Changeset 6203

Timestamp:

07/27/2012 03:01:10 AM (12 years ago)

Author:

johnjamesjacoby

Message:

XProfile:

• Properly escape xprofile_filter_link_profile_data() output.
• See r6201, r6202.
• For 1.6 branch.
• Props vnd.

File:

• trunk/bp-xprofile/bp-xprofile-filters.php (modified) (2 diffs)

trunk/bp-xprofile/bp-xprofile-filters.php

@@ -49 +49 @@
 add_filter( 'bp_get_the_profile_field_value',           'xprofile_filter_format_field_value', 1, 2 );
 add_filter( 'bp_get_the_site_member_profile_data',      'xprofile_filter_format_field_value', 1, 2 );
-add_filter( 'bp_get_the_profile_field_value',           'xprofile_filter_link_profile_data', 9, 2 );
+add_filter( 'bp_get_the_profile_field_value',           'xprofile_filter_link_profile_data',  9, 2 );
 
 add_filter( 'xprofile_data_value_before_save',          'xprofile_sanitize_data_value_before_save', 1, 2 );
@@ -169 +169 @@
             if ( preg_match( '@(https?://([-\w\.]+)+(:\d+)?(/([\w/_\.]*(\?\S+)?)?)?)@', $value ) ) {
                 $new_values[] = make_clickable( $value );
+
+            // Is not clickable
             } else {
+
+                // More than 5 commas
                 if ( count( explode( ' ', $value ) ) > 5 ) {
                     $new_values[] = $value;
+
+                // Less than 5 commas
                 } else {
-                    $new_values[] = '<a href="' . site_url( bp_get_members_root_slug() ) . '/?s=' . strip_tags( $value ) . '" rel="nofollow">' . $value . '</a>';
+                    $search_url   = add_query_arg( array( 's' => urlencode( $value ) ), bp_get_members_directory_permalink() );
+                    $new_values[] = '<a href="' . $search_url . '" rel="nofollow">' . esc_html( $value ) . '</a>';
                 }
             }