                        _deprecated_argument( __METHOD__, '2.0.0', sprintf( esc_html__( 'Arguments passed to %1$s should be in an associative array. See the inline documentation at %2$s for more details.', 'buddypress' ), __METHOD__, __FILE__ ) );
 
                         $old_args_keys = array(

trunk/src/bp-groups/classes/class-bp-groups-invite-template.php

@@ -100 +100 @@
                 if ( ! is_array( $args ) || count( $function_args ) > 1 ) {
                         /* translators: 1: the name of the method. 2: the name of the file. */
-                        _deprecated_argument( __METHOD__, '2.0.0', sprintf( __( 'Arguments passed to %1$s should be in an associative array. See the inline documentation at %2$s for more details.', 'buddypress' ), __METHOD__, __FILE__ ) );
+                        _deprecated_argument( __METHOD__, '2.0.0', sprintf( esc_html__( 'Arguments passed to %1$s should be in an associative array. See the inline documentation at %2$s for more details.', 'buddypress' ), __METHOD__, __FILE__ ) );
 
                         $old_args_keys = array(

trunk/src/bp-groups/classes/class-bp-groups-list-table.php

@@ -251 +251 @@
          */
         public function no_items() {
-                _e( 'No groups found.', 'buddypress' );
+                esc_html_e( 'No groups found.', 'buddypress' );
         }
 
@@ -262 +262 @@
                 $this->display_tablenav( 'top' ); ?>
 
-                <h2 class="screen-reader-text"><?php
-                        /* translators: accessibility text */
-                        _e( 'Groups list', 'buddypress' );
-                ?></h2>
-
-                <table class="wp-list-table <?php echo implode( ' ', $this->get_table_classes() ); ?>" cellspacing="0">
+                <h2 class="screen-reader-text">
+                        <?php
+                                /* translators: accessibility text */
+                                esc_html_e( 'Groups list', 'buddypress' );
+                        ?>
+                </h2>
+
+                <table class="wp-list-table <?php echo esc_attr( implode( ' ', $this->get_table_classes() ) ); ?>" cellspacing="0">
                         <thead>
                                 <tr>
@@ -334 +336 @@
                  * @param string $value       ID of the current group being displayed.
                  */
-                $row_classes = apply_filters( 'bp_groups_admin_row_class', $row_classes, $item['id'] );
+                $row_classes = array_map( 'sanitize_html_class', apply_filters( 'bp_groups_admin_row_class', $row_classes, $item['id'] ) );
                 $row_class = ' class="' . implode( ' ', $row_classes ) . '"';
 
+                // phpcs:ignore WordPress.Security.EscapeOutput
                 echo '<tr' . $row_class . ' id="group-' . esc_attr( $item['id'] ) . '" data-parent_id="' . esc_attr( $item['id'] ) . '" data-root_id="' . esc_attr( $item['id'] ) . '">';
+
+                // Escapes are made into `self::single_row_columns()`.
+                // phpcs:ignore WordPress.Security.EscapeOutput
                 echo $this->single_row_columns( $item );
                 echo '</tr>';
@@ -352 +358 @@
                 $url_base = bp_get_admin_url( 'admin.php?page=bp-groups' ); ?>
 
-                <h2 class="screen-reader-text"><?php
-                        /* translators: accessibility text */
-                        _e( 'Filter groups list', 'buddypress' );
-                ?></h2>
+                <h2 class="screen-reader-text">
+                        <?php
+                                /* translators: accessibility text */
+                                esc_html_e( 'Filter groups list', 'buddypress' );
+                        ?>
+                </h2>
 
