Changeset 13816

Timestamp:

04/27/2024 05:51:41 PM (2 years ago)

Author:

imath

Message:

Activity component: improve PHP code standards using WPCS

See #7228 (trunk)

Location:

trunk/src

Files:

• bp-activity/bp-activity-admin.php (modified) (21 diffs)
• bp-activity/bp-activity-embeds.php (modified) (3 diffs)
• bp-activity/bp-activity-notifications.php (modified) (4 diffs)
• bp-activity/bp-activity-template.php (modified) (83 diffs)
• bp-activity/classes/class-bp-activity-feed.php (modified) (5 diffs)
• bp-activity/classes/class-bp-activity-list-table.php (modified) (20 diffs)
• bp-activity/classes/class-bp-activity-oembed-extension.php (modified) (2 diffs)
• bp-activity/classes/class-bp-activity-template.php (modified) (1 diff)
• bp-activity/classes/class-bp-akismet.php (modified) (2 diffs)
• bp-templates/bp-nouveau/buddypress/activity/widget.php (modified) (1 diff)

trunk/src/bp-activity/bp-activity-admin.php

@@ -15 +15 @@
 
 // Include WP's list table class.
-if ( !class_exists( 'WP_List_Table' ) ) require( ABSPATH . 'wp-admin/includes/class-wp-list-table.php' );
+if ( ! class_exists( 'WP_List_Table' ) ) require( ABSPATH . 'wp-admin/includes/class-wp-list-table.php' );
 
 // Per_page screen option. Has to be hooked in extremely early.
-if ( is_admin() && ! empty( $_REQUEST['page'] ) && 'bp-activity' == $_REQUEST['page'] )
+if ( is_admin() && ! empty( $_REQUEST['page'] ) && 'bp-activity' == $_REQUEST['page'] ) {
         add_filter( 'set-screen-option', 'bp_activity_admin_screen_options', 10, 3 );
+}
 
 /**
@@ -77 +78 @@
 
         // $parent_id is required.
-        if ( empty( $parent_id ) )
+        if ( empty( $parent_id ) ) {
                 die( '-1' );
+        }
 
         // If $root_id not set (e.g. for root items), use $parent_id.
-        if ( empty( $root_id ) )
+        if ( empty( $root_id ) ) {
                 $root_id = $parent_id;
+        }
 
         // Check that a reply has been entered.
-        if ( empty( $_REQUEST['content'] ) )
-                die( __( 'Error: Please type a reply.', 'buddypress' ) );
+        if ( empty( $_REQUEST['content'] ) ) {
+                die( esc_html__( 'Error: Please type a reply.', 'buddypress' ) );
+        }
 
         // Check parent activity exists.
         $parent_activity = new BP_Activity_Activity( $parent_id );
-        if ( empty( $parent_activity->component ) )
-                die( __( 'Error: The item you are trying to reply to cannot be found, or it has been deleted.', 'buddypress' ) );
+        if ( empty( $parent_activity->component ) ) {
+                die( esc_html__( 'Error: The item you are trying to reply to cannot be found, or it has been deleted.', 'buddypress' ) );
+        }
 
         // @todo: Check if user is allowed to create new activity items
         // if ( ! current_user_can( 'bp_new_activity' ) )
-        if ( ! bp_current_user_can( 'bp_moderate' ) )
+        if ( ! bp_current_user_can( 'bp_moderate' ) ) {
                 die( '-1' );
+        }
 
         // Add new activity comment.
@@ -589 +595 @@
 
                 // If an error occurred, pass back the activity ID that failed.
-                if ( $error )
+                if ( $error ) {
                         $redirect_to = add_query_arg( 'error', $error, $redirect_to );
-                else
+                } else {
                         $redirect_to = add_query_arg( 'updated', $activity->id, $redirect_to );
+                }
 
                 /**
@@ -689 +696 @@
                         printf(
                                 /* translators: 1: activity type. 2: activity author. 3: activity date and time. */
-                                __( '"%1$s" activity submitted by %2$s on %3$s', 'buddypress' ),
+                                esc_html__( '"%1$s" activity submitted by %2$s on %3$s', 'buddypress' ),
                                 esc_html( $activity_type ),
+                                // phpcs:ignore WordPress.Security.EscapeOutput
                                 bp_core_get_userlink( $activity->user_id ),
                                 sprintf(
                                         '<a href="%1$s">%2$s</a>',
                                         esc_url( bp_activity_get_permalink( $activity->id, $activity ) ),
-                                        date_i18n( bp_get_option( 'date_format' ), strtotime( $activity->date_recorded ) )
+                                        esc_html( date_i18n( bp_get_option( 'date_format' ), strtotime( $activity->date_recorded ) ) )
                                 )
                         );
@@ -761 +769 @@
                         <?php
                         /* translators: %s: the activity ID */
-                        printf( __( 'Editing Activity (ID #%s)', 'buddypress' ), number_format_i18n( (int) $_REQUEST['aid'] ) );
+                        printf( esc_html__( 'Editing Activity (ID #%s)', 'buddypress' ), esc_html( number_format_i18n( (int) $_REQUEST['aid'] ) ) );
                         ?>
                 </h1>
@@ -776 +784 @@
                                                         <div id="postdiv">
                                                                 <div id="bp_activity_action" class="activitybox">
-                                                                        <h2><?php _e( 'Action', 'buddypress' ); ?></h2>
+                                                                        <h2><?php esc_html_e( 'Action', 'buddypress' ); ?></h2>
                                                                         <div class="inside">
-                                                                                <label for="bp-activities-action" class="screen-reader-text"><?php
-                                                                                        /* translators: accessibility text */
-                                                                                        _e( 'Edit activity action', 'buddypress' );
-                                                                                ?></label>
+                                                                                <label for="bp-activities-action" class="screen-reader-text">
+                                                                                        <?php
+                                                                                                /* translators: accessibility text */
+                                                                                                esc_html_e( 'Edit activity action', 'buddypress' );
+                                                                                        ?>
+                                                                                </label>
                                                                                 <?php wp_editor( stripslashes( $activity->action ), 'bp-activities-action', array( 'media_buttons' => false, 'textarea_rows' => 7, 'teeny' => true, 'quicktags' => array( 'buttons' => 'strong,em,link,block,del,ins,img,code,spell,close' ) ) ); ?>
                                                                         </div>
@@ -787 +797 @@
 
                                                                 <div id="bp_activity_content" class="activitybox">
-                                                                        <h2><?php _e( 'Content', 'buddypress' ); ?></h2>
+                                                                        <h2><?php esc_html_e( 'Content', 'buddypress' ); ?></h2>
                                                                         <div class="inside">
-                                                                                <label for="bp-activities-content" class="screen-reader-text"><?php
-                                                                                        /* translators: accessibility text */
-                                                                                        _e( 'Edit activity content', 'buddypress' );
-                                                                                ?></label>
+                                                                                <label for="bp-activities-content" class="screen-reader-text">
+                                                                                        <?php
+                                                                                                /* translators: accessibility text */
+                                                                                                esc_html_e( 'Edit activity content', 'buddypress' );
+                                                                                        ?>
+                                                                                </label>
                                                                                 <?php wp_editor( stripslashes( $activity->content ), 'bp-activities-content', array( 'media_buttons' => false, 'teeny' => true, 'quicktags' => array( 'buttons' => 'strong,em,link,block,del,ins,img,code,spell,close' ) ) ); ?>
                                                                         </div>
@@ -820 +832 @@
                                 printf(
                                         '%1$s <a href="%2$s">%3$s</a>',
-                                        __( 'No activity found with this ID.', 'buddypress' ),
+                                        esc_html__( 'No activity found with this ID.', 'buddypress' ),
                                         esc_url( bp_get_admin_url( 'admin.php?page=bp-activity' ) ),
-                                        __( 'Go back and try again.', 'buddypress' )
+                                        esc_html__( 'Go back and try again.', 'buddypress' )
                                 );
                         ?></p>
@@ -852 +864 @@
                         <div id="minor-publishing-actions">
                                 <div id="preview-action">
-                                        <a class="button preview" href="<?php echo esc_attr( bp_activity_get_permalink( $item->id, $item ) ); ?>" target="_blank"><?php _e( 'View Activity', 'buddypress' ); ?></a>
+                                        <a class="button preview" href="<?php echo esc_url( bp_activity_get_permalink( $item->id, $item ) ); ?>" target="_blank"><?php esc_html_e( 'View Activity', 'buddypress' ); ?></a>
                                 </div>
 
@@ -860 +872 @@
                         <div id="misc-publishing-actions">
                                 <div class="misc-pub-section" id="comment-status-radio">
-                                        <label class="approved" for="activity-status-approved"><input type="radio" name="activity_status" id="activity-status-approved" value="ham" <?php checked( $item->is_spam, 0 ); ?>><?php _e( 'Approved', 'buddypress' ); ?></label><br />
-                                        <label class="spam" for="activity-status-spam"><input type="radio" name="activity_status" id="activity-status-spam" value="spam" <?php checked( $item->is_spam, 1 ); ?>><?php _e( 'Spam', 'buddypress' ); ?></label>
+                                        <label class="approved" for="activity-status-approved"><input type="radio" name="activity_status" id="activity-status-approved" value="ham" <?php checked( $item->is_spam, 0 ); ?>><?php esc_html_e( 'Approved', 'buddypress' ); ?></label><br />
+                                        <label class="spam" for="activity-status-spam"><input type="radio" name="activity_status" id="activity-status-spam" value="spam" <?php checked( $item->is_spam, 1 ); ?>><?php esc_html_e( 'Spam', 'buddypress' ); ?></label>
                                 </div>
 
