Skip to:
Content

BuddyPress.org


Ignore:
Timestamp:
04/29/2024 06:50:42 PM (19 months ago)
Author:
imath
Message:

BP Legacy: improve PHP code standards using WPCS

See #7228 (trunk)

File:
1 edited

Legend:

Unmodified
Added
Removed

  • trunk/src/bp-templates/bp-legacy/buddypress-functions.php

    r13709 r13822  
    512512        $class = did_action( 'admin_bar_menu' ) ? 'admin-bar-on' : 'admin-bar-off';
    513513
    514         echo '<div id="sitewide-notice" class="' . $class . '">';
     514        echo '<div id="sitewide-notice" class="' . esc_attr( $class ) . '">';
    515515        bp_message_get_notices();
    516516        echo '</div>';
    … …  
    985985    check_admin_referer( 'post_update', '_wpnonce_post_update' );
    986986
    987     if ( ! is_user_logged_in() )
     987    if ( ! is_user_logged_in() ) {
    988988        exit( '-1' );
    989 
    990     if ( empty( $_POST['content'] ) )
    991         exit( '-1<div id="message" class="error bp-ajax-message"><p>' . __( 'Please enter some content to post.', 'buddypress' ) . '</p></div>' );
     989    }
     990
     991    if ( empty( $_POST['content'] ) ) {
     992        exit( '-1<div id="message" class="error bp-ajax-message"><p>' . esc_html__( 'Please enter some content to post.', 'buddypress' ) . '</p></div>' );
     993    }
    992994
    993995    $activity_id = 0;
    … …  
    10251027
    10261028    if ( false === $activity_id ) {
    1027         exit( '-1<div id="message" class="error bp-ajax-message"><p>' . __( 'There was a problem posting your update. Please try again.', 'buddypress' ) . '</p></div>' );
     1029        exit( '-1<div id="message" class="error bp-ajax-message"><p>' . esc_html__( 'There was a problem posting your update. Please try again.', 'buddypress' ) . '</p></div>' );
    10281030    } elseif ( is_wp_error( $activity_id ) && $activity_id->get_error_code() ) {
    1029         exit( '-1<div id="message" class="error bp-ajax-message"><p>' . $activity_id->get_error_message() . '</p></div>' );
     1031        exit( '-1<div id="message" class="error bp-ajax-message"><p>' . esc_html( $activity_id->get_error_message() ) . '</p></div>' );
    10301032    }
    10311033
    … …  
    11461148    check_admin_referer( 'bp_activity_delete_link' );
    11471149
    1148     if ( ! is_user_logged_in() )
     1150    if ( ! is_user_logged_in() ) {
    11491151        exit( '-1' );
    1150 
    1151     if ( empty( $_POST['id'] ) || ! is_numeric( $_POST['id'] ) )
     1152    }
     1153
     1154    if ( empty( $_POST['id'] ) || ! is_numeric( $_POST['id'] ) ) {
    11521155        exit( '-1' );
     1156    }
    11531157
    11541158    $activity = new BP_Activity_Activity( (int) $_POST['id'] );
    11551159
    11561160    // Check access.
    1157     if ( ! bp_activity_user_can_delete( $activity ) )
     1161    if ( ! bp_activity_user_can_delete( $activity ) ) {
    11581162        exit( '-1' );
     1163    }
    11591164
    11601165    /** This action is documented in bp-activity/bp-activity-actions.php */
    11611166    do_action( 'bp_activity_before_action_delete_activity', $activity->id, $activity->user_id );
    11621167
    1163     if ( ! bp_activity_delete( array( 'id' => $activity->id, 'user_id' => $activity->user_id ) ) )
    1164         exit( '-1<div id="message" class="error bp-ajax-message"><p>' . __( 'There was a problem when deleting. Please try again.', 'buddypress' ) . '</p></div>' );
     1168    if ( ! bp_activity_delete( array( 'id' => $activity->id, 'user_id' => $activity->user_id ) ) ) {
     1169        exit( '-1<div id="message" class="error bp-ajax-message"><p>' . esc_html__( 'There was a problem when deleting. Please try again.', 'buddypress' ) . '</p></div>' );
     1170    }
    11651171
    11661172    /** This action is documented in bp-activity/bp-activity-actions.php */
    … …  
    11951201
    11961202    // Check access.
    1197     if ( ! bp_current_user_can( 'bp_moderate' ) && $comment->user_id != bp_loggedin_user_id() )
     1203    if ( ! bp_current_user_can( 'bp_moderate' ) && $comment->user_id != bp_loggedin_user_id() ) {