                 <ul class="subsubsub">
@@ -365 +373 @@
                                                 sprintf(
                                                         '<span class="count">(%s)</span>',
-                                                        number_format_i18n( $this->group_counts['all'] )
+                                                        esc_html( number_format_i18n( $this->group_counts['all'] ) )
                                                 )
                                         ); ?>
@@ -374 +382 @@
                                         <?php printf(
                                                 /* translators: %s is the placeholder for the count html `<span class="count"/>` */
-                                                _n( 'Public %s', 'Public %s', $this->group_counts['public'], 'buddypress' ),
+                                                esc_html( _n( 'Public %s', 'Public %s', $this->group_counts['public'], 'buddypress' ) ),
                                                 sprintf(
                                                         '<span class="count">(%s)</span>',
-                                                        number_format_i18n( $this->group_counts['public'] )
+                                                        esc_html( number_format_i18n( $this->group_counts['public'] ) )
                                                 )
                                         ); ?>
@@ -386 +394 @@
                                         <?php printf(
                                                 /* translators: %s is the placeholder for the count html `<span class="count"/>` */
-                                                _n( 'Private %s', 'Private %s', $this->group_counts['private'], 'buddypress' ),
+                                                esc_html( _n( 'Private %s', 'Private %s', $this->group_counts['private'], 'buddypress' ) ),
                                                 sprintf(
                                                         '<span class="count">(%s)</span>',
-                                                        number_format_i18n( $this->group_counts['private'] )
+                                                        esc_html( number_format_i18n( $this->group_counts['private'] ) )
                                                 )
                                         ); ?>
@@ -398 +406 @@
                                         <?php printf(
                                                 /* translators: %s is the placeholder for the count html tag */
-                                                _n( 'Hidden %s', 'Hidden %s', $this->group_counts['hidden'], 'buddypress' ),
+                                                esc_html( _n( 'Hidden %s', 'Hidden %s', $this->group_counts['hidden'], 'buddypress' ) ),
                                                 sprintf(
                                                         '<span class="count">(%s)</span>',
-                                                        number_format_i18n( $this->group_counts['hidden'] )
+                                                        esc_html( number_format_i18n( $this->group_counts['hidden'] ) )
                                                 )
                                         ); ?>
@@ -546 +554 @@
         public function column_cb( $item = array() ) {
                 /* translators: accessibility text */
-                printf( '<label class="screen-reader-text" for="gid-%1$d">' . __( 'Select group %1$d', 'buddypress' ) . '</label><input type="checkbox" name="gid[]" value="%1$d" id="gid-%1$d" />', $item['id'] );
+                printf( '<label class="screen-reader-text" for="gid-%1$d">' . esc_html__( 'Select group %1$d', 'buddypress' ) . '</label><input type="checkbox" name="gid[]" value="%1$d" id="gid-%1$d" />', intval( $item['id'] ) );
         }
 
@@ -639 +647 @@
                 $content = sprintf( '<strong><a href="%s">%s</a></strong>', esc_url( $edit_url ), $group_name );
 
-                echo $avatar . ' ' . $content . ' ' . $this->row_actions( $actions );
+                echo wp_kses(
+                        $avatar,
+                        array(
+                                'img' => array(
+                                        'alt'    => true,
+                                        'src'    => true,
+                                        'srcset' => true,
+                                        'class'  => true,
+                                        'height' => true,
+                                        'width'  => true,
+                                )
+                        )
+                );
+                // phpcs:ignore WordPress.Security.EscapeOutput
+                echo ' ' . $content . ' ' . $this->row_actions( $actions );
         }
 
@@ -651 +673 @@
         public function column_description( $item = array() ) {
 
-                /**
-                 * Filters the markup for the Description column.
-                 *
-                 * @since 1.0.0
-                 *
-                 * @param string $value Markup for the Description column.
-                 * @param array  $item  The current group item in the loop.
-                 */
-                echo apply_filters_ref_array( 'bp_get_group_description', array( $item['description'], $item ) );
+                // phpcs:ignore WordPress.Security.EscapeOutput
+                echo apply_filters_ref_array(
+                        /**
+                         * Filters the markup for the Description column.
+                         *
+                         * @since 1.0.0
+                         *
+                         * @param string $value Markup for the Description column.
+                         * @param array  $item  The current group item in the loop.
+                         */
+                        'bp_get_group_description',
+                        array( $item['description'], $item )
+                );
         }
 
@@ -695 +721 @@
                  * @parma array  $item        The current group item in the loop.
                  */
-                echo apply_filters_ref_array( 'bp_groups_admin_get_group_status', array( $status_desc, $item ) );
+                echo esc_html( apply_filters_ref_array( 'bp_groups_admin_get_group_status', array( $status_desc, $item ) ) );
         }
 
@@ -715 +741 @@
                  *
                  * @param int   $count Markup for the number of Members column.
-                 * @parma array $item  The current group item in the loop.
-                 */
-                echo apply_filters_ref_array( 'bp_groups_admin_get_group_member_count', array( (int) $count, $item ) );
+                 * @param array $item  The current group item in the loop.
+                 */
+                echo intval( apply_filters_ref_array( 'bp_groups_admin_get_group_member_count', array( $count, $item ) ) );
         }
 
@@ -736 +762 @@
                  *
                  * @param string $last_active Markup for the Last Active column.
-                 * @parma array  $item        The current group item in the loop.
-                 */
-                echo apply_filters_ref_array( 'bp_groups_admin_get_group_last_active', array( $last_active, $item ) );
+                 * @param array  $item        The current group item in the loop.
+                 */
+                echo esc_html( apply_filters_ref_array( 'bp_groups_admin_get_group_last_active', array( $last_active, $item ) ) );
         }
 