@@ -873 +885 @@
                                                 <?php
                                                 /* translators: %s: the date the activity was submitted on */
-                                                printf( __( 'Submitted on: %s', 'buddypress' ), '<strong>' . $date . '</strong>' );
+                                                printf( esc_html__( 'Submitted on: %s', 'buddypress' ), '<strong>' . esc_html( $date ) . '</strong>' );
                                                 ?>
-                                        </span>&nbsp;<a href="#edit_timestamp" class="edit-timestamp hide-if-no-js" tabindex='4'><?php _e( 'Edit', 'buddypress' ); ?></a>
+                                        </span>&nbsp;<a href="#edit_timestamp" class="edit-timestamp hide-if-no-js" tabindex='4'><?php esc_html_e( 'Edit', 'buddypress' ); ?></a>
 
                                         <div id='timestampdiv' class='hide-if-js'>
@@ -912 +924 @@
 ?>
 
-        <label class="screen-reader-text" for="bp-activities-link"><?php
-                /* translators: accessibility text */
-                _e( 'Link', 'buddypress' );
-        ?></label>
+        <label class="screen-reader-text" for="bp-activities-link">
+                <?php
+                        /* translators: accessibility text */
+                        esc_html_e( 'Link', 'buddypress' );
+                ?>
+        </label>
         <input type="url" name="bp-activities-link" id="bp-activities-link" value="<?php echo esc_url( $item->primary_link ); ?>" aria-describedby="bp-activities-link-description" />
-        <p id="bp-activities-link-description"><?php _e( 'Activity generated by posts and comments uses the link field for a permalink back to the content item.', 'buddypress' ); ?></p>
+        <p id="bp-activities-link-description"><?php esc_html_e( 'Activity generated by posts and comments uses the link field for a permalink back to the content item.', 'buddypress' ); ?></p>
 
 <?php
@@ -932 +946 @@
 ?>
 
-        <label class="screen-reader-text" for="bp-activities-userid"><?php
-                /* translators: accessibility text */
-                _e( 'Author ID', 'buddypress' );
-        ?></label>
+        <label class="screen-reader-text" for="bp-activities-userid">
+                <?php
+                        /* translators: accessibility text */
+                        esc_html_e( 'Author ID', 'buddypress' );
+                ?>
+        </label>
         <input type="number" name="bp-activities-userid" id="bp-activities-userid" value="<?php echo esc_attr( $item->user_id ); ?>" min="1" />
 
@@ -1020 +1036 @@
                         sprintf(
                                 /* translators: %s: the name of the activity type */
-                                __( 'This activity item has a type (%s) that is not registered using bp_activity_set_action(), so no label is available.', 'buddypress' ),
-                                $selected
+                                esc_html__( 'This activity item has a type (%s) that is not registered using bp_activity_set_action(), so no label is available.', 'buddypress' ),
+                                esc_html( $selected )
                         ),
                         '2.0.0'
@@ -1031 +1047 @@
         ?>
 
-        <label for="bp-activities-type" class="screen-reader-text"><?php
-                /* translators: accessibility text */
-                esc_html_e( 'Select activity type', 'buddypress' );
-        ?></label>
+        <label for="bp-activities-type" class="screen-reader-text">
+                <?php
+                        /* translators: accessibility text */
+                        esc_html_e( 'Select activity type', 'buddypress' );
+                ?>
+        </label>
         <select name="bp-activities-type" id="bp-activities-type">
                 <?php foreach ( $actions as $k => $v ) : ?>
@@ -1054 +1072 @@
 ?>
 
-        <label for="bp-activities-primaryid"><?php _e( 'Primary Item ID', 'buddypress' ); ?></label>
+        <label for="bp-activities-primaryid"><?php esc_html_e( 'Primary Item ID', 'buddypress' ); ?></label>
         <input type="number" name="bp-activities-primaryid" id="bp-activities-primaryid" value="<?php echo esc_attr( $item->item_id ); ?>" min="0" />
         <br />
 
-        <label for="bp-activities-secondaryid"><?php _e( 'Secondary Item ID', 'buddypress' ); ?></label>
+        <label for="bp-activities-secondaryid"><?php esc_html_e( 'Secondary Item ID', 'buddypress' ); ?></label>
         <input type="number" name="bp-activities-secondaryid" id="bp-activities-secondaryid" value="<?php echo esc_attr( $item->secondary_item_id ); ?>" min="0" />
 
-        <p><?php _e( 'These identify the object that created this activity. For example, the fields could reference a pair of site and comment IDs.', 'buddypress' ); ?></p>
+        <p><?php esc_html_e( 'These identify the object that created this activity. For example, the fields could reference a pair of site and comment IDs.', 'buddypress' ); ?></p>
 
 <?php
@@ -1156 +1174 @@
                                 <?php
                                 /* translators: %s: the activity ID */
-                                printf( __( 'Activity related to ID #%s', 'buddypress' ), number_format_i18n( (int) $_REQUEST['aid'] ) );
+                                printf( esc_html__( 'Activity related to ID #%s', 'buddypress' ), esc_html( number_format_i18n( (int) $_REQUEST['aid'] ) ) );
                                 ?>
                         <?php else : ?>
-                                <?php _ex( 'Activity', 'Admin SWA page', 'buddypress' ); ?>
+                                <?php echo esc_html_x( 'Activity', 'Admin SWA page', 'buddypress' ); ?>
                         <?php endif; ?>
 
@@ -1166 +1184 @@
                                         <?php
                                         /* translators: %s: the activity search terms */
-                                        printf( __( 'Search results for &#8220;%s&#8221;', 'buddypress' ), wp_html_excerpt( esc_html( stripslashes( $_REQUEST['s'] ) ), 50 ) );
+                                        printf( esc_html__( 'Search results for &#8220;%s&#8221;', 'buddypress' ), esc_html( wp_html_excerpt( stripslashes( $_REQUEST['s'] ) ), 50 ) );
                                         ?>
                                 </span>
@@ -1176 +1194 @@
                 <?php // If the user has just made a change to an activity item, display the status messages. ?>
                 <?php if ( !empty( $messages ) ) : ?>
-                        <div id="moderated" class="<?php echo ( ! empty( $_REQUEST['error'] ) ) ? 'error' : 'updated'; ?> notice is-dismissible"><p><?php echo implode( "<br/>\n", $messages ); ?></p></div>
+                        <div id="moderated" class="<?php echo ( ! empty( $_REQUEST['error'] ) ) ? 'error' : 'updated'; ?> notice is-dismissible"><p><?php echo implode( "<br/>\n", array_map( 'esc_html', $messages ) ); ?></p></div>
                 <?php endif; ?>
 
@@ -1183 +1201 @@
 
                 <form id="bp-activities-form" action="" method="get">
-                        <?php $bp_activity_list_table->search_box( __( 'Search all Activity', 'buddypress' ), 'bp-activity' ); ?>
+                        <?php $bp_activity_list_table->search_box( esc_html__( 'Search all Activity', 'buddypress' ), 'bp-activity' ); ?>
                         <input type="hidden" name="page" value="<?php echo esc_attr( $plugin_page ); ?>" />
                         <?php $bp_activity_list_table->display(); ?>
@@ -1194 +1212 @@
                                         <form method="get" action="">
 
-                                                <h3 id="bp-replyhead"><?php _e( 'Reply to Activity', 'buddypress' ); ?></h3>
-                                                <label for="bp-activities" class="screen-reader-text"><?php
-                                                        /* translators: accessibility text */
-                                                        _e( 'Reply', 'buddypress' );
-                                                ?></label>
+                                                <h3 id="bp-replyhead"><?php esc_html_e( 'Reply to Activity', 'buddypress' ); ?></h3>
+                                                <label for="bp-activities" class="screen-reader-text">
+                                                        <?php
+                                                                /* translators: accessibility text */
+                                                                esc_html_e( 'Reply', 'buddypress' );
+                                                        ?>
+                                                </label>
                                                 <?php wp_editor( '', 'bp-activities', array( 'dfw' => false, 'media_buttons' => false, 'quicktags' => array( 'buttons' => 'strong,em,link,block,del,ins,img,code,spell,close' ), 'tinymce' => false, ) ); ?>
 
                                                 <p id="bp-replysubmit" class="submit">
-                                                        <a href="#" class="cancel button-secondary alignleft"><?php _e( 'Cancel', 'buddypress' ); ?></a>
-                                                        <a href="#" class="save button-primary alignright"><?php _e( 'Reply', 'buddypress' ); ?></a>
+                                                        <a href="#" class="cancel button-secondary alignleft"><?php esc_html_e( 'Cancel', 'buddypress' ); ?></a>
+                                                        <a href="#" class="save button-primary alignright"><?php esc_html_e( 'Reply', 'buddypress' ); ?></a>
 