    11981204        exit( '-1' );
     1205    }
    11991206
    12001207    /** This action is documented in bp-activity/bp-activity-actions.php */
    12011208    do_action( 'bp_activity_before_action_delete_activity', $_POST['id'], $comment->user_id );
    12021209
    1203     if ( ! bp_activity_delete_comment( $comment->item_id, $comment->id ) )
    1204         exit( '-1<div id="message" class="error bp-ajax-message"><p>' . __( 'There was a problem when deleting. Please try again.', 'buddypress' ) . '</p></div>' );
     1210    if ( ! bp_activity_delete_comment( $comment->item_id, $comment->id ) ) {
     1211        exit( '-1<div id="message" class="error bp-ajax-message"><p>' . esc_html__( 'There was a problem when deleting. Please try again.', 'buddypress' ) . '</p></div>' );
     1212    }
    12051213
    12061214    /** This action is documented in bp-activity/bp-activity-actions.php */
    … …  
    12241232
    12251233    // Check that user is logged in, Activity Streams are enabled, and Akismet is present.
    1226     if ( ! is_user_logged_in() || ! bp_is_active( 'activity' ) || empty( $bp->activity->akismet ) )
     1234    if ( ! is_user_logged_in() || ! bp_is_active( 'activity' ) || empty( $bp->activity->akismet ) ) {
    12271235        exit( '-1' );
     1236    }
    12281237
    12291238    // Check an item ID was passed.
    1230     if ( empty( $_POST['id'] ) || ! is_numeric( $_POST['id'] ) )
     1239    if ( empty( $_POST['id'] ) || ! is_numeric( $_POST['id'] ) ) {
    12311240        exit( '-1' );
     1241    }
    12321242
    12331243    // Is the current user allowed to spam items?
    1234     if ( ! bp_activity_user_can_mark_spam() )
     1244    if ( ! bp_activity_user_can_mark_spam() ) {
    12351245        exit( '-1' );
     1246    }
    12361247
    12371248    // Load up the activity item.
    12381249    $activity = new BP_Activity_Activity( (int) $_POST['id'] );
    1239     if ( empty( $activity->component ) )
     1250    if ( empty( $activity->component ) ) {
    12401251        exit( '-1' );
     1252    }
    12411253
    12421254    // Check nonce.
    … …  
    13461358    $activity = ! empty( $activity_array['activities'][0] ) ? $activity_array['activities'][0] : false;
    13471359
    1348     if ( empty( $activity ) )
     1360    if ( empty( $activity ) ) {
    13491361        exit; // @todo: error?
     1362    }
    13501363
    13511364    /**
    … …  
    13641377    $content = apply_filters_ref_array( 'bp_get_activity_content_body', array( $activity->content, &$activity ) );
    13651378
     1379    // phpcs:ignore WordPress.Security.EscapeOutput
    13661380    exit( $content );
    13671381}
    … …  
    13811395    check_ajax_referer( 'groups_invite_uninvite_user' );
    13821396
    1383     if ( ! $_POST['friend_id'] || ! $_POST['friend_action'] || ! $_POST['group_id'] )
    1384         return;
    1385 
    1386     if ( ! bp_groups_user_can_send_invites( $_POST['group_id'] ) )
    1387         return;
     1397    if ( ! $_POST['friend_id'] || ! $_POST['friend_action'] || ! $_POST['group_id'] ) {
     1398        return;
     1399    }
     1400
     1401    if ( ! bp_groups_user_can_send_invites( $_POST['group_id'] ) ) {
     1402        return;
     1403    }
    13881404
    13891405    $group_id = (int) $_POST['group_id'];
    … …  
    14241440        }
    14251441
     1442        // phpcs:disable WordPress.Security.EscapeOutput
    14261443        echo '<li id="uid-' . esc_attr( $user->id ) . '">';
    14271444        echo $user->avatar_thumb;
    … …  
    14291446        echo '<span class="activity">' . esc_attr( $user->last_active ) . '</span>';
    14301447        echo '<div class="action">
    1431                 <a class="button remove" href="' . wp_nonce_url( $uninvite_url, 'groups_invite_uninvite_user' ) . '" id="uid-' . esc_attr( $user->id ) . '">' . __( 'Remove Invite', 'buddypress' ) . '</a>
     1448                <a class="button remove" href="' . esc_url( wp_nonce_url( $uninvite_url, 'groups_invite_uninvite_user' ) ) . '" id="uid-' . esc_attr( $user->id ) . '">' . esc_html__( 'Remove Invite', 'buddypress' ) . '</a>
