Changeset 7867

Timestamp:

02/13/2014 05:07:49 PM (13 years ago)

Author:

imath

Message:

Improve string escaping in wp-admin/Profile

Props DJPaul

Fixes #5396

File:

• trunk/bp-members/bp-members-admin.php (modified) (12 diffs)

trunk/bp-members/bp-members-admin.php

@@ -413 +413 @@
                                 $notice = array(
                                         'class'   => 'updated',
-                                        'message' => esc_html__( 'Avatar was deleted successfully!', 'buddypress' )
+                                        'message' => __( 'Avatar was deleted successfully!', 'buddypress' )
                                 );
                                 break;
@@ -419 +419 @@
                                 $notice = array(
                                         'class'   => 'updated',
-                                        'message' => esc_html__( 'User removed as spammer.', 'buddypress' )
+                                        'message' => __( 'User removed as spammer.', 'buddypress' )
                                 );
                                 break;
@@ -425 +425 @@
                                 $notice = array(
                                         'class'   => 'updated',
-                                        'message' => esc_html__( 'User marked as spammer. Spam users are visible only to site admins.', 'buddypress' )
+                                        'message' => __( 'User marked as spammer. Spam users are visible only to site admins.', 'buddypress' )
                                 );
                                 break;
@@ -431 +431 @@
                                 $notice = array(
                                         'class'   => 'updated',
-                                        'message' => esc_html__( 'Profile updated.', 'buddypress' )
+                                        'message' => __( 'Profile updated.', 'buddypress' )
                                 );
                                 break;
@@ -442 +442 @@
                                 $notice = array(
                                         'class'   => 'error',
-                                        'message' => esc_html__( 'There was a problem deleting that avatar, please try again.', 'buddypress' )
+                                        'message' => __( 'There was a problem deleting that avatar, please try again.', 'buddypress' )
                                 );
                                 break;
@@ -448 +448 @@
                                 $notice = array(
                                         'class'   => 'error',
-                                        'message' => esc_html__( 'User could not be removed as spammer.', 'buddypress' )
+                                        'message' => __( 'User could not be removed as spammer.', 'buddypress' )
                                 );
                                 break;
@@ -454 +454 @@
                                 $notice = array(
                                         'class'   => 'error',
-                                        'message' => esc_html__( 'User could not be marked as spammer.', 'buddypress' )
+                                        'message' => __( 'User could not be marked as spammer.', 'buddypress' )
                                 );
                                 break;
@@ -460 +460 @@
                                 $notice = array(
                                         'class'   => 'error',
-                                        'message' => esc_html__( 'An error occured while trying to update the profile.', 'buddypress' )
+                                        'message' => __( 'An error occured while trying to update the profile.', 'buddypress' )
                                 );
                                 break;
@@ -466 +466 @@
                                 $notice = array(
                                         'class'   => 'error',
-                                        'message' => esc_html__( 'Please make sure you fill in all required fields in this profile field group before saving.', 'buddypress' )
+                                        'message' => __( 'Please make sure you fill in all required fields in this profile field group before saving.', 'buddypress' )
                                 );
                                 break;
@@ -472 +472 @@
                                 $notice = array(
                                         'class'   => 'error',
-                                        'message' => esc_html__( 'There was a problem updating some of your profile information, please try again.', 'buddypress' )
+                                        'message' => __( 'There was a problem updating some of your profile information, please try again.', 'buddypress' )
                                 );
                                 break;
@@ -484 +484 @@
                                 <div class="<?php echo esc_attr( $notice['class'] ); ?>">
                         <?php endif; ?>
-                                <p><?php echo $notice['message']; ?></p>
+                                <p><?php echo esc_html( $notice['message'] ); ?></p>
                                 <?php if ( !empty( $wp_http_referer ) && ( 'updated' === $notice['class'] ) ) : ?>
-                                        <p><a href="<?php echo esc_url( $wp_http_referer ); ?>"><?php _e( '&larr; Back to Users', 'buddypress' ); ?></a></p>
+                                        <p><a href="<?php echo esc_url( $wp_http_referer ); ?>"><?php esc_html_e( '&larr; Back to Users', 'buddypress' ); ?></a></p>
                                 <?php endif; ?>
                         </div>
@@ -570 +570 @@
                                 <div id="minor-publishing-actions">
                                         <div id="preview-action">
-                                                <a class="button preview" href="<?php echo esc_attr( bp_core_get_user_domain( $user->ID ) ); ?>" target="_blank"><?php esc_html_e( 'View Profile', 'buddypress' ); ?></a>
+                                                <a class="button preview" href="<?php echo esc_url( bp_core_get_user_domain( $user->ID ) ); ?>" target="_blank"><?php esc_html_e( 'View Profile', 'buddypress' ); ?></a>
                                         </div>