Changeset 13810 for trunk/src/bp-messages/classes/class-bp-messages-notices-list-table.php

Timestamp:

04/27/2024 01:40:03 AM (9 months ago)

Author:

imath

Message:

Messages component: improve PHP code standards using WPCS

See #7228 (trunk)

File:

• trunk/src/bp-messages/classes/class-bp-messages-notices-list-table.php (modified) (4 diffs)

trunk/src/bp-messages/classes/class-bp-messages-notices-list-table.php

@@ -95 +95 @@
      */
     public function single_row( $item ) {
-        $class = '';
 
         if ( ! empty( $item->is_active ) ) {
-            $class = ' class="notice-active"';
+            echo '<tr class="notice-active">';
+        } else {
+            echo '<tr>';
         }
 
-        echo "<tr{$class}>";
         $this->single_row_columns( $item );
         echo '</tr>';
@@ -146 +146 @@
         }
 
-        echo '<strong>' . apply_filters( 'bp_get_message_notice_subject', $item->subject ) . '</strong> ' . $this->row_actions( $actions );
+        echo '<strong>' . esc_html( apply_filters( 'bp_get_message_notice_subject', $item->subject ) ) . '</strong> ';
+
+        // BuddyPress relies on WordPress's `WP_List_Table::row_actions()`.
+        // phpcs:ignore WordPress.Security.EscapeOutput
+        echo $this->row_actions( $actions );
     }
 
@@ -157 +161 @@
      */
     public function column_message( $item ) {
+        // Escaping is made in `bp-messages/bp-messages-filters.php`.
+        // phpcs:ignore WordPress.Security.EscapeOutput
         echo apply_filters( 'bp_get_message_notice_text', $item->message );
     }
@@ -168 +174 @@
      */
     public function column_date_sent( $item ) {
-        echo apply_filters( 'bp_get_message_notice_post_date', bp_format_time( strtotime( $item->date_sent ) ) );
+        echo esc_html( apply_filters( 'bp_get_message_notice_post_date', bp_format_time( strtotime( $item->date_sent ) ) ) );
     }
 }