    14321449              </div>';
    14331450
    14341451        if ( 'is_pending' == $user_status ) {
    14351452            /* translators: %s: user link */
    1436             echo '<p class="description">' . sprintf( __( '%s has previously requested to join this group. Sending an invitation will automatically add the member to the group.', 'buddypress' ), $user->user_link ) . '</p>';
     1453            echo '<p class="description">' . sprintf( esc_html__( '%s has previously requested to join this group. Sending an invitation will automatically add the member to the group.', 'buddypress' ), $user->user_link ) . '</p>';
    14371454        }
    14381455
    14391456        echo '</li>';
     1457        // phpcs:enable
    14401458        exit;
    14411459
    … …  
    14761494    $user = get_user_by( 'id', $friend_id );
    14771495    if ( ! $user ) {
    1478         die( __( 'No member found by that ID.', 'buddypress' ) );
     1496        die( esc_html__( 'No member found by that ID.', 'buddypress' ) );
    14791497    }
    14801498
    … …  
    14841502
    14851503        if ( ! friends_remove_friend( bp_loggedin_user_id(), $friend_id ) ) {
    1486             echo __( 'Friendship could not be canceled.', 'buddypress' );
     1504            esc_html_e( 'Friendship could not be canceled.', 'buddypress' );
    14871505        } else {
    14881506            $url = bp_loggedin_user_url( bp_members_get_path_chunks( array( bp_get_friends_slug(), 'add-friend', array( $friend_id ) ) ) );
    1489             echo '<a id="friend-' . esc_attr( $friend_id ) . '" class="friendship-button not_friends add" rel="add" href="' . wp_nonce_url( $url, 'friends_add_friend' ) . '">' . __( 'Add Friend', 'buddypress' ) . '</a>';
     1507            echo '<a id="friend-' . esc_attr( $friend_id ) . '" class="friendship-button not_friends add" rel="add" href="' . esc_url( wp_nonce_url( $url, 'friends_add_friend' ) ) . '">' . esc_html__( 'Add Friend', 'buddypress' ) . '</a>';
    14901508        }
    14911509
    … …  
    14951513
    14961514        if ( ! friends_add_friend( bp_loggedin_user_id(), $friend_id ) ) {
    1497             echo __(' Friendship could not be requested.', 'buddypress' );
     1515            esc_html_e(' Friendship could not be requested.', 'buddypress' );
    14981516        } else {
    14991517            $url = bp_loggedin_user_url( bp_members_get_path_chunks( array( bp_get_friends_slug(), 'requests', array( 'cancel', $friend_id ) ) ) );
    1500             echo '<a id="friend-' . esc_attr( $friend_id ) . '" class="remove friendship-button pending_friend requested" rel="remove" href="' . wp_nonce_url( $url, 'friends_withdraw_friendship' ) . '" class="requested">' . __( 'Cancel Friendship Request', 'buddypress' ) . '</a>';
     1518            echo '<a id="friend-' . esc_attr( $friend_id ) . '" class="remove friendship-button pending_friend requested" rel="remove" href="' . esc_url( wp_nonce_url( $url, 'friends_withdraw_friendship' ) ) . '" class="requested">' . esc_html__( 'Cancel Friendship Request', 'buddypress' ) . '</a>';
    15011519        }
    15021520
    … …  
    15071525        if ( friends_withdraw_friendship( bp_loggedin_user_id(), $friend_id ) ) {
    15081526            $url = bp_loggedin_user_url( bp_members_get_path_chunks( array( bp_get_friends_slug(), 'add-friend', array( $friend_id ) ) ) );
    1509             echo '<a id="friend-' . esc_attr( $friend_id ) . '" class="friendship-button not_friends add" rel="add" href="' . wp_nonce_url( $url, 'friends_add_friend' ) . '">' . __( 'Add Friend', 'buddypress' ) . '</a>';
     1527            echo '<a id="friend-' . esc_attr( $friend_id ) . '" class="friendship-button not_friends add" rel="add" href="' . esc_url( wp_nonce_url( $url, 'friends_add_friend' ) ) . '">' . esc_html__( 'Add Friend', 'buddypress' ) . '</a>';
    15101528        } else {
    1511             echo __("Friendship request could not be cancelled.", 'buddypress');
     1529            esc_html_e("Friendship request could not be cancelled.", 'buddypress');
    15121530        }
    15131531
