Changeset 8928

Timestamp:

08/16/2014 12:03:53 PM (10 years ago)