                                                         <img class="waiting" style="display:none;" src="<?php echo esc_url( admin_url( 'images/wpspin_light.gif' ) ); ?>" alt="" />

trunk/src/bp-activity/bp-activity-embeds.php

@@ -73 +73 @@
         // Grab contents of CSS file and do some rudimentary CSS protection.
         $css = file_get_contents( $css['file'] );
-        $css = wp_kses( $css, array( "\'", '\"' ) );
-
-        printf( '<style type="text/css">%s</style>', $css );
+
+        printf( '<style type="text/css">%s</style>', wp_kses( $css, array( "\'", '\"' ) ) );
 }
 add_action( 'embed_head', 'bp_activity_embed_add_inline_styles', 20 );
@@ -122 +121 @@
  */
 function bp_activity_embed_excerpt( $content = '' ) {
+        // Escaping is made in `bp-activity/bp-activity-filters.php`.
+        // phpcs:ignore WordPress.Security.EscapeOutput
         echo bp_activity_get_embed_excerpt( $content );
 }
@@ -318 +319 @@
                         printf( '<div class="bp-activity-embed-display-media %s" style="max-width:%spx">%s</div>',
                                 $thumb_width < $float_width ? 'two-col' : 'one-col',
-                                $thumb_width < $float_width ? $width : $thumb_width,
+                                $thumb_width < $float_width ? intval( $width ) : intval( $thumb_width ),
+                                // phpcs:ignore WordPress.Security.EscapeOutput
                                 $content
                         );

trunk/src/bp-activity/bp-activity-notifications.php

@@ -393 +393 @@
                 $reply = 'yes';
         }
-
         ?>
 
@@ -400 +399 @@
                         <tr>
                                 <th class="icon">&nbsp;</th>
-                                <th class="title"><?php _e( 'Activity', 'buddypress' ) ?></th>
-                                <th class="yes"><?php _e( 'Yes', 'buddypress' ) ?></th>
-                                <th class="no"><?php _e( 'No', 'buddypress' )?></th>
+                                <th class="title"><?php esc_html_e( 'Activity', 'buddypress' ) ?></th>
+                                <th class="yes"><?php esc_html_e( 'Yes', 'buddypress' ) ?></th>
+                                <th class="no"><?php esc_html_e( 'No', 'buddypress' )?></th>
                         </tr>
                 </thead>
@@ -413 +412 @@
                                                 <?php
                                                 /* translators: %s: the displayed user username */
-                                                printf( __( 'A member mentions you in an update using "@%s"', 'buddypress' ), bp_members_get_user_slug( bp_displayed_user_id() ) );
+                                                printf( esc_html__( 'A member mentions you in an update using "@%s"', 'buddypress' ), esc_html( bp_members_get_user_slug( bp_displayed_user_id() ) ) );
                                                 ?>
                                         </td>
-                                        <td class="yes"><input type="radio" name="notifications[notification_activity_new_mention]" id="notification-activity-new-mention-yes" value="yes" <?php checked( $mention, 'yes', true ) ?>/><label for="notification-activity-new-mention-yes" class="bp-screen-reader-text"><?php
-                                                /* translators: accessibility text */
-                                                esc_html_e( 'Yes, send email', 'buddypress' );
-                                        ?></label></td>
-                                        <td class="no"><input type="radio" name="notifications[notification_activity_new_mention]" id="notification-activity-new-mention-no" value="no" <?php checked( $mention, 'no', true ) ?>/><label for="notification-activity-new-mention-no" class="bp-screen-reader-text"><?php
-                                                /* translators: accessibility text */
-                                                esc_html_e( 'No, do not send email', 'buddypress' );
-                                        ?></label></td>
+                                        <td class="yes">
+                                                <input type="radio" name="notifications[notification_activity_new_mention]" id="notification-activity-new-mention-yes" value="yes" <?php checked( $mention, 'yes', true ) ?>/>
+                                                <label for="notification-activity-new-mention-yes" class="bp-screen-reader-text">
+                                                        <?php
+                                                                /* translators: accessibility text */
+                                                                esc_html_e( 'Yes, send email', 'buddypress' );
+                                                        ?>
+                                                </label>
+                                        </td>
+                                        <td class="no"><input type="radio" name="notifications[notification_activity_new_mention]" id="notification-activity-new-mention-no" value="no" <?php checked( $mention, 'no', true ) ?>/>
+                                                <label for="notification-activity-new-mention-no" class="bp-screen-reader-text">
+                                                        <?php
+                                                                /* translators: accessibility text */
+                                                                esc_html_e( 'No, do not send email', 'buddypress' );
+                                                        ?>
+                                                </label>
+                                        </td>
                                 </tr>
                         <?php endif; ?>
@@ -429 +437 @@
                         <tr id="activity-notification-settings-replies">
                                 <td>&nbsp;</td>
-                                <td><?php _e( "A member replies to an update or comment you've posted", 'buddypress' ) ?></td>
-                                <td class="yes"><input type="radio" name="notifications[notification_activity_new_reply]" id="notification-activity-new-reply-yes" value="yes" <?php checked( $reply, 'yes', true ) ?>/><label for="notification-activity-new-reply-yes" class="bp-screen-reader-text"><?php
-                                        /* translators: accessibility text */
-                                        esc_html_e( 'Yes, send email', 'buddypress' );
-                                ?></label></td>
-                                <td class="no"><input type="radio" name="notifications[notification_activity_new_reply]" id="notification-activity-new-reply-no" value="no" <?php checked( $reply, 'no', true ) ?>/><label for="notification-activity-new-reply-no" class="bp-screen-reader-text"><?php
-                                        /* translators: accessibility text */
-                                        esc_html_e( 'No, do not send email', 'buddypress' );
-                                ?></label></td>
+                                <td><?php esc_html_e( "A member replies to an update or comment you've posted", 'buddypress' ) ?></td>
+                                <td class="yes">
+                                        <input type="radio" name="notifications[notification_activity_new_reply]" id="notification-activity-new-reply-yes" value="yes" <?php checked( $reply, 'yes', true ) ?>/>
+                                        <label for="notification-activity-new-reply-yes" class="bp-screen-reader-text">
+                                                <?php
+                                                        /* translators: accessibility text */
+                                                        esc_html_e( 'Yes, send email', 'buddypress' );
+                                                ?>
+                                        </label>
+                                </td>
+                                <td class="no"><input type="radio" name="notifications[notification_activity_new_reply]" id="notification-activity-new-reply-no" value="no" <?php checked( $reply, 'no', true ) ?>/>
+                                        <label for="notification-activity-new-reply-no" class="bp-screen-reader-text">
+                                                <?php
+                                                        /* translators: accessibility text */
+                                                        esc_html_e( 'No, do not send email', 'buddypress' );
+                                                ?>
+                                        </label>
+                                </td>
                         </tr>
 

trunk/src/bp-activity/bp-activity-template.php

@@ -18 +18 @@
  */
 function bp_activity_slug() {
-        echo bp_get_activity_slug();
+        echo esc_url( bp_get_activity_slug() );
 }
         /**
@@ -47 +47 @@
  */
 function bp_activity_root_slug() {
-        echo bp_get_activity_root_slug();
+        echo esc_url( bp_get_activity_root_slug() );
 }
         /**
@@ -458 +458 @@
  */
 function bp_activity_pagination_count() {
-        echo bp_get_activity_pagination_count();
+        echo esc_html( bp_get_activity_pagination_count() );
 }
 
@@ -495 +495 @@
  */
 function bp_activity_pagination_links() {
+        // Escaping is done in WordPress's `paginate_links()` function.
+        // phpcs:ignore WordPress.Security.EscapeOutput
         echo bp_get_activity_pagination_links();
 }
@@ -561 +563 @@
  */
 function bp_activity_count() {
-        echo bp_get_activity_count();
+        echo intval( bp_get_activity_count() );
 }
 
@@ -593 +595 @@
  */
 function bp_activity_per_page() {
-        echo bp_get_activity_per_page();
+        echo intval( bp_get_activity_per_page() );
 }
 
@@ -625 +627 @@
  */
 function bp_activity_id() {
-        echo bp_get_activity_id();
+        echo intval( bp_get_activity_id() );
 }
 
@@ -657 +659 @@
  */
 function bp_activity_item_id() {
-        echo bp_get_activity_item_id();
+        echo intval( bp_get_activity_item_id() );
 }
 
@@ -689 +691 @@
  */
 function bp_activity_secondary_item_id() {
-        echo bp_get_activity_secondary_item_id();
+        echo intval( bp_get_activity_secondary_item_id() );
 }
 
@@ -721 +723 @@
  */
 function bp_activity_date_recorded() {
-        echo bp_get_activity_date_recorded();
+        echo esc_html( bp_get_activity_date_recorded() );
 }
 
@@ -753 +755 @@
  */
 function bp_activity_member_display_name() {
-        echo bp_get_activity_member_display_name();
+        echo esc_html( bp_get_activity_member_display_name() );
 }
 
@@ -789 +791 @@
  */
 function bp_activity_object_name() {
-        echo bp_get_activity_object_name();
+        echo esc_html( bp_get_activity_object_name() );
 }
 
@@ -821 +823 @@
  */
 function bp_activity_type() {
-        echo bp_get_activity_type();
+        echo esc_html( bp_get_activity_type() );
 }
 
@@ -878 +880 @@
          *
          */
-        function bp_activity_action_name() { echo bp_activity_type(); }
+        function bp_activity_action_name() { bp_activity_type(); }
 
         /**
@@ -902 +904 @@
  */
 function bp_activity_user_id() {
-        echo bp_get_activity_user_id();
+        echo intval( bp_get_activity_user_id() );
 }
 
@@ -934 +936 @@
  */
 function bp_activity_user_link() {
-        echo bp_get_activity_user_link();
+        echo esc_url( bp_get_activity_user_link() );
 }
 
@@ -975 +977 @@
  */
 function bp_activity_avatar( $args = '' ) {
+        // phpcs:ignore WordPress.Security.EscapeOutput
         echo bp_get_activity_avatar( $args );
 }
@@ -1016 +1019 @@
 
