Skip to:
Content

BuddyPress.org

Changeset 2288


Ignore:
Timestamp:
01/10/2010 09:55:51 PM (17 years ago)
Author:
apeatling
Message:

Fixing escaped allowed HTML in forum posts. Adding mention filters to blog comments and forum posts.

Location:
trunk
Files:
5 edited

Legend:

Unmodified
Added
Removed

  • trunk/bp-activity/bp-activity-filters.php

    r2287 r2288  
    5959        $activity_allowedtags['img']['class'] = array();
    6060        $activity_allowedtags['img']['id'] = array();
     61        $activity_allowedtags['code'] = array();
    6162
     63        $activity_allowedtags = apply_filters( 'bp_activity_allowed_tags', $activity_allowedtags );
    6264        return wp_kses( $content, $activity_allowedtags );
    6365}
    … …  
    8890add_filter( 'bp_activity_new_update_content', 'bp_activity_at_name_filter' );
    8991add_filter( 'groups_activity_new_update_content', 'bp_activity_at_name_filter' );
    90 add_filter( 'bp_activity_comment_content', 'bp_activity_at_name_filter' );
    91 add_filter( 'bp_get_activity_feed_item_description', 'bp_activity_at_name_filter' );
     92add_filter( 'pre_comment_content', 'bp_activity_at_name_filter' );
     93add_filter( 'group_forum_topic_text_before_save', 'bp_activity_at_name_filter' );
     94add_filter( 'group_forum_post_text_before_save', 'bp_activity_at_name_filter' );
    9295
    9396?>

  • trunk/bp-activity/bp-activity-templatetags.php

    r2287 r2288  
    351351
    352352        /* Add the permalink */
    353         $meta = ' &middot; <a href="' . bp_activity_get_permalink( $activities_template->activity->id, $activities_template->activity ) . '" class="view" title="' . __( 'View Thread / Permalink', 'buddypress' ) . '">#</a>';
     353        $meta = ' &middot; <a href="' . bp_activity_get_permalink( $activities_template->activity->id, $activities_template->activity ) . '" class="view" title="' . __( 'View Thread / Permalink', 'buddypress' ) . '">' . __( 'View', 'buddypress' ) . '</a>';
    354354
    355355        /* Add the delete link if the user has permission on this item */

  • trunk/bp-forums.php

    r2239 r2288  
    195195                'topic_title' => '',
    196196                'topic_slug' => '',
     197                'topic_text' => '',
    197198                'topic_poster' => $bp->loggedin_user->id, // accepts ids
    198199                'topic_poster_name' => $bp->loggedin_user->fullname, // accept names
    … …  
    243244
    244245        /* Update the first post */
    245         if ( !$post = bb_insert_post( array( 'post_id' => $post->post_id, 'topic_id' => $topic_id, 'post_text' => $topic_text, 'post_time' => $post->post_time, 'poster_id' => $post->poster_id, 'poster_ip' => $post->poster_ip, 'post_status' => $post->post_status, 'post_position' => $post->post_position ) ) )
     246        if ( !$post = bp_forums_insert_post( array( 'post_id' => $post->post_id, 'topic_id' => $topic_id, 'post_text' => $topic_text, 'post_time' => $post->post_time, 'poster_id' => $post->poster_id, 'poster_ip' => $post->poster_ip, 'post_status' => $post->post_status, 'post_position' => $post->post_position ) ) )
    246247                return false;
    247248