    15141532    // Request already pending.
    15151533    } else {
    1516         echo __( 'Request Pending', 'buddypress' );
     1534        esc_html_e( 'Request Pending', 'buddypress' );
    15171535    }
    15181536
    … …  
    15351553
    15361554    if ( ! friends_accept_friendship( (int) $_POST['id'] ) )
    1537         echo "-1<div id='message' class='error'><p>" . __( 'There was a problem accepting that request. Please try again.', 'buddypress' ) . '</p></div>';
     1555        echo "-1<div id='message' class='error'><p>" . esc_html__( 'There was a problem accepting that request. Please try again.', 'buddypress' ) . '</p></div>';
    15381556
    15391557    exit;
    … …  
    15551573
    15561574    if ( ! friends_reject_friendship( (int) $_POST['id'] ) )
    1557         echo "-1<div id='message' class='error'><p>" . __( 'There was a problem rejecting that request. Please try again.', 'buddypress' ) . '</p></div>';
     1575        echo "-1<div id='message' class='error'><p>" . esc_html__( 'There was a problem rejecting that request. Please try again.', 'buddypress' ) . '</p></div>';
    15581576
    15591577    exit;
    … …  
    16101628
    16111629            if ( ! groups_join_group( $group->id ) ) {
    1612                 _e( 'Error joining group', 'buddypress' );
     1630                esc_html_e( 'Error joining group', 'buddypress' );
    16131631            } else {
    16141632                $leave_url = wp_nonce_url(
    … …  
    16191637                    'groups_leave_group'
    16201638                );
    1621                 echo '<a id="group-' . esc_attr( $group->id ) . '" class="group-button leave-group" rel="leave" href="' . esc_url( $leave_url ) . '">' . __( 'Leave Group', 'buddypress' ) . '</a>';
     1639                echo '<a id="group-' . esc_attr( $group->id ) . '" class="group-button leave-group" rel="leave" href="' . esc_url( $leave_url ) . '">' . esc_html__( 'Leave Group', 'buddypress' ) . '</a>';
    16221640            }
    16231641        break;
    … …  
    16311649
    16321650            if ( ! groups_accept_invite( bp_loggedin_user_id(), $group->id ) ) {
    1633                 _e( 'Error requesting membership', 'buddypress' );
     1651                esc_html_e( 'Error requesting membership', 'buddypress' );
    16341652            } else {
    16351653                $leave_url = wp_nonce_url(
    … …  
    16401658                    'groups_leave_group'
    16411659                );
    1642                 echo '<a id="group-' . esc_attr( $group->id ) . '" class="group-button leave-group" rel="leave" href="' . esc_url( $leave_url ) . '">' . __( 'Leave Group', 'buddypress' ) . '</a>';
     1660                echo '<a id="group-' . esc_attr( $group->id ) . '" class="group-button leave-group" rel="leave" href="' . esc_url( $leave_url ) . '">' . esc_html__( 'Leave Group', 'buddypress' ) . '</a>';
    16431661            }
    16441662        break;
    … …  
    16481666
    16491667            if ( ! groups_send_membership_request( [ 'user_id' => bp_loggedin_user_id(), 'group_id' => $group->id ] ) ) {
    1650                 _e( 'Error requesting membership', 'buddypress' );
     1668                esc_html_e( 'Error requesting membership', 'buddypress' );
    16511669            } else {
    1652                 echo '<a id="group-' . esc_attr( $group->id ) . '" class="group-button disabled pending membership-requested" rel="membership-requested" href="' . esc_url( bp_get_group_url( $group ) ) . '">' . __( 'Request Sent', 'buddypress' ) . '</a>';
     1670                echo '<a id="group-' . esc_attr( $group->id ) . '" class="group-button disabled pending membership-requested" rel="membership-requested" href="' . esc_url( bp_get_group_url( $group ) ) . '">' . esc_html__( 'Request Sent', 'buddypress' ) . '</a>';
    16531671            }
    16541672        break;
    … …  
    16581676
    16591677            if ( ! groups_leave_group( $group->id ) ) {
    1660                 _e( 'Error leaving group', 'buddypress' );
     1678                esc_html_e( 'Error leaving group', 'buddypress' );
