Changeset 8928

Timestamp:

08/16/2014 12:03:53 PM (12 years ago)

Author:

imath

Message:

Make sure BP_User_Query returns correct results when search term contains the Ampersand character

1. Search terms containing this character was problematic as the "&" is a query var delimiter used in bp_legacy_theme_ajax_querystring() to build the ajax querystring

2. When a xProfile field is saved, the value is sanitized using the xprofile_filter_kses() filter which is converting "&" to "&" before inserting the value in database.

Urlencoding the search terms in bp_legacy_theme_ajax_querystring() and applying wp_kses_normalize_entities() to search terms in BP_User_Query & in bp_xprofile_bp_user_query_search() make sure the correct results are returned to the user.

Fixes #5694

Location:

trunk

Files:

• src/bp-core/bp-core-classes.php (modified) (1 diff)
• src/bp-templates/bp-legacy/buddypress-functions.php (modified) (1 diff)
• src/bp-xprofile/bp-xprofile-functions.php (modified) (1 diff)
• tests/phpunit/testcases/core/class-bp-user-query.php (modified) (1 diff)

trunk/src/bp-core/bp-core-classes.php

@@ -369 +369 @@
                 // xprofile field matches happen in bp_xprofile_bp_user_query_search()
                 if ( false !== $search_terms ) {
-                        $search_terms = bp_esc_like( $search_terms );
+                        $search_terms = bp_esc_like( wp_kses_normalize_entities( $search_terms ) );
 
                         if ( $search_wildcard === 'left' ) {

trunk/src/bp-templates/bp-legacy/buddypress-functions.php

@@ -537 +537 @@
         $object_search_text = bp_get_search_default_text( $object );
         if ( ! empty( $_POST['search_terms'] ) && $object_search_text != $_POST['search_terms'] && 'false' != $_POST['search_terms'] && 'undefined' != $_POST['search_terms'] )
-                $qs[] = 'search_terms=' . $_POST['search_terms'];
+                $qs[] = 'search_terms=' . urlencode( $_POST['search_terms'] );
 
         // Now pass the querystring to override default values.

trunk/src/bp-xprofile/bp-xprofile-functions.php

@@ -686 +686 @@
         $bp = buddypress();
 
-        $search_terms_clean = bp_esc_like( $query->query_vars['search_terms'] );
+        $search_terms_clean = bp_esc_like( wp_kses_normalize_entities( $query->query_vars['search_terms'] ) );
 
         if ( $query->query_vars['search_wildcard'] === 'left' ) {

trunk/tests/phpunit/testcases/core/class-bp-user-query.php

@@ -202 +202 @@
         }
 
+        public function test_bp_user_query_search_with_ampersand_sign() {
+
+                // LIKE special character: &
+                $user_id = $this->create_user();
+                xprofile_set_field_data( 1, $user_id, "a&mpersand" );
+                $q = new BP_User_Query( array( 'search_terms' => "a&m", ) );
+
+                $found_user_id = null;
+                if ( ! empty( $q->results ) ) {
+                        $found_user = array_pop( $q->results );
+                        $found_user_id = $found_user->ID;
+                }
+
+                $this->assertEquals( $user_id, $found_user_id );
+
+        }
+
         /**
          * @group search_terms