                 // Prepend some descriptive text to alt.
-                $alt_default = __( 'Profile picture', 'buddypress' );
+                $alt_default = esc_html__( 'Profile picture', 'buddypress' );
                 if ( ! empty( $dn_default ) ) {
                         /* translators: %s: member name */
-                        $alt_default = sprintf( __( 'Profile picture of %s', 'buddypress' ), $dn_default );
+                        $alt_default = sprintf( esc_html__( 'Profile picture of %s', 'buddypress' ), $dn_default );
                 }
 
@@ -1035 +1038 @@
                 );
 
-                extract( $r, EXTR_SKIP );
-
-                if ( !isset( $height ) && !isset( $width ) ) {
+                if ( ! isset( $r['height'] ) && ! isset( $r['width'] ) ) {
 
                         // Backpat.
                         if ( isset( $bp->avatar->full->height ) || isset( $bp->avatar->thumb->height ) ) {
-                                $height = ( 'full' == $type ) ? $bp->avatar->full->height : $bp->avatar->thumb->height;
+                                $r['height'] = ( 'full' == $r['type'] ) ? $bp->avatar->full->height : $bp->avatar->thumb->height;
                         } else {
-                                $height = 20;
+                                $r['height'] = 20;
                         }
 
                         // Backpat.
                         if ( isset( $bp->avatar->full->width ) || isset( $bp->avatar->thumb->width ) ) {
-                                $width = ( 'full' == $type ) ? $bp->avatar->full->width : $bp->avatar->thumb->width;
+                                $r['width'] = ( 'full' == $r['type'] ) ? $bp->avatar->full->width : $bp->avatar->thumb->width;
                         } else {
-                                $width = 20;
+                                $r['width'] = 20;
                         }
                 }
@@ -1066 +1067 @@
                  */
                 $object  = apply_filters( 'bp_get_activity_avatar_object_' . $current_activity_item->component, 'user' );
-                $item_id = !empty( $user_id ) ? $user_id : $current_activity_item->user_id;
+                $item_id = $current_activity_item->user_id;
+
+                if ( ! empty( $r['user_id'] ) ) {
+                        $item_id = (int) $r['user_id'];
+                }
 
                 /**
@@ -1078 +1083 @@
 
                 // If this is a user object pass the users' email address for Gravatar so we don't have to prefetch it.
-                if ( 'user' == $object && empty( $user_id ) && empty( $email ) && isset( $current_activity_item->user_email ) ) {
-                        $email = $current_activity_item->user_email;
+                if ( 'user' == $object && empty( $r['user_id'] ) && empty( $r['email'] ) && isset( $current_activity_item->user_email ) ) {
+                        $r['email'] = $current_activity_item->user_email;
                 }
 
@@ -1089 +1094 @@
                  * @param array $value HTML image element containing the activity avatar.
                  */
-                return apply_filters( 'bp_get_activity_avatar', bp_core_fetch_avatar( array(
-                        'item_id' => $item_id,
-                        'object'  => $object,
-                        'type'    => $type,
-                        'alt'     => $alt,
-                        'class'   => $class,
-                        'width'   => $width,
-                        'height'  => $height,
-                        'email'   => $email
-                ) ) );
+                return apply_filters( 'bp_get_activity_avatar',
+                        bp_core_fetch_avatar(
+                                array(
+                                        'item_id' => $item_id,
+                                        'object'  => $object,
+                                        'type'    => $r['type'],
+                                        'alt'     => $r['alt'],
+                                        'class'   => $r['class'],
+                                        'width'   => $r['width'],
+                                        'height'  => $r['height'],
+                                        'email'   => $r['email'],
+                                )
+                        )
+                );
         }
 
@@ -1111 +1120 @@
  */
 function bp_activity_secondary_avatar( $args = '' ) {
+        // phpcs:ignore WordPress.Security.EscapeOutput
         echo bp_get_activity_secondary_avatar( $args );
 }
@@ -1151 +1161 @@
                 );
 
-                extract( $r, EXTR_SKIP );
-
                 // Set item_id and object (default to user).
                 switch ( $activities_template->activity->component ) {
@@ -1172 +1180 @@
                                 }
 
-                                if ( empty( $alt ) ) {
-                                        $alt = __( 'Group logo', 'buddypress' );
+                                if ( empty( $r['alt'] ) ) {
+                                        $r['alt'] = esc_html__( 'Group logo', 'buddypress' );
 
                                         if ( ! empty( $name ) ) {
                                                 /* translators: %s: the Group name */
-                                                $alt = sprintf( __( 'Group logo of %s', 'buddypress' ), $name );
+                                                $r['alt'] = sprintf( esc_html__( 'Group logo of %s', 'buddypress' ), $name );
                                         }
                                 }
@@ -1187 +1195 @@
                                 $link    = home_url();
 
-                                if ( empty( $alt ) ) {
+                                if ( empty( $r['alt'] ) ) {
                                         /* translators: %s: the blog name */
-                                        $alt = sprintf( __( 'Profile picture of the author of the site %s', 'buddypress' ), get_blog_option( $item_id, 'blogname' ) );
+                                        $r['alt'] = sprintf( esc_html__( 'Profile picture of the author of the site %s', 'buddypress' ), esc_html( get_blog_option( $item_id, 'blogname' ) ) );
                                 }
 
@@ -1198 +1206 @@
                                 $link    = bp_core_get_userlink( $item_id, false, true );
 
-                                if ( empty( $alt ) ) {
+                                if ( empty( $r['alt'] ) ) {
                                         /* translators: %s: member name */
-                                        $alt = sprintf( __( 'Profile picture of %s', 'buddypress' ), bp_core_get_user_displayname( $activities_template->activity->secondary_item_id ) );
+                                        $r['alt'] = sprintf( esc_html__( 'Profile picture of %s', 'buddypress' ), bp_core_get_user_displayname( $activities_template->activity->secondary_item_id ) );
                                 }
 
                                 break;
                         default :
-                                $object  = 'user';
-                                $item_id = $activities_template->activity->user_id;
-                                $email   = $activities_template->activity->user_email;
-                                $link    = bp_core_get_userlink( $item_id, false, true );
-
-                                if ( empty( $alt ) ) {
+                                $object     = 'user';
+                                $item_id    = $activities_template->activity->user_id;
+                                $r['email'] = $activities_template->activity->user_email;
+                                $link       = bp_core_get_userlink( $item_id, false, true );
+
+                                if ( empty( $r['alt'] ) ) {
                                         /* translators: %s: member name */
-                                        $alt = sprintf( __( 'Profile picture of %s', 'buddypress' ), $activities_template->activity->display_name );
+                                        $r['alt'] = sprintf( esc_html__( 'Profile picture of %s', 'buddypress' ), esc_html( $activities_template->activity->display_name ) );
                                 }
 
@@ -1229 +1237 @@
                  * @param string $object Component being displayed.
                  */
-                $object  = apply_filters( 'bp_get_activity_secondary_avatar_object_' . $activities_template->activity->component, $object );
+                $object = apply_filters( 'bp_get_activity_secondary_avatar_object_' . $activities_template->activity->component, $object );
 
                 /**
@@ -1246 +1254 @@
 
                 // Get the avatar.
-                $avatar = bp_core_fetch_avatar( array(
-                        'item_id' => $item_id,
-                        'object'  => $object,
-                        'type'    => $type,
-                        'alt'     => $alt,
-                        'class'   => $class,
-                        'width'   => $width,
-                        'height'  => $height,
-                        'email'   => $email
-                ) );
-
-                if ( !empty( $linked ) ) {
+                $avatar = bp_core_fetch_avatar(
+                        array(
+                                'item_id' => $item_id,
+                                'object'  => $object,
+                                'type'    => $r['type'],
+                                'alt'     => $r['alt'],
+                                'class'   => $r['class'],
+                                'width'   => $r['width'],
+                                'height'  => $r['height'],
+                                'email'   => $r['email'],
+                        )
+                );
+
+                if ( ! empty( $r['linked'] ) ) {
 
                         /**
@@ -1279 +1289 @@
 
                         return sprintf( '<a href="%s" class="%s">%s</a>',
-                                $link,
-                                $link_class,
+                                esc_url( $link ),
+                                esc_attr( $r['link_class'] ),
                                 $avatar
                         );
@@ -1297 +1307 @@
  */
 function bp_activity_action( $args = array() ) {
-        echo bp_get_activity_action( $args );
+        echo wp_kses(
+                bp_get_activity_action( $args ),
+                array(
+                        'p'    => true,
+                        'a'    => array(
+                                'href'            => true,
+                                'class'           => true,
+                                'data-bp-tooltip' => true,
+                        ),
+                        'span' => array(
+                                'class' => true,
+                        ),
+                        'img'  => array(
+                                'src'     => true,
+                                'loading' => true,
+                                'class'   => true,
+                                'alt'     => true,
+                                'height'  => true,
+                                'width'   => true,
+                        ),
+                )
+        );
 }
 
