Changeset 5860

Timestamp:

02/28/2012 01:08:16 PM (13 years ago)

Author:

boonebgorges

Message:

Use addslashes() and stripslashes() when hooking signup error messages to display hooks.
This helps us to avoid syntax errors related to create_function() when the error message contains quotes.
Fixes #4016. Props j.conti

File:

• trunk/bp-members/bp-members-screens.php (modified) (1 diff)

trunk/bp-members/bp-members-screens.php

@@ -148 +148 @@
         // Add any errors to the action for the field in the template for display.
         if ( !empty( $bp->signup->errors ) ) {
-            foreach ( (array) $bp->signup->errors as $fieldname => $error_message )
-                add_action( 'bp_' . $fieldname . '_errors', create_function( '', 'echo apply_filters(\'bp_members_signup_error_message\', "<div class=\"error\">' . $error_message . '</div>" );' ) );
+            foreach ( (array) $bp->signup->errors as $fieldname => $error_message ) {
+                // addslashes() and stripslashes() to avoid create_function()
+                // syntax errors when the $error_message contains quotes
+                add_action( 'bp_' . $fieldname . '_errors', create_function( '', 'echo apply_filters(\'bp_members_signup_error_message\', "<div class=\"error\">" . stripslashes( \'' . addslashes( $error_message ) . '\' ) . "</div>" );' ) );
+            }
         } else {
             $bp->signup->step = 'save-details';