Skip to:
Content

BuddyPress.org

Changeset 2288


Ignore:
Timestamp:
01/10/2010 09:55:51 PM (16 years ago)
Author:
apeatling
Message:

Fixing escaped allowed HTML in forum posts. Adding mention filters to blog comments and forum posts.

Location:
trunk
Files:
5 edited

Legend:

Unmodified
Added
Removed

  • trunk/bp-activity/bp-activity-filters.php

    r2287 r2288  
    5959    $activity_allowedtags['img']['class'] = array();
    6060    $activity_allowedtags['img']['id'] = array();
     61    $activity_allowedtags['code'] = array();
    6162
     63    $activity_allowedtags = apply_filters( 'bp_activity_allowed_tags', $activity_allowedtags );
    6264    return wp_kses( $content, $activity_allowedtags );
    6365}
    … …  
    8890add_filter( 'bp_activity_new_update_content', 'bp_activity_at_name_filter' );
    8991add_filter( 'groups_activity_new_update_content', 'bp_activity_at_name_filter' );
    90 add_filter( 'bp_activity_comment_content', 'bp_activity_at_name_filter' );
    91 add_filter( 'bp_get_activity_feed_item_description', 'bp_activity_at_name_filter' );
     92add_filter( 'pre_comment_content', 'bp_activity_at_name_filter' );
     93add_filter( 'group_forum_topic_text_before_save', 'bp_activity_at_name_filter' );
     94add_filter( 'group_forum_post_text_before_save', 'bp_activity_at_name_filter' );
    9295
    9396?>

  • trunk/bp-activity/bp-activity-templatetags.php

    r2287 r2288  
    351351
    352352    /* Add the permalink */
    353     $meta = ' &middot; <a href="' . bp_activity_get_permalink( $activities_template->activity->id, $activities_template->activity ) . '" class="view" title="' . __( 'View Thread / Permalink', 'buddypress' ) . '">#</a>';
     353    $meta = ' &middot; <a href="' . bp_activity_get_permalink( $activities_template->activity->id, $activities_template->activity ) . '" class="view" title="' . __( 'View Thread / Permalink', 'buddypress' ) . '">' . __( 'View', 'buddypress' ) . '</a>';
    354354
    355355    /* Add the delete link if the user has permission on this item */

  • trunk/bp-forums.php

    r2239 r2288  
    195195        'topic_title' => '',
    196196        'topic_slug' => '',
     197        'topic_text' => '',
    197198        'topic_poster' => $bp->loggedin_user->id, // accepts ids
    198199        'topic_poster_name' => $bp->loggedin_user->fullname, // accept names
    … …  
    243244
    244245    /* Update the first post */
    245     if ( !$post = bb_insert_post( array( 'post_id' => $post->post_id, 'topic_id' => $topic_id, 'post_text' => $topic_text, 'post_time' => $post->post_time, 'poster_id' => $post->poster_id, 'poster_ip' => $post->poster_ip, 'post_status' => $post->post_status, 'post_position' => $post->post_position ) ) )
     246    if ( !$post = bp_forums_insert_post( array( 'post_id' => $post->post_id, 'topic_id' => $topic_id, 'post_text' => $topic_text, 'post_time' => $post->post_time, 'poster_id' => $post->poster_id, 'poster_ip' => $post->poster_ip, 'post_status' => $post->post_status, 'post_position' => $post->post_position ) ) )
    246247        return false;
    247248