  • trunk/bp-forums/bp-forums-filters.php

    r2198 r2288  
    55add_filter( 'bp_forums_bbconfig_location', 'attribute_escape', 1 );
    66
    7 add_filter( 'bp_get_the_topic_title', 'wp_filter_kses', 1 );
    8 add_filter( 'bp_get_the_topic_latest_post_excerpt', 'wp_filter_kses', 1 );
    9 add_filter( 'bp_get_the_topic_post_content', 'wp_filter_kses', 1 );
    10 
    11 add_filter( 'bp_get_the_topic_title', 'attribute_escape' );
    12 add_filter( 'bp_get_the_topic_post_content', 'attribute_escape' );
     7add_filter( 'bp_get_the_topic_title', 'bp_forums_filter_kses', 1 );
     8add_filter( 'bp_get_the_topic_latest_post_excerpt', 'bp_forums_filter_kses', 1 );
     9add_filter( 'bp_get_the_topic_post_content', 'bp_forums_filter_kses', 1 );
    1310
    1411add_filter( 'bp_get_the_topic_title', 'wptexturize' );
    … …  
    3835add_filter( 'bp_get_forum_topic_count', 'number_format' );
    3936
    40 function bp_forums_add_allowed_tags( $allowedtags ) {
    41         $allowedtags['p'] = array();
    42         $allowedtags['br'] = array();
     37function bp_forums_filter_kses( $content ) {
     38        global $allowedtags;
    4339
    44         return $allowedtags;
     40        $forums_allowedtags = $allowedtags;
     41        $forums_allowedtags['span'] = array();
     42        $forums_allowedtags['span']['class'] = array();
     43        $forums_allowedtags['div'] = array();
     44        $forums_allowedtags['div']['class'] = array();
     45        $forums_allowedtags['div']['id'] = array();
     46        $forums_allowedtags['a']['class'] = array();
     47        $forums_allowedtags['img'] = array();
     48        $forums_allowedtags['br'] = array();
     49        $forums_allowedtags['p'] = array();
     50        $forums_allowedtags['img']['src'] = array();
     51        $forums_allowedtags['img']['alt'] = array();
     52        $forums_allowedtags['img']['class'] = array();
     53        $forums_allowedtags['img']['width'] = array();
     54        $forums_allowedtags['img']['height'] = array();
     55        $forums_allowedtags['img']['class'] = array();
     56        $forums_allowedtags['img']['id'] = array();
     57        $forums_allowedtags['code'] = array();
     58        $forums_allowedtags['blockquote'] = array();
     59
     60        $forums_allowedtags = apply_filters( 'bp_forums_allowed_tags', $forums_allowedtags );
     61        return wp_kses( $content, $forums_allowedtags );
    4562}
    46 add_filter( 'edit_allowedtags', 'bp_forums_add_allowed_tags' );
    4763
    4864function bp_forums_filter_tag_link( $link, $tag, $page, $context ) {

