Changeset 13826 for trunk/src/bp-members/bp-members-blocks.php

Timestamp:

04/30/2024 09:55:17 PM (2 years ago)

Author:

imath

Message:

Dynamic Members/Friends/Groups blocks: improve output escaping

(trunk)

File:

• trunk/src/bp-members/bp-members-blocks.php (modified) (2 diffs)

trunk/src/bp-members/bp-members-blocks.php

@@ -493 +493 @@
                                         'php',
                                         array(
-                                                'data.link'              => bp_members_get_user_url( $user->ID ),
-                                                'data.name'              => $user->display_name,
+                                                'data.link'              => esc_url( bp_members_get_user_url( $user->ID ) ),
+                                                'data.name'              => esc_html( $user->display_name ),
                                                 'data.avatar_urls.thumb' => bp_core_fetch_avatar(
                                                         array(
@@ -505 +505 @@
                                                                 /* translators: %s: member name */
                                                                 __( 'Profile picture of %s', 'buddypress' ),
-                                                                $user->display_name
+                                                                esc_html( $user->display_name )
                                                         )
                                                 ),
                                                 'data.id'                => $user->ID,
-                                                'data.extra'             => $extra,
+                                                'data.extra'             => esc_html( $extra ),
                                         )
                                 );