Changeset 7258

Timestamp:

07/09/2013 08:56:08 PM (11 years ago)

Author:

boonebgorges

Message:

Improved sanitization when outputting template_notice messages

• Strip slashes from cookie contents before attempting to display
• Use kses for sanitization of message content

Props nacin

Location:

branches/1.7/bp-core

Files:

• bp-core-filters.php (modified) (1 diff)
• bp-core-functions.php (modified) (1 diff)

branches/1.7/bp-core/bp-core-filters.php

@@ -52 +52 @@
 add_filter( 'bp_core_render_message_content', 'wpautop'           );
 add_filter( 'bp_core_render_message_content', 'shortcode_unautop' );
+add_filter( 'bp_core_render_message_content', 'wp_kses_data', 5   );
 
 /**

branches/1.7/bp-core/bp-core-functions.php

@@ -360 +360 @@
 
     if ( empty( $bp->template_message ) && isset( $_COOKIE['bp-message'] ) )
-        $bp->template_message = $_COOKIE['bp-message'];
+        $bp->template_message = stripslashes( $_COOKIE['bp-message'] );
 
     if ( empty( $bp->template_message_type ) && isset( $_COOKIE['bp-message-type'] ) )
-        $bp->template_message_type = $_COOKIE['bp-message-type'];
+        $bp->template_message_type = stripslashes( $_COOKIE['bp-message-type'] );
 
     add_action( 'template_notices', 'bp_core_render_message' );