    16611679            } elseif ( 'public' === $group->status ) {
    16621680                $join_url = wp_nonce_url(
    … …  
    16671685                    'groups_join_group'
    16681686                );
    1669                 echo '<a id="group-' . esc_attr( $group->id ) . '" class="group-button join-group" rel="join" href="' . esc_url( $join_url ) . '">' . __( 'Join Group', 'buddypress' ) . '</a>';
     1687                echo '<a id="group-' . esc_attr( $group->id ) . '" class="group-button join-group" rel="join" href="' . esc_url( $join_url ) . '">' . esc_html__( 'Join Group', 'buddypress' ) . '</a>';
    16701688            } else {
    16711689                $request_url = wp_nonce_url(
    … …  
    16761694                    'groups_request_membership'
    16771695                );
    1678                 echo '<a id="group-' . esc_attr( $group->id ) . '" class="group-button request-membership" rel="join" href="' . esc_url( $request_url ) . '">' . __( 'Request Membership', 'buddypress' ) . '</a>';
     1696                echo '<a id="group-' . esc_attr( $group->id ) . '" class="group-button request-membership" rel="join" href="' . esc_url( $request_url ) . '">' . esc_html__( 'Request Membership', 'buddypress' ) . '</a>';
    16791697            }
    16801698        break;
    … …  
    16991717
    17001718    if ( ! $nonce_check || ! isset( $_POST['notice_id'] ) ) {
    1701         echo "-1<div id='message' class='error'><p>" . __( 'There was a problem closing the notice.', 'buddypress' ) . '</p></div>';
     1719        echo "-1<div id='message' class='error'><p>" . esc_html__( 'There was a problem closing the notice.', 'buddypress' ) . '</p></div>';
    17021720
    17031721    } else {
    … …  
    17261744    // Cannot respond to a thread you're not already a recipient on.
    17271745    if ( ! bp_current_user_can( 'bp_moderate' ) && ( ! messages_is_valid_thread( $thread_id ) || ! messages_check_thread_access( $thread_id ) ) ) {
    1728         echo "-1<div id='message' class='error'><p>" . __( 'There was a problem sending that reply. Please try again.', 'buddypress' ) . '</p></div>';
     1746        echo "-1<div id='message' class='error'><p>" . esc_html__( 'There was a problem sending that reply. Please try again.', 'buddypress' ) . '</p></div>';
    17291747        die;
    17301748    }
    … …  
    17321750    $result = messages_new_message( array( 'thread_id' => $thread_id, 'content' => $_REQUEST['content'] ) );
    17331751
    1734     if ( !empty( $result ) ) {
     1752    if ( ! empty( $result ) ) {
    17351753
    17361754        // Pretend we're in the message loop.
    … …  
    17661784
    17671785    } else {
    1768         echo "-1<div id='message' class='error'><p>" . __( 'There was a problem sending that reply. Please try again.', 'buddypress' ) . '</p></div>';
     1786        echo "-1<div id='message' class='error'><p>" . esc_html__( 'There was a problem sending that reply. Please try again.', 'buddypress' ) . '</p></div>';
    17691787    }
    17701788
    … …  
    20972115    if ( $message ) {
    20982116        // Surround the message with `<p>` tags.
    2099         echo wpautop( $message );
     2117        $message = wpautop( $message );
     2118
     2119        echo wp_kses(
     2120            $message,
     2121            array(
     2122                'p' => true,
     2123                'a' => array(
     2124                    'href' => true,
     2125                ),
     2126            )
     2127        );
    21002128    }
    21012129}
    … …  
    21142142    if ( $message ) {
    21152143        // Surround the message with `<p>` tags.
    2116         echo wpautop( $message );
     2144        $message = wpautop( $message );
     2145
     2146        echo wp_kses(
     2147            $message,
     2148            array(
     2149                'p' => true,
     2150                'a' => array(
     2151                    'href' => true,
     2152                ),
     2153            )
     2154        );
    21172155    }
    21182156}
Note: See TracChangeset for help on using the changeset viewer.