Changeset 5861

Timestamp:

02/28/2012 01:09:30 PM (13 years ago)

Author:

boonebgorges

Message:

Use addslashes() and stripslashes() when hooking signup error messages to display hooks.
This helps us to avoid syntax errors related to create_function() when the error message contains quotes.
Fixes #4016. Props j.conti

File:

• branches/1.5/bp-members/bp-members-signup.php (modified) (1 diff)

branches/1.5/bp-members/bp-members-signup.php

@@ -113 +113 @@
         // Add any errors to the action for the field in the template for display.
         if ( !empty( $bp->signup->errors ) ) {
-            foreach ( (array)$bp->signup->errors as $fieldname => $error_message )
-                add_action( 'bp_' . $fieldname . '_errors', create_function( '', 'echo apply_filters(\'bp_members_signup_error_message\', "<div class=\"error\">' . $error_message . '</div>" );' ) );
+            foreach ( (array) $bp->signup->errors as $fieldname => $error_message ) {
+                // addslashes() and stripslashes() to avoid create_function()
+                // syntax errors when the $error_message contains quotes
+                add_action( 'bp_' . $fieldname . '_errors', create_function( '', 'echo apply_filters(\'bp_members_signup_error_message\', "<div class=\"error\">" . stripslashes( \'' . addslashes( $error_message ) . '\' ) . "</div>" );' ) );
+            }
         } else {
             $bp->signup->step = 'save-details';