Changeset 13826 for trunk/src/bp-members/bp-members-blocks.php

Timestamp:

04/30/2024 09:55:17 PM (20 months ago)

Author:

imath

Message:

Dynamic Members/Friends/Groups blocks: improve output escaping

(trunk)

File:

• trunk/src/bp-members/bp-members-blocks.php (modified) (2 diffs)

trunk/src/bp-members/bp-members-blocks.php

@@ -493 +493 @@
                     'php',
                     array(
-                        'data.link'              => bp_members_get_user_url( $user->ID ),
-                        'data.name'              => $user->display_name,
+                        'data.link'              => esc_url( bp_members_get_user_url( $user->ID ) ),
+                        'data.name'              => esc_html( $user->display_name ),
                         'data.avatar_urls.thumb' => bp_core_fetch_avatar(
                             array(
@@ -505 +505 @@
                                 /* translators: %s: member name */
                                 __( 'Profile picture of %s', 'buddypress' ),
-                                $user->display_name
+                                esc_html( $user->display_name )
                             )
                         ),
                         'data.id'                => $user->ID,
-                        'data.extra'             => $extra,
+                        'data.extra'             => esc_html( $extra ),
                     )
                 );