@@ -1363 +1394 @@
  */
 function bp_activity_content_body() {
+        // Escaping is made in `bp-activity/bp-activity-filters.php`.
+        // phpcs:ignore WordPress.Security.EscapeOutput
         echo bp_get_activity_content_body();
 }
@@ -1608 +1641 @@
  */
 function bp_activity_generated_content_part( $property = '' ) {
+        // phpcs:ignore WordPress.Security.EscapeOutput
         echo bp_activity_get_generated_content_part( $property );
 }
@@ -1664 +1698 @@
  */
 function bp_activity_content() {
+        // Escaping is made in `bp-activity/bp-activity-filters.php`.
+        // phpcs:ignore WordPress.Security.EscapeOutput
         echo bp_get_activity_content();
 }
@@ -1842 +1878 @@
  */
 function bp_activity_parent_content( $args = '' ) {
-        echo bp_get_activity_parent_content($args);
+        // Escaping is made in `bp-activity/bp-activity-filters.php`.
+        // phpcs:ignore WordPress.Security.EscapeOutput
+        echo bp_get_activity_parent_content( $args );
 }
 
@@ -1906 +1944 @@
  */
 function bp_activity_parent_user_id() {
-        echo bp_get_activity_parent_user_id();
+        echo intval( bp_get_activity_parent_user_id() );
 }
 
@@ -1959 +1997 @@
  */
 function bp_activity_is_favorite() {
+        // phpcs:ignore WordPress.Security.EscapeOutput
         echo bp_get_activity_is_favorite();
 }
@@ -1999 +2038 @@
                         sprintf(
                                 /* translators: 1: the name of the function. 2: the name of the file. */
-                                __( '%1$s no longer accepts arguments. See the inline documentation at %2$s for more details.', 'buddypress' ),
+                                esc_html__( '%1$s no longer accepts arguments. See the inline documentation at %2$s for more details.', 'buddypress' ),
                                 __FUNCTION__,
                                 __FILE__
@@ -2006 +2045 @@
         }
 
+        // phpcs:ignore WordPress.Security.EscapeOutput
         echo bp_activity_get_comments();
 }
@@ -2032 +2072 @@
                                 sprintf(
                                         /* translators: 1: the name of the function. 2: the name of the file. */
-                                        __( '%1$s no longer accepts arguments. See the inline documentation at %2$s for more details.', 'buddypress' ),
+                                        esc_html__( '%1$s no longer accepts arguments. See the inline documentation at %2$s for more details.', 'buddypress' ),
                                         __FUNCTION__,
                                         __FILE__
@@ -2070 +2110 @@
                         }
 
-                        /**
-                         * Filters the opening tag for the template that lists activity comments.
-                         *
-                         * @since 1.6.0
-                         *
-                         * @param string $value Opening tag for the HTML markup to use.
-                         */
-                        echo apply_filters( 'bp_activity_recurse_comments_start_ul', '<ul>' );
+                        // phpcs:ignore WordPress.Security.EscapeOutput
+                        echo apply_filters(
+                                /**
+                                 * Filters the opening tag for the template that lists activity comments.
+                                 *
+                                 * @since 1.6.0
+                                 *
+                                 * @param string $value Opening tag for the HTML markup to use.
+                                 */
+                                'bp_activity_recurse_comments_start_ul',
+                                '<ul>'
+                        );
+
                         foreach ( (array) $comment->children as $comment_child ) {
 
@@ -2108 +2153 @@
                         }
 
-                        /**
-                         * Filters the closing tag for the template that list activity comments.
-                         *
-                         * @since  1.6.0
-                         *
-                         * @param string $value Closing tag for the HTML markup to use.
-                         */
-                        echo apply_filters( 'bp_activity_recurse_comments_end_ul', '</ul>' );
+                        // phpcs:ignore WordPress.Security.EscapeOutput
+                        echo apply_filters(
+                                /**
+                                 * Filters the closing tag for the template that list activity comments.
+                                 *
+                                 * @since  1.6.0
+                                 *
+                                 * @param string $value Closing tag for the HTML markup to use.
+                                 */
+                                'bp_activity_recurse_comments_end_ul',
+                                '</ul>'
+                        );
                 }
 
@@ -2153 +2202 @@
  */
 function bp_activity_comment_id() {
-        echo bp_get_activity_comment_id();
+        echo intval( bp_get_activity_comment_id() );
 }
 
@@ -2188 +2237 @@
  */
 function bp_activity_comment_user_id() {
-        echo bp_get_activity_comment_user_id();
+        echo intval( bp_get_activity_comment_user_id() );
 }
 
@@ -2223 +2272 @@
  */
 function bp_activity_comment_user_link() {
-        echo bp_get_activity_comment_user_link();
+        echo esc_url( bp_get_activity_comment_user_link() );
 }
 
@@ -2254 +2303 @@
  */
 function bp_activity_comment_name() {
-        echo bp_get_activity_comment_name();
+        echo esc_html( bp_get_activity_comment_name() );
 }
 
@@ -2296 +2345 @@
  */
 function bp_activity_comment_date_recorded() {
-        echo bp_get_activity_comment_date_recorded();
+        echo esc_html( bp_get_activity_comment_date_recorded() );
 }
 
@@ -2327 +2376 @@
  */
 function bp_activity_comment_date_recorded_raw() {
-        echo bp_get_activity_comment_date_recorded_raw();
+        echo esc_html( bp_get_activity_comment_date_recorded_raw() );
 }
 
@@ -2360 +2409 @@
  */
 function bp_activity_comment_delete_link() {
-        echo bp_get_activity_comment_delete_link();
+        echo esc_url( bp_get_activity_comment_delete_link() );
 }
 
@@ -2399 +2448 @@
  */
 function bp_activity_comment_content() {
+        // Escaping is made in `bp-activity/bp-activity-filters.php`.
+        // phpcs:ignore WordPress.Security.EscapeOutput
         echo bp_get_activity_comment_content();
 }
@@ -2441 +2492 @@
  */
 function bp_activity_comment_count() {
-        echo bp_activity_get_comment_count();
+        echo intval( bp_activity_get_comment_count() );
 }
 
@@ -2464 +2515 @@
                                 sprintf(
                                         /* translators: 1: the name of the function. 2: the name of the file. */
-                                        __( '%1$s no longer accepts arguments. See the inline documentation at %2$s for more details.', 'buddypress' ),
+                                        esc_html__( '%1$s no longer accepts arguments. See the inline documentation at %2$s for more details.', 'buddypress' ),
                                         __FUNCTION__,
                                         __FILE__
@@ -2534 +2585 @@
  */
 function bp_activity_comment_depth( $comment = 0 ) {
-        echo bp_activity_get_comment_depth( $comment );
+        echo intval( bp_activity_get_comment_depth( $comment ) );
 }
 
@@ -2601 +2652 @@
  */
 function bp_activity_comment_link() {
-        echo bp_get_activity_comment_link();
+        echo esc_url( bp_get_activity_comment_link() );
 }
 
@@ -2648 +2699 @@
  */
 function bp_activity_comment_form_nojs_display() {
+        // phpcs:ignore WordPress.Security.EscapeOutput
         echo bp_get_activity_comment_form_nojs_display();
 }
@@ -2752 +2804 @@
  */
 function bp_activity_permalink_id() {
-        echo bp_get_activity_permalink_id();
+        echo esc_html( bp_get_activity_permalink_id() );
 }
 
@@ -2853 +2905 @@
  */
 function bp_activity_favorite_link() {
-        echo bp_get_activity_favorite_link();
+        echo esc_url( bp_get_activity_favorite_link() );
 }
 
@@ -2895 +2947 @@
  */
 function bp_activity_unfavorite_link() {
-        echo bp_get_activity_unfavorite_link();
+        echo esc_url( bp_get_activity_unfavorite_link() );
 }
 
@@ -2937 +2989 @@
  */
 function bp_activity_css_class() {
-        echo bp_get_activity_css_class();
+        echo esc_attr( bp_get_activity_css_class() );
 }
 
@@ -2995 +3047 @@
  */
 function bp_activity_delete_link() {
+        // phpcs:ignore WordPress.Security.EscapeOutput
         echo bp_get_activity_delete_link();
 }
@@ -3020 +3073 @@
                 }
 
-                $link = '<a href="' . esc_url( $url ) . '" class="button item-button bp-secondary-action ' . $class . ' confirm" rel="nofollow">' . __( 'Delete', 'buddypress' ) . '</a>';
+                $link = '<a href="' . esc_url( $url ) . '" class="button item-button bp-secondary-action ' . esc_attr( $class ) . ' confirm" rel="nofollow">' . esc_html__( 'Delete', 'buddypress' ) . '</a>';
 
                 /**
@@ -3096 +3149 @@
  */
 function bp_activity_latest_update( $user_id = 0 ) {
+        // Escaping is made in `bp-activity/bp-activity-filters.php`.
+        // phpcs:ignore WordPress.Security.EscapeOutput
         echo bp_get_activity_latest_update( $user_id );
 }
@@ -3163 +3218 @@
  */
 function bp_activity_filter_links( $args = false ) {
+        // phpcs:ignore WordPress.Security.EscapeOutput
         echo bp_get_activity_filter_links( $args );
 }
@@ -3201 +3257 @@
 
                         // Skip the activity comment filter.
-                        if ( 'activity' == $component ) {
+                        if ( 'activity' === $component ) {
                                 continue;
                         }
 
-                        if ( isset( $_GET['afilter'] ) && $component == $_GET['afilter'] ) {
+                        if ( isset( $_GET['afilter'] ) && $component === $_GET['afilter'] ) {
                                 $selected = ' class="selected"';
                         } else {
@@ -3250 +3306 @@
 
                 if ( isset( $_GET['afilter'] ) ) {
-                        $component_links[] = '<' . $tag . ' id="afilter-clear"><a href="' . esc_url( $link ) . '">' . __( 'Clear Filter', 'buddypress' ) . '</a></' . $tag . '>';
+                        $component_links[] = '<' . $tag . ' id="afilter-clear"><a href="' . esc_url( $link ) . '">' . esc_html__( 'Clear Filter', 'buddypress' ) . '</a></' . $tag . '>';
                 }
 
