Changeset 1473 for branches/1.0/bp-groups/bp-groups-templatetags.php

Timestamp:

05/08/2009 12:02:11 PM (17 years ago)

Author:

apeatling

Message:

Applying security enhancement patch - props markjaquith.

File:

• branches/1.0/bp-groups/bp-groups-templatetags.php (modified) (3 diffs)

branches/1.0/bp-groups/bp-groups-templatetags.php

@@ -57 +57 @@
                 case 1: ?>
                         <label for="group-name">* <?php _e('Group Name', 'buddypress') ?></label>
-                        <input type="text" name="group-name" id="group-name" value="<?php echo ( $group_obj ) ? $group_obj->name : $_POST['group-name']; ?>" />
+                        <input type="text" name="group-name" id="group-name" value="<?php echo attribute_escape( ( $group_obj ) ? $group_obj->name : $_POST['group-name'] ); ?>" />
                 
                         <label for="group-desc">* <?php _e('Group Description', 'buddypress') ?></label>
-                        <textarea name="group-desc" id="group-desc"><?php echo ( $group_obj ) ? $group_obj->description : $_POST['group-desc']; ?></textarea>
+                        <textarea name="group-desc" id="group-desc"><?php echo htmlspecialchars( ( $group_obj ) ? $group_obj->description : $_POST['group-desc'] ); ?></textarea>
                 
                         <label for="group-news"><?php _e('Recent News', 'buddypress') ?></label>
-                        <textarea name="group-news" id="group-news"><?php echo ( $group_obj ) ? $group_obj->news : $_POST['group-news']; ?></textarea>
+                        <textarea name="group-news" id="group-news"><?php echo htmlspecialchars( ( $group_obj ) ? $group_obj->news : $_POST['group-news'] ); ?></textarea>
                         
                         <?php do_action( 'groups_custom_group_fields_editable' ) ?>
@@ -233 +233 @@
                                         ?>
                                         
-                                        <li><input<?php echo $checked ?> type="checkbox" name="friends[]" id="f-<?php echo $friends[$i]['id'] ?>" value="<?php echo $friends[$i]['id'] ?>" /> <?php echo $friends[$i]['full_name']; ?></li>
+                                        <li><input<?php echo $checked ?> type="checkbox" name="friends[]" id="f-<?php echo $friends[$i]['id'] ?>" value="<?php echo attribute_escape( $friends[$i]['id'] ); ?>" /> <?php echo $friends[$i]['full_name']; ?></li>
                                         <?php } ?>
                                 </ul>
@@ -1513 +1513 @@
                 <?php bp_group_list_invite_friends() ?>
                 <?php wp_nonce_field( 'groups_invite_uninvite_user', '_wpnonce_invite_uninvite_user' ) ?>
-                <input type="hidden" name="group_id" id="group_id" value="<?php echo $group->id ?>" />
+                <input type="hidden" name="group_id" id="group_id" value="<?php echo attribute_escape( $group->id ) ?>" />
         </div>