@@ -805 +831 @@
                 remove_filter( 'bp_get_group_type_directory_permalink', array( $this, 'group_type_permalink_use_admin_filter' ), 10 );
 
-                /**
-                 * Filters the markup for the Group Type column.
-                 *
-                 * @since 2.7.0
-                 *
-                 * @param string $retval Markup for the Group Type column.
-                 * @parma array  $item   The current group item in the loop.
-                 */
-                echo apply_filters_ref_array( 'bp_groups_admin_get_group_type_column', array( $retval, $item ) );
+                // phpcs:ignore WordPress.Security.EscapeOutput
+                echo apply_filters_ref_array(
+                        /**
+                         * Filters the markup for the Group Type column.
+                         *
+                         * @since 2.7.0
+                         *
+                         * @param string $retval Markup for the Group Type column.
+                         * @parma array  $item   The current group item in the loop.
+                         */
+                        'bp_groups_admin_get_group_type_column',
+                        array( $retval, $item )
+                );
         }
 
@@ -850 +880 @@
                 ?>
                 <div class="alignleft actions">
-                        <label class="screen-reader-text" for="<?php echo $id_name; ?>"><?php _e( 'Change group type to&hellip;', 'buddypress' ) ?></label>
-                        <select name="<?php echo $id_name; ?>" id="<?php echo $id_name; ?>" style="display:inline-block;float:none;">
-                                <option value=""><?php _e( 'Change group type to&hellip;', 'buddypress' ) ?></option>
+                        <label class="screen-reader-text" for="<?php echo esc_attr( $id_name ); ?>"><?php esc_html_e( 'Change group type to&hellip;', 'buddypress' ) ?></label>
+                        <select name="<?php echo esc_attr( $id_name ); ?>" id="<?php echo esc_attr( $id_name ); ?>" style="display:inline-block;float:none;">
+                                <option value=""><?php esc_html_e( 'Change group type to&hellip;', 'buddypress' ) ?></option>
 
                                 <?php foreach( $types as $type ) : ?>
@@ -860 +890 @@
                                 <?php endforeach; ?>
 
-                                <option value="remove_group_type"><?php _e( 'No Group Type', 'buddypress' ) ?></option>
+                                <option value="remove_group_type"><?php esc_html_e( 'No Group Type', 'buddypress' ) ?></option>
 
                         </select>

trunk/src/bp-groups/classes/class-bp-groups-membership-requests-template.php

@@ -99 +99 @@
                 if ( ! is_array( $args ) || count( $function_args ) > 1 ) {
                         /* translators: 1: the name of the method. 2: the name of the file. */
-                        _deprecated_argument( __METHOD__, '2.0.0', sprintf( __( 'Arguments passed to %1$s should be in an associative array. See the inline documentation at %2$s for more details.', 'buddypress' ), __METHOD__, __FILE__ ) );
+                        _deprecated_argument( __METHOD__, '2.0.0', sprintf( esc_html__( 'Arguments passed to %1$s should be in an associative array. See the inline documentation at %2$s for more details.', 'buddypress' ), __METHOD__, __FILE__ ) );
 
                         $old_args_keys = array(

trunk/src/bp-groups/classes/class-bp-groups-template.php

@@ -139 +139 @@
                 // Backward compatibility with old method of passing arguments.
                 if ( ! is_array( $args[0] ) || count( $args ) > 1 ) {
-                        _deprecated_argument( __METHOD__, '1.7', sprintf( __( 'Arguments passed to %1$s should be in an associative array. See the inline documentation at %2$s for more details.', 'buddypress' ), __METHOD__, __FILE__ ) );
+                        _deprecated_argument( __METHOD__, '1.7', sprintf( esc_html__( 'Arguments passed to %1$s should be in an associative array. See the inline documentation at %2$s for more details.', 'buddypress' ), __METHOD__, __FILE__ ) );
 
                         $old_args_keys = array(

trunk/src/bp-groups/classes/class-bp-groups-widget.php

@@ -12 +12 @@
 defined( 'ABSPATH' ) || exit;
 
-_deprecated_file( basename( __FILE__ ), '12.0.0', '', __( 'BuddyPress does not include Legacy Widgets anymore, you can restore it using the BP Classic plugin', 'buddypress' ) );
+_deprecated_file( basename( __FILE__ ), '12.0.0', '', esc_html__( 'BuddyPress does not include Legacy Widgets anymore, you can restore it using the BP Classic plugin', 'buddypress' ) );
 
 /**