@@ -3378 +3434 @@
  */
 function bp_total_favorite_count_for_user( $user_id = 0 ) {
-        echo bp_get_total_favorite_count_for_user( $user_id );
+        echo intval( bp_get_total_favorite_count_for_user( $user_id ) );
 }
 
@@ -3428 +3484 @@
  */
 function bp_total_mention_count_for_user( $user_id = 0 ) {
-        echo bp_get_total_mention_count_for_user( $user_id );
+        echo intval( bp_get_total_mention_count_for_user( $user_id ) );
 }
 
@@ -3540 +3596 @@
  */
 function bp_mentioned_user_display_name( $user_id_or_username = false ) {
+        // phpcs:ignore WordPress.Security.EscapeOutput
         echo bp_get_mentioned_user_display_name( $user_id_or_username );
 }
@@ -3559 +3616 @@
                 // If user somehow has no name, return this really lame string.
                 if ( empty( $name ) ) {
-                        $name = __( 'a user', 'buddypress' );
+                        $name = esc_html__( 'a user', 'buddypress' );
                 }
 
@@ -3583 +3640 @@
  */
 function bp_send_public_message_button( $args = '' ) {
+        // Escaping is done in `BP_Core_HTML_Element()`.
+        // phpcs:ignore WordPress.Security.EscapeOutput
         echo bp_get_send_public_message_button( $args );
 }
@@ -3662 +3721 @@
  */
 function bp_activity_post_form_action() {
-        echo bp_get_activity_post_form_action();
+        echo esc_url( bp_get_activity_post_form_action() );
 }
 
@@ -3734 +3793 @@
 
                         // Get avatar for this user.
-                        $image_html   = bp_core_fetch_avatar( array(
-                                'item_id' => $user_id,
-                                'height'  => $r['height'],
-                                'html'    => $r['html'],
-                                'type'    => $r['type'],
-                                'width'   => $r['width']
-                        ) );
+                        $image_html = bp_core_fetch_avatar(
+                                array(
+                                        'item_id' => $user_id,
+                                        'height'  => $r['height'],
+                                        'html'    => $r['html'],
+                                        'type'    => $r['type'],
+                                        'width'   => $r['width']
+                                )
+                        );
 
                         // If user has link & avatar, add them to the output array.
@@ -3754 +3815 @@
         }
 
-        /**
-         * Filters the list of linked avatars for users who have commented on the current activity item.
-         *
-         * @since 1.7.0
-         *
-         * @param string $retval HTML markup for the list of avatars.
-         * @param array  $r      Array of arguments used for each avatar.
-         * @param array  $output Array of each avatar found, before imploded into single string.
-         */
-        echo apply_filters( 'bp_activity_comments_user_avatars', $retval, $r, $output );
+        // phpcs:ignore WordPress.Security.EscapeOutput
+        echo apply_filters(
+                /**
+                 * Filters the list of linked avatars for users who have commented on the current activity item.
+                 *
+                 * @since 1.7.0
+                 *
+                 * @param string $retval HTML markup for the list of avatars.
+                 * @param array  $r      Array of arguments used for each avatar.
+                 * @param array  $output Array of each avatar found, before imploded into single string.
+                 */
+                'bp_activity_comments_user_avatars',
+                $retval,
+                $r,
+                $output
+        );
 }
 
@@ -3842 +3909 @@
  */
 function bp_displayed_user_mentionname() {
-        echo bp_get_displayed_user_mentionname();
+        echo esc_html( bp_get_displayed_user_mentionname() );
 }
         /**
@@ -3900 +3967 @@
                 switch ( $output ) {
                         case 'select' :
+                                // phpcs:ignore WordPress.Security.EscapeOutput
                                 printf( '<option value="%1$s" %2$s>%3$s</option>', esc_attr( $type ), $selected, esc_html( $description ) );
                                 break;
                         case 'checkbox' :
+                                // phpcs:ignore WordPress.Security.EscapeOutput
                                 printf( '<label style="" for="%1$s[]">%2$s<input type="checkbox" id="%1$s[]" name="%1$s[]" value="%3$s" %4$s/></label>', esc_attr( $args['checkbox_name'] ), esc_html( $description ), esc_attr( $args['checkbox_name'] ), esc_attr( $args['checkbox_name'] ), esc_attr( $type ), $checked );
                                 break;
@@ -3938 +4007 @@
  */
 function bp_sitewide_activity_feed_link() {
-        echo bp_get_sitewide_activity_feed_link();
+        echo esc_url( bp_get_sitewide_activity_feed_link() );
 }
 
@@ -4054 +4123 @@
  */
 function bp_activity_feed_item_guid() {
-        echo bp_get_activity_feed_item_guid();
+        echo esc_html( bp_get_activity_feed_item_guid() );
 }
 
@@ -4086 +4155 @@
  */
 function bp_activity_feed_item_title() {
+        // phpcs:ignore WordPress.Security.EscapeOutput
         echo bp_get_activity_feed_item_title();
 }
@@ -4135 +4205 @@
  */
 function bp_activity_feed_item_link() {
-        echo bp_get_activity_feed_item_link();
+        echo esc_url( bp_get_activity_feed_item_link() );
 }
 
@@ -4171 +4241 @@
  */
 function bp_activity_feed_item_date() {
-        echo bp_get_activity_feed_item_date();
+        echo esc_html( bp_get_activity_feed_item_date() );
 }
 
@@ -4207 +4277 @@
  */
 function bp_activity_feed_item_description() {
+        // Escaping is made in `bp-activity/bp-activity-filters.php`.
+        // phpcs:ignore WordPress.Security.EscapeOutput
         echo bp_get_activity_feed_item_description();
 }
@@ -4251 +4323 @@
 ?>
 
-        <link rel="alternate" type="application/rss+xml" title="<?php bloginfo( 'name' ) ?> | <?php _e( 'Site Wide Activity RSS Feed', 'buddypress' ) ?>" href="<?php bp_sitewide_activity_feed_link() ?>" />
+        <link rel="alternate" type="application/rss+xml" title="<?php bloginfo( 'name' ) ?> | <?php esc_html_e( 'Site Wide Activity RSS Feed', 'buddypress' ) ?>" href="<?php bp_sitewide_activity_feed_link() ?>" />
 
 <?php
@@ -4266 +4338 @@
  */
 function bp_activity_show_filters( $context = '' ) {
+        // phpcs:ignore WordPress.Security.EscapeOutput
         echo bp_get_activity_show_filters( $context );
 }

trunk/src/bp-activity/classes/class-bp-activity-feed.php

@@ -168 +168 @@
                         // Check if id is valid.
                         if ( empty( $this->id ) ) {
-                                _doing_it_wrong( 'BP_Activity_Feed', __( "RSS feed 'id' must be defined", 'buddypress' ), 'BP 1.8' );
+                                _doing_it_wrong( 'BP_Activity_Feed', esc_html__( "RSS feed 'id' must be defined", 'buddypress' ), 'BP 1.8' );
                                 return false;
                         }
@@ -318 +318 @@
                                 if ( 'activity_comment' == bp_get_activity_action_name() ) :
                         ?>
-                                <strong><?php _e( 'In reply to', 'buddypress' ) ?></strong> -
+                                <strong><?php esc_html_e( 'In reply to', 'buddypress' ) ?></strong> -
                                 <?php bp_activity_parent_content() ?>
                         <?php
@@ -414 +414 @@
         protected function output() {
                 $this->http_headers();
-                echo '<?xml version="1.0" encoding="' . get_option( 'blog_charset' ) . '"?'.'>';
+                echo '<?xml version="1.0" encoding="' . esc_attr( get_option( 'blog_charset' ) ) . '"?'.'>';
 
                 /**
@@ -440 +440 @@
 
 <channel>
-        <title><?php echo $this->title; ?></title>
-        <link><?php echo $this->link; ?></link>
-        <atom:link href="<?php self_link(); ?>" rel="self" type="application/rss+xml" />
-        <description><?php echo $this->description ?></description>
-        <lastBuildDate><?php echo mysql2date( 'D, d M Y H:i:s O', bp_activity_get_last_updated(), false ); ?></lastBuildDate>
-        <generator>https://buddypress.org/?v=<?php bp_version(); ?></generator>
+        <title><?php echo esc_html( $this->title ); ?></title>
+        <link><?php echo esc_url( $this->link ); ?></link>
+        <atom:link href="<?php esc_url( self_link() ); ?>" rel="self" type="application/rss+xml" />
+        <description><?php echo esc_html( $this->description ); ?></description>
+        <lastBuildDate><?php echo esc_html( mysql2date( 'D, d M Y H:i:s O', bp_activity_get_last_updated(), false ) ); ?></lastBuildDate>
+        <generator>https://buddypress.org/?v=<?php esc_html( bp_get_version() ); ?></generator>
         <language><?php bloginfo_rss( 'language' ); ?></language>
-        <ttl><?php echo $this->ttl; ?></ttl>
-        <sy:updatePeriod><?php echo $this->update_period; ?></sy:updatePeriod>
-        <sy:updateFrequency><?php echo $this->update_frequency; ?></sy:updateFrequency>
+        <ttl><?php echo esc_html( $this->ttl ); ?></ttl>
+        <sy:updatePeriod><?php echo esc_html( $this->update_period ); ?></sy:updatePeriod>
+        <sy:updateFrequency><?php echo esc_html( $this->update_frequency ); ?></sy:updateFrequency>
         <?php
 
