Changeset 6224

Timestamp:

08/05/2012 09:21:03 PM (12 years ago)

Author:

boonebgorges

Message:

Cleanup of sanitization and formatting of xprofile output

In r6202 and r6204, sanitization was introduced into the xprofile output
functions, to protect against CSRF-style vulnerabilities. However, the
sanitization (esc_html()) was run in such a way that some clickable items,
such as email addresses, were double escaped, resulting in HTML tags being
printed to the screen rather than parsed by the browser.

This changeset reconfigures the sanitization procedure, so that output is
sanitized by esc_html() before being run through the formatting filters such
as make_clickable() and xprofile_filter_link_profile_data().

Fixes #4392

Props rachelbaker, DJPaul

File:

• trunk/bp-xprofile/bp-xprofile-filters.php (modified) (2 diffs)

trunk/bp-xprofile/bp-xprofile-filters.php

@@ -24 +24 @@
 add_filter( 'bp_get_the_profile_field_value',           'convert_chars'      );
 add_filter( 'bp_get_the_profile_field_value',           'wpautop'            );
-add_filter( 'bp_get_the_profile_field_value',           'make_clickable', 8  );
 add_filter( 'bp_get_the_profile_field_value',           'force_balance_tags' );
+add_filter( 'bp_get_the_profile_field_value',           'make_clickable'     );
+add_filter( 'bp_get_the_profile_field_value',           'esc_html',        8 );
 
 add_filter( 'bp_get_the_profile_field_edit_value',      'force_balance_tags' );
@@ -175 +176 @@
                 // More than 5 spaces
                 if ( count( explode( ' ', $value ) ) > 5 ) {
-                    $new_values[] = esc_html( $value );
+                    $new_values[] = $value;
 
                 // Less than 5 spaces
                 } else {
                     $search_url   = add_query_arg( array( 's' => urlencode( $value ) ), bp_get_members_directory_permalink() );
-                    $new_values[] = '<a href="' . $search_url . '" rel="nofollow">' . esc_html( $value ) . '</a>';
+                    $new_values[] = '<a href="' . $search_url . '" rel="nofollow">' . $value . '</a>';
                 }
             }