  • trunk/bp-forums/bp-forums-filters.php

    r2198 r2288  
    55add_filter( 'bp_forums_bbconfig_location', 'attribute_escape', 1 );
    66
    7 add_filter( 'bp_get_the_topic_title', 'wp_filter_kses', 1 );
    8 add_filter( 'bp_get_the_topic_latest_post_excerpt', 'wp_filter_kses', 1 );
    9 add_filter( 'bp_get_the_topic_post_content', 'wp_filter_kses', 1 );
    10 
    11 add_filter( 'bp_get_the_topic_title', 'attribute_escape' );
    12 add_filter( 'bp_get_the_topic_post_content', 'attribute_escape' );
     7add_filter( 'bp_get_the_topic_title', 'bp_forums_filter_kses', 1 );
     8add_filter( 'bp_get_the_topic_latest_post_excerpt', 'bp_forums_filter_kses', 1 );
     9add_filter( 'bp_get_the_topic_post_content', 'bp_forums_filter_kses', 1 );
    1310
    1411add_filter( 'bp_get_the_topic_title', 'wptexturize' );
    … …  
    3835add_filter( 'bp_get_forum_topic_count', 'number_format' );
    3936
    40 function bp_forums_add_allowed_tags( $allowedtags ) {
    41     $allowedtags['p'] = array();
    42     $allowedtags['br'] = array();
     37function bp_forums_filter_kses( $content ) {
     38    global $allowedtags;
    4339
    44     return $allowedtags;
     40    $forums_allowedtags = $allowedtags;
     41    $forums_allowedtags['span'] = array();
     42    $forums_allowedtags['span']['class'] = array();
     43    $forums_allowedtags['div'] = array();
     44    $forums_allowedtags['div']['class'] = array();
     45    $forums_allowedtags['div']['id'] = array();
     46    $forums_allowedtags['a']['class'] = array();
     47    $forums_allowedtags['img'] = array();
     48    $forums_allowedtags['br'] = array();
     49    $forums_allowedtags['p'] = array();
     50    $forums_allowedtags['img']['src'] = array();
     51    $forums_allowedtags['img']['alt'] = array();
     52    $forums_allowedtags['img']['class'] = array();
     53    $forums_allowedtags['img']['width'] = array();
     54    $forums_allowedtags['img']['height'] = array();
     55    $forums_allowedtags['img']['class'] = array();
     56    $forums_allowedtags['img']['id'] = array();
     57    $forums_allowedtags['code'] = array();
     58    $forums_allowedtags['blockquote'] = array();
     59
     60    $forums_allowedtags = apply_filters( 'bp_forums_allowed_tags', $forums_allowedtags );
     61    return wp_kses( $content, $forums_allowedtags );
    4562}
    46 add_filter( 'edit_allowedtags', 'bp_forums_add_allowed_tags' );
    4763
    4864function bp_forums_filter_tag_link( $link, $tag, $page, $context ) {