@@ -463 +463 @@
                         <item>
                                 <guid isPermaLink="false"><?php bp_activity_feed_item_guid(); ?></guid>
-                                <title><?php echo stripslashes( bp_get_activity_feed_item_title() ); ?></title>
+                                <title><?php echo esc_html( stripslashes( bp_get_activity_feed_item_title() ) ); ?></title>
                                 <link><?php bp_activity_thread_permalink() ?></link>
-                                <pubDate><?php echo mysql2date( 'D, d M Y H:i:s O', bp_get_activity_feed_item_date(), false ); ?></pubDate>
+                                <pubDate><?php echo esc_html( mysql2date( 'D, d M Y H:i:s O', bp_get_activity_feed_item_date(), false ) ); ?></pubDate>
 
                                 <?php if ( bp_get_activity_feed_item_description() ) : ?>

trunk/src/bp-activity/classes/class-bp-activity-list-table.php

@@ -261 +261 @@
          */
         function no_items() {
-                _e( 'No activities found.', 'buddypress' );
+                esc_html_e( 'No activities found.', 'buddypress' );
         }
 
@@ -272 +272 @@
                 $this->display_tablenav( 'top' ); ?>
 
-                <h2 class="screen-reader-text"><?php
-                        /* translators: accessibility text */
-                        _e( 'Activities list', 'buddypress' );
-                ?></h2>
-
-                <table class="wp-list-table <?php echo implode( ' ', $this->get_table_classes() ); ?>" cellspacing="0">
+                <h2 class="screen-reader-text">
+                        <?php
+                                /* translators: accessibility text */
+                                esc_html_e( 'Activities list', 'buddypress' );
+                        ?>
+                </h2>
+
+                <table class="wp-list-table <?php echo esc_attr( implode( ' ', $this->get_table_classes() ) ); ?>" cellspacing="0">
                         <thead>
                                 <tr>
@@ -309 +311 @@
                 static $even = false;
 
+                $row_classes = array();
+
                 if ( $even ) {
-                        $row_class = ' class="even"';
+                        $row_classes = array( 'even' );
                 } else {
-                        $row_class = ' class="alternate odd"';
+                        $row_classes = array( 'alternate', 'odd' );
                 }
 
@@ -321 +325 @@
                 }
 
-                echo '<tr' . $row_class . ' id="activity-' . esc_attr( $item['id'] ) . '" data-parent_id="' . esc_attr( $item['id'] ) . '" data-root_id="' . esc_attr( $root_id ) . '">';
+                echo '<tr class="' . implode( ' ', array_map( 'sanitize_html_class', $row_classes ) ) . '" id="activity-' . esc_attr( $item['id'] ) . '" data-parent_id="' . esc_attr( $item['id'] ) . '" data-root_id="' . esc_attr( $root_id ) . '">';
+
+                // Escapes are made into `self::single_row_columns()`.
+                // phpcs:ignore WordPress.Security.EscapeOutput
                 echo $this->single_row_columns( $item );
                 echo '</tr>';
@@ -336 +343 @@
                 $url_base = add_query_arg( array( 'page' => 'bp-activity' ), bp_get_admin_url( 'admin.php' ) ); ?>
 
-                <h2 class="screen-reader-text"><?php
-                        /* translators: accessibility text */
-                        esc_html_e( 'Filter activities list', 'buddypress' );
-                ?></h2>
+                <h2 class="screen-reader-text">
+                        <?php
+                                /* translators: accessibility text */
+                                esc_html_e( 'Filter activities list', 'buddypress' );
+                        ?>
+                </h2>
 
                 <ul class="subsubsub">
@@ -349 +358 @@
                                                 sprintf(
                                                         '<span class="count">(%s)</span>',
-                                                        number_format_i18n( $this->all_count )
+                                                        esc_html( number_format_i18n( $this->all_count ) )
                                                 )
                                         ); ?>
@@ -361 +370 @@
                                                 sprintf(
                                                         '<span class="count">(%s)</span>',
-                                                        number_format_i18n( $this->spam_count )
+                                                        esc_html( number_format_i18n( $this->spam_count ) )
                                                 )
                                         ); ?>
@@ -398 +407 @@
                  * @param array $actions Default available actions for bulk operations.
                  */
-                return apply_filters( 'bp_activity_list_table_get_bulk_actions', array(
-                        'bulk_spam'   => __( 'Mark as Spam', 'buddypress' ),
-                        'bulk_ham'    => __( 'Not Spam', 'buddypress' ),
-                        'bulk_delete' => __( 'Delete Permanently', 'buddypress' ),
-                ) );
+                return apply_filters( 'bp_activity_list_table_get_bulk_actions',
+                        array(
+                                'bulk_spam'   => __( 'Mark as Spam', 'buddypress' ),
+                                'bulk_ham'    => __( 'Not Spam', 'buddypress' ),
+                                'bulk_delete' => __( 'Delete Permanently', 'buddypress' ),
+                        )
+                );
         }
 
@@ -423 +434 @@
                  * @param array $value Array of slugs and titles for the columns.
                  */
-                return apply_filters( 'bp_activity_list_table_get_columns', array(
-                        'cb'       => '<input name type="checkbox" />',
-                        'author'   => _x( 'Author', 'Admin SWA column header', 'buddypress' ),
-                        'comment'  => _x( 'Activity', 'Admin SWA column header', 'buddypress' ),
-                        'action'   => _x( 'Action', 'Admin SWA column header', 'buddypress' ),
-                        'response' => _x( 'In Response To', 'Admin SWA column header', 'buddypress' ),
-                ) );
+                return apply_filters( 'bp_activity_list_table_get_columns',
+                        array(
+                                'cb'       => '<input name type="checkbox" />',
+                                'author'   => _x( 'Author', 'Admin SWA column header', 'buddypress' ),
+                                'comment'  => _x( 'Activity', 'Admin SWA column header', 'buddypress' ),
+                                'action'   => _x( 'Action', 'Admin SWA column header', 'buddypress' ),
+                                'response' => _x( 'In Response To', 'Admin SWA column header', 'buddypress' ),
+                        )
+                );
         }
 
@@ -472 +485 @@
 
                 <div class="alignleft actions">
-                        <label for="activity-type" class="screen-reader-text"><?php
-                                /* translators: accessibility text */
-                                _e( 'Filter by activity type', 'buddypress' );
-                        ?></label>
+                        <label for="activity-type" class="screen-reader-text">
+                                <?php
+                                        /* translators: accessibility text */
+                                        esc_html_e( 'Filter by activity type', 'buddypress' );
+                                ?>
+                        </label>
                         <select name="activity_type" id="activity-type">
-                                <option value="" <?php selected( ! $selected ); ?>><?php _e( 'View all actions', 'buddypress' ); ?></option>
+                                <option value="" <?php selected( ! $selected ); ?>><?php esc_html_e( 'View all actions', 'buddypress' ); ?></option>
 
                                 <?php foreach ( $activity_actions as $component => $actions ) : ?>
@@ -573 +588 @@
         function column_cb( $item ) {
                 /* translators: accessibility text */
-                printf( '<label class="screen-reader-text" for="aid-%1$d">' . __( 'Select activity item %1$d', 'buddypress' ) . '</label><input type="checkbox" name="aid[]" value="%1$d" id="aid-%1$d" />', $item['id'] );
+                printf( '<label class="screen-reader-text" for="aid-%1$d">' . esc_html__( 'Select activity item %1$d', 'buddypress' ) . '</label><input type="checkbox" name="aid[]" value="%1$d" id="aid-%1$d" />', intval( $item['id'] ) );
         }
 
@@ -586 +601 @@
          */
         function column_author( $item ) {
-                echo '<strong>' . get_avatar( $item['user_id'], '32' ) . ' ' . bp_core_get_userlink( $item['user_id'] ) . '</strong>';
+                $avatar = get_avatar( $item['user_id'], '32' );
+
+                printf(
+                        '<strong>%1$s %2$s</strong>',
+                        wp_kses(
+                                $avatar,
+                                array(
+                                        'img' => array(
+                                                'alt'    => true,
+                                                'src'    => true,
+                                                'srcset' => true,
+                                                'class'  => true,
+                                                'height' => true,
+                                                'width'  => true,
+                                        )
+                                )
+                        ),
+                        // phpcs:ignore WordPress.Security.EscapeOutput
+                        bp_core_get_userlink( $item['user_id'] )
+                );
         }
 
@@ -602 +636 @@
 
                 if ( isset( $actions[ $item['type'] ] ) ) {
-                        echo $actions[ $item['type'] ];
+                        echo esc_html( $actions[ $item['type'] ] );
                 } else {
                         /* translators: %s: the name of the activity type */
-                        printf( __( 'Unregistered action - %s', 'buddypress' ), $item['type'] );
+                        printf( esc_html__( 'Unregistered action - %s', 'buddypress' ), esc_html( $item['type'] ) );
                 }
         }
@@ -622 +656 @@
         function column_comment( $item ) {
                 // Determine what type of item (row) we're dealing with.
-                if ( $item['is_spam'] )
+                if ( $item['is_spam'] ) {
                         $item_status = 'spam';
-                else
+                } else {
                         $item_status = 'all';
+                }
 
