Changeset 1483 for branches/1.0/bp-groups/bp-groups-templatetags.php

Timestamp:

05/15/2009 07:24:11 PM (17 years ago)

Author:

apeatling

Message:

Fixing vulnerability in group avatars.

File:

• branches/1.0/bp-groups/bp-groups-templatetags.php (modified) (6 diffs)

branches/1.0/bp-groups/bp-groups-templatetags.php

@@ -274 +274 @@
         
         if ( $group_obj->avatar_full ) { ?>
-                <img src="<?php echo $group_obj->avatar_full ?>" alt="<?php _e( 'Group Avatar', 'buddypress' ) ?>" class="avatar" />
+                <img src="<?php echo attribute_escape( $group_obj->avatar_full ) ?>" alt="<?php _e( 'Group Avatar', 'buddypress' ) ?>" class="avatar" />
         <?php } else { ?>
                 <img src="<?php echo $bp->groups->image_base . '/none.gif' ?>" alt="<?php _e( 'No Group Avatar', 'buddypress' ) ?>" class="avatar" />
@@ -307 +307 @@
                         <li>
                                 <div class="item-avatar">
-                                        <a href="<?php echo bp_get_group_permalink( $group ) ?>" title="<?php echo $group->name ?>"><img src="<?php echo $group->avatar_thumb ?>" class="avatar" alt="<?php printf( __( '%s Avatar', 'buddypress' ), $group->name ) ?>" /></a>
+                                        <a href="<?php echo bp_get_group_permalink( $group ) ?>" title="<?php echo $group->name ?>"><img src="<?php echo attribute_escape( $group->avatar_thumb ) ?>" class="avatar" alt="<?php printf( __( '%s Avatar', 'buddypress' ), $group->name ) ?>" /></a>
                                 </div>
 
@@ -361 +361 @@
                                 }
                         ?>                              <li>
-                                        <a href="<?php echo bp_get_group_permalink( $group ) ?>"><img src="<?php echo $group->avatar_thumb; ?>" class="avatar" alt="<?php _e( 'Group Avatar', 'buddypress' ) ?>" /></a>
+                                        <a href="<?php echo bp_get_group_permalink( $group ) ?>"><img src="<?php echo attribute_escape( $group->avatar_thumb ); ?>" class="avatar" alt="<?php _e( 'Group Avatar', 'buddypress' ) ?>" /></a>
                                         <h5><a href="<?php echo bp_get_group_permalink( $group ) ?>"><?php echo $group->name ?></a></h5>
                                 </li>
@@ -706 +706 @@
                         $group =& $groups_template->group;
 
-                return apply_filters( 'bp_get_group_avatar', '<img src="' . $group->avatar_full . '" class="avatar" alt="' . $group->name . '" />', $group->avatar_full, $group->avatar_name );
+                return apply_filters( 'bp_get_group_avatar', '<img src="' . attribute_escape( $group->avatar_full ) . '" class="avatar" alt="' . attribute_escape( $group->name ) . '" />', $group->avatar_full, $group->avatar_name );
         }
 
@@ -718 +718 @@
                         $group =& $groups_template->group;
 
-                return apply_filters( 'bp_get_group_avatar_thumb', '<img src="' . $group->avatar_thumb . '" class="avatar" alt="' . $group->name . '" />', $group->avatar_thumb, $group->avatar_name );
+                return apply_filters( 'bp_get_group_avatar_thumb', '<img src="' . attribute_escape( $group->avatar_thumb ) . '" class="avatar" alt="' . attribute_escape( $group->name ) . '" />', $group->avatar_thumb, $group->avatar_name );
         }
 
@@ -730 +730 @@
                         $group =& $groups_template->group;
 
-                return apply_filters( 'bp_get_group_avatar_mini', '<img src="' . $group->avatar_thumb . '" class="avatar" width="30" height="30" alt="' . $group->name . '" />', $group->avatar_thumb, $group->avatar_name );
+                return apply_filters( 'bp_get_group_avatar_mini', '<img src="' . attribute_escape( $group->avatar_thumb ) . '" class="avatar" width="30" height="30" alt="' . attribute_escape( $group->name ) . '" />', $group->avatar_thumb, $group->avatar_name );
         }