  • trunk/bp-groups.php

    r2285 r2288  
    20822082        return false;
    20832083
     2084    $post_text = apply_filters( 'group_forum_post_text_before_save', $post_text );
     2085    $topic_id = apply_filters( 'group_forum_post_topic_id_before_save', $topic_id );
     2086
    20842087    if ( $forum_post = bp_forums_insert_post( array( 'post_text' => $post_text, 'topic_id' => $topic_id ) ) ) {
    20852088        $topic = bp_forums_get_topic_details( $topic_id );
    20862089
    20872090        $activity_content = sprintf( __( '%s posted on the forum topic %s in the group %s:', 'buddypress'), bp_core_get_userlink( $bp->loggedin_user->id ), '<a href="' . bp_get_group_permalink( $bp->groups->current_group ) . 'forum/topic/' . $topic->topic_slug .'/">' . attribute_escape( $topic->topic_title ) . '</a>', '<a href="' . bp_get_group_permalink( $bp->groups->current_group ) . '">' . attribute_escape( $bp->groups->current_group->name ) . '</a>' );
    2088         $activity_content .= '<blockquote>' . bp_create_excerpt( attribute_escape( $post_text ) ) . '</blockquote>';
     2091        $activity_content .= '<blockquote>' . bp_create_excerpt( $post_text ) . '</blockquote>';
    20892092
    20902093        /* Record this in activity streams */
    … …  
    21112114        return false;
    21122115
     2116    $topic_title = apply_filters( 'group_forum_topic_title_before_save', $topic_title );
     2117    $topic_text = apply_filters( 'group_forum_topic_text_before_save', $topic_text );
     2118    $topic_tags = apply_filters( 'group_forum_topic_tags_before_save', $topic_tags );
     2119    $forum_id = apply_filters( 'group_forum_topic_forum_id_before_save', $forum_id );
     2120
    21132121    if ( $topic_id = bp_forums_new_topic( array( 'topic_title' => $topic_title, 'topic_text' => $topic_text, 'topic_tags' => $topic_tags, 'forum_id' => $forum_id ) ) ) {
    21142122        $topic = bp_forums_get_topic_details( $topic_id );
    21152123
    21162124        $activity_content = sprintf( __( '%s started the forum topic %s in the group %s:', 'buddypress'), bp_core_get_userlink( $bp->loggedin_user->id ), '<a href="' . bp_get_group_permalink( $bp->groups->current_group ) . 'forum/topic/' . $topic->topic_slug .'/">' . attribute_escape( $topic->topic_title ) . '</a>', '<a href="' . bp_get_group_permalink( $bp->groups->current_group ) . '">' . attribute_escape( $bp->groups->current_group->name ) . '</a>' );
    2117         $activity_content .= '<blockquote>' . bp_create_excerpt( attribute_escape( $topic_text ) ) . '</blockquote>';
     2125        $activity_content .= '<blockquote>' . bp_create_excerpt( $topic_text ) . '</blockquote>';
    21182126
    21192127        /* Record this in activity streams */
    … …  
    21372145    global $bp;
    21382146
     2147    $topic_title = apply_filters( 'group_forum_topic_title_before_save', $topic_title );
     2148    $topic_text = apply_filters( 'group_forum_topic_text_before_save', $topic_text );
     2149
    21392150    if ( $topic = bp_forums_update_topic( array( 'topic_title' => $topic_title, 'topic_text' => $topic_text, 'topic_id' => $topic_id ) ) ) {
    21402151        /* Update the activity stream item */
    … …  
    21432154
    21442155        $activity_content = sprintf( __( '%s started the forum topic %s in the group %s:', 'buddypress'), bp_core_get_userlink( $topic->topic_poster ), '<a href="' . bp_get_group_permalink( $bp->groups->current_group ) . 'forum/topic/' . $topic->topic_slug .'/">' . attribute_escape( $topic->topic_title ) . '</a>', '<a href="' . bp_get_group_permalink( $bp->groups->current_group ) . '">' . attribute_escape( $bp->groups->current_group->name ) . '</a>' );
    2145         $activity_content .= '<blockquote>' . bp_create_excerpt( attribute_escape( $topic_text ) ) . '</blockquote>';
     2156        $activity_content .= '<blockquote>' . bp_create_excerpt( $topic_text ) . '</blockquote>';
    21462157
    21472158        /* Record this in activity streams */
    … …  
    21672178    global $bp;
    21682179
     2180    $post_text = apply_filters( 'group_forum_post_text_before_save', $post_text );
     2181    $topic_id = apply_filters( 'group_forum_post_topic_id_before_save', $topic_id );
     2182
    21692183    $post = bp_forums_get_post( $post_id );
    21702184
    … …  
    21772191
    21782192        $activity_content = sprintf( __( '%s posted on the forum topic %s in the group %s:', 'buddypress'), bp_core_get_userlink( $post->poster_id ), '<a href="' . bp_get_group_permalink( $bp->groups->current_group ) . 'forum/topic/' . $topic->topic_slug .'">' . attribute_escape( $topic->topic_title ) . '</a>', '<a href="' . bp_get_group_permalink( $bp->groups->current_group ) . '">' . attribute_escape( $bp->groups->current_group->name ) . '</a>' );
    2179         $activity_content .= '<blockquote>' . bp_create_excerpt( attribute_escape( $post_text ) ) . '</blockquote>';
     2193        $activity_content .= '<blockquote>' . bp_create_excerpt( $post_text ) . '</blockquote>';
    21802194
    21812195        /* Record this in activity streams */
Note: See TracChangeset for help on using the changeset viewer.