                 // Preorder items: Reply | Edit | Spam | Delete Permanently.
@@ -682 +717 @@
                 printf(
                         /* translators: %s: activity date and time */
-                        __( 'Submitted on %s', 'buddypress' ),
+                        esc_html__( 'Submitted on %s', 'buddypress' ),
                         sprintf(
                                 '<a href="%1$s">%2$s</a>',
-                                bp_activity_get_permalink( $item['id'] ),
+                                esc_url( bp_activity_get_permalink( $item['id'] ) ),
                                 sprintf(
                                         /* translators: 1: activity date, 2: activity time */
-                                        __( '%1$s at %2$s', 'buddypress' ),
-                                        date_i18n( bp_get_option( 'date_format' ), strtotime( $item['date_recorded'] ) ),
-                                        get_date_from_gmt( $item['date_recorded'], bp_get_option( 'time_format' ) )
+                                        esc_html__( '%1$s at %2$s', 'buddypress' ),
+                                        esc_html( date_i18n( bp_get_option( 'date_format' ), strtotime( $item['date_recorded'] ) ) ),
+                                        esc_html( get_date_from_gmt( $item['date_recorded'], bp_get_option( 'time_format' ) ) )
                                 )
                         )
@@ -714 +749 @@
                 }
 
-                /**
-                 * Filter here to add extra output to the activity content into the Administration.
-                 *
-                 * @since  2.4.0
-                 *
-                 * @param  string $content The activity content.
-                 * @param  array  $item    The activity object converted into an array.
-                 */
-                echo apply_filters( 'bp_activity_admin_comment_content', $content, $item ) . ' ' . $this->row_actions( $actions );
+                // phpcs:disable WordPress.Security.EscapeOutput
+                echo apply_filters(
+                        /**
+                         * Filter here to add extra output to the activity content into the Administration.
+                         *
+                         * @since  2.4.0
+                         *
+                         * @param  string $content The activity content.
+                         * @param  array  $item    The activity object converted into an array.
+                         */
+                        'bp_activity_admin_comment_content',
+                        $content,
+                        $item
+                );
+
+                echo ' ' . $this->row_actions( $actions );
+                // phpcs:enable
         }
 
@@ -745 +788 @@
                 $activity_permalink = '';
                 if ( ! $item['is_spam'] ) {
-                        $activity_permalink = '<a href="' . bp_activity_get_permalink( $item['id'], (object) $item ) . '" class="comments-view-item-link">' . __( 'View Activity', 'buddypress' ) . '</a>';
+                        $activity_permalink = '<a href="' . esc_url( bp_activity_get_permalink( $item['id'], (object) $item ) ) . '" class="comments-view-item-link">' . esc_html__( 'View Activity', 'buddypress' ) . '</a>';
                 }
 
@@ -757 +800 @@
                  */
                 if ( empty( $item['item_id'] ) || ! in_array( $item['type'], apply_filters( 'bp_activity_admin_root_activity_types', array( 'activity_comment' ), $item ) ) ) {
+                        // phpcs:ignore WordPress.Security.EscapeOutput
                         echo $activity_permalink;
 
-                        $comment_count     = !empty( $item['children'] ) ? bp_activity_recurse_comment_count( (object) $item ) : 0;
+                        $comment_count     = ! empty( $item['children'] ) ? bp_activity_recurse_comment_count( (object) $item ) : 0;
                         $root_activity_url = bp_get_admin_url( 'admin.php?page=bp-activity&amp;aid=' . $item['id'] );
 
                         // If the activity has comments, display a link to the activity's permalink, with its comment count in a speech bubble.
                         if ( $comment_count ) {
-                                printf( '<a href="%1$s" class="post-com-count post-com-count-approved"><span class="comment-count comment-count-approved">%2$s</span></a>', esc_url( $root_activity_url ), number_format_i18n( $comment_count ) );
+                                printf( '<a href="%1$s" class="post-com-count post-com-count-approved"><span class="comment-count comment-count-approved">%2$s</span></a>', esc_url( $root_activity_url ), esc_html( number_format_i18n( $comment_count ) ) );
                         }
 
                 // For non-root activities, display a link to the replied-to activity's author's profile.
                 } else {
-                        echo '<strong>' . get_avatar( $this->get_activity_user_id( $item['item_id'] ), '32' ) . ' ' . bp_core_get_userlink( $this->get_activity_user_id( $item['item_id'] ) ) . '</strong><br />';
+                        $avatar = get_avatar( $this->get_activity_user_id( $item['item_id'] ), '32' );
+                        printf(
+                                '<strong>%1$s %2$s</strong><br />',
+                                wp_kses(
+                                        $avatar,
+                                        array(
+                                                'img' => array(
+                                                        'alt'    => true,
+                                                        'src'    => true,
+                                                        'srcset' => true,
+                                                        'class'  => true,
+                                                        'height' => true,
+                                                        'width'  => true,
+                                                )
+                                        )
+                                ),
+                                // phpcs:ignore WordPress.Security.EscapeOutput
+                                bp_core_get_userlink( $this->get_activity_user_id( $item['item_id'] ) )
+                        );
+
+                        // phpcs:ignore WordPress.Security.EscapeOutput
                         echo $activity_permalink;
                 }
                 ?>
-
                 </div>
-
                 <?php
         }
@@ -829 +891 @@
                          * activities as orphans, use the logged in user's ID to avoid errors.
                          */
-                        if ( empty( $activity['activities'] ) )
+                        if ( empty( $activity['activities'] ) ) {
                                 return bp_loggedin_user_id();
+                        }
 
                         // Store the new activity/user ID mapping for any later re-use.
@@ -854 +917 @@
          * @return bool $can_comment
          */
-        protected function can_comment( $item  ) {
+        protected function can_comment( $item ) {
                 $can_comment = bp_activity_type_supports( $item['type'], 'comment-reply' );
 

trunk/src/bp-activity/classes/class-bp-activity-oembed-extension.php

@@ -157 +157 @@
          *
          * @since 2.6.0
-         * 
+         *
          * @global BP_Activity_Template $activities_template The Activity template loop.
          *
@@ -321 +321 @@
                                 <?php
                                 printf(
-                                        _n(
-                                                /* translators: accessibility text */
-                                                '%s <span class="screen-reader-text">Comment</span>',
-                                                /* translators: accessibility text */
-                                                '%s <span class="screen-reader-text">Comments</span>',
-                                                $count,
-                                                'buddypress'
+                                        wp_kses(
+                                                _n(
+                                                        /* translators: accessibility text */
+                                                        '%s <span class="screen-reader-text">Comment</span>',
+                                                        /* translators: accessibility text */
+                                                        '%s <span class="screen-reader-text">Comments</span>',
+                                                        intval( $count ),
+                                                        'buddypress'
+                                                ),
+                                                array(
+                                                        'span' => array(
+                                                                'class' => true,
+                                                        ),
+                                                )
                                         ),
-                                        number_format_i18n( $count )
+                                        esc_html( number_format_i18n( $count ) )
                                 );
                                 ?>

trunk/src/bp-activity/classes/class-bp-activity-template.php

@@ -174 +174 @@
                 // Backward compatibility with old method of passing arguments.
                 if ( !is_array( $args ) || count( $function_args ) > 1 ) {
-                        _deprecated_argument( __METHOD__, '1.6', sprintf( __( 'Arguments passed to %1$s should be in an associative array. See the inline documentation at %2$s for more details.', 'buddypress' ), __METHOD__, __FILE__ ) );
+                        _deprecated_argument( __METHOD__, '1.6', sprintf( esc_html__( 'Arguments passed to %1$s should be in an associative array. See the inline documentation at %2$s for more details.', 'buddypress' ), __METHOD__, __FILE__ ) );
 
                         $old_args_keys = array(

trunk/src/bp-activity/classes/class-bp-akismet.php

@@ -108 +108 @@
                                 $b[ $k ] = $item;
                                 if ( $k == 'edit' )
-                                        $b['history'] = '<a href="' . esc_url( bp_get_admin_url( 'admin.php?page=bp-activity&amp;action=edit&aid=' . $activity['id'] ) ) . '#bp_activity_history"> '. __( 'History', 'buddypress' ) . '</a>';
+                                        $b['history'] = '<a href="' . esc_url( bp_get_admin_url( 'admin.php?page=bp-activity&amp;action=edit&aid=' . $activity['id'] ) ) . '#bp_activity_history"> '. esc_html__( 'History', 'buddypress' ) . '</a>';
                         }
 
@@ -114 +114 @@
                 }
 
-                if ( $desc )
-                        echo '<span class="akismet-status"><a href="' . esc_url( bp_get_admin_url( 'admin.php?page=bp-activity&amp;action=edit&aid=' . $activity['id'] ) ) . '#bp_activity_history">' . htmlspecialchars( $desc ) . '</a></span>';
+                if ( $desc ) {
+                        echo '<span class="akismet-status"><a href="' . esc_url( bp_get_admin_url( 'admin.php?page=bp-activity&amp;action=edit&aid=' . $activity['id'] ) ) . '#bp_activity_history">' . esc_html( $desc ) . '</a></span>';
+                }
 
                 /**

trunk/src/bp-templates/bp-nouveau/buddypress/activity/widget.php

@@ -28 +28 @@
 
                                                 <cite>
-                                                        <a href="<?php bp_activity_user_link(); ?>" class="bp-tooltip" data-bp-tooltip="<?php echo esc_attr( bp_activity_member_display_name() ); ?>">
+                                                        <a href="<?php bp_activity_user_link(); ?>" class="bp-tooltip" data-bp-tooltip="<?php echo esc_attr( bp_get_activity_member_display_name() ); ?>">
                                                                 <?php
                                                                 bp_activity_avatar(