  • trunk/bp-groups.php

    r2285 r2288  
    20822082                return false;
    20832083
     2084        $post_text = apply_filters( 'group_forum_post_text_before_save', $post_text );
     2085        $topic_id = apply_filters( 'group_forum_post_topic_id_before_save', $topic_id );
     2086
    20842087        if ( $forum_post = bp_forums_insert_post( array( 'post_text' => $post_text, 'topic_id' => $topic_id ) ) ) {
    20852088                $topic = bp_forums_get_topic_details( $topic_id );
    20862089
    20872090                $activity_content = sprintf( __( '%s posted on the forum topic %s in the group %s:', 'buddypress'), bp_core_get_userlink( $bp->loggedin_user->id ), '<a href="' . bp_get_group_permalink( $bp->groups->current_group ) . 'forum/topic/' . $topic->topic_slug .'/">' . attribute_escape( $topic->topic_title ) . '</a>', '<a href="' . bp_get_group_permalink( $bp->groups->current_group ) . '">' . attribute_escape( $bp->groups->current_group->name ) . '</a>' );
    2088                 $activity_content .= '<blockquote>' . bp_create_excerpt( attribute_escape( $post_text ) ) . '</blockquote>';
     2091                $activity_content .= '<blockquote>' . bp_create_excerpt( $post_text ) . '</blockquote>';
    20892092
    20902093                /* Record this in activity streams */
    … …  
    21112114                return false;
    21122115
     2116        $topic_title = apply_filters( 'group_forum_topic_title_before_save', $topic_title );
     2117        $topic_text = apply_filters( 'group_forum_topic_text_before_save', $topic_text );
     2118        $topic_tags = apply_filters( 'group_forum_topic_tags_before_save', $topic_tags );
     2119        $forum_id = apply_filters( 'group_forum_topic_forum_id_before_save', $forum_id );
     2120
    21132121        if ( $topic_id = bp_forums_new_topic( array( 'topic_title' => $topic_title, 'topic_text' => $topic_text, 'topic_tags' => $topic_tags, 'forum_id' => $forum_id ) ) ) {
    21142122                $topic = bp_forums_get_topic_details( $topic_id );
    21152123
    21162124                $activity_content = sprintf( __( '%s started the forum topic %s in the group %s:', 'buddypress'), bp_core_get_userlink( $bp->loggedin_user->id ), '<a href="' . bp_get_group_permalink( $bp->groups->current_group ) . 'forum/topic/' . $topic->topic_slug .'/">' . attribute_escape( $topic->topic_title ) . '</a>', '<a href="' . bp_get_group_permalink( $bp->groups->current_group ) . '">' . attribute_escape( $bp->groups->current_group->name ) . '</a>' );
    2117                 $activity_content .= '<blockquote>' . bp_create_excerpt( attribute_escape( $topic_text ) ) . '</blockquote>';
     2125                $activity_content .= '<blockquote>' . bp_create_excerpt( $topic_text ) . '</blockquote>';
    21182126
    21192127                /* Record this in activity streams */
    … …  
    21372145        global $bp;
    21382146
     2147        $topic_title = apply_filters( 'group_forum_topic_title_before_save', $topic_title );
     2148        $topic_text = apply_filters( 'group_forum_topic_text_before_save', $topic_text );
     2149
    21392150        if ( $topic = bp_forums_update_topic( array( 'topic_title' => $topic_title, 'topic_text' => $topic_text, 'topic_id' => $topic_id ) ) ) {
    21402151                /* Update the activity stream item */
    … …  
    21432154
    21442155                $activity_content = sprintf( __( '%s started the forum topic %s in the group %s:', 'buddypress'), bp_core_get_userlink( $topic->topic_poster ), '<a href="' . bp_get_group_permalink( $bp->groups->current_group ) . 'forum/topic/' . $topic->topic_slug .'/">' . attribute_escape( $topic->topic_title ) . '</a>', '<a href="' . bp_get_group_permalink( $bp->groups->current_group ) . '">' . attribute_escape( $bp->groups->current_group->name ) . '</a>' );
    2145                 $activity_content .= '<blockquote>' . bp_create_excerpt( attribute_escape( $topic_text ) ) . '</blockquote>';
     2156                $activity_content .= '<blockquote>' . bp_create_excerpt( $topic_text ) . '</blockquote>';
    21462157
    21472158                /* Record this in activity streams */
    … …  
    21672178        global $bp;
    21682179
     2180        $post_text = apply_filters( 'group_forum_post_text_before_save', $post_text );
     2181        $topic_id = apply_filters( 'group_forum_post_topic_id_before_save', $topic_id );
     2182
    21692183        $post = bp_forums_get_post( $post_id );
    21702184
    … …  
    21772191
    21782192                $activity_content = sprintf( __( '%s posted on the forum topic %s in the group %s:', 'buddypress'), bp_core_get_userlink( $post->poster_id ), '<a href="' . bp_get_group_permalink( $bp->groups->current_group ) . 'forum/topic/' . $topic->topic_slug .'">' . attribute_escape( $topic->topic_title ) . '</a>', '<a href="' . bp_get_group_permalink( $bp->groups->current_group ) . '">' . attribute_escape( $bp->groups->current_group->name ) . '</a>' );
    2179                 $activity_content .= '<blockquote>' . bp_create_excerpt( attribute_escape( $post_text ) ) . '</blockquote>';
     2193                $activity_content .= '<blockquote>' . bp_create_excerpt( $post_text ) . '</blockquote>';
    21802194
    21812195                /* Record this in activity streams */
Note: See TracChangeset for help on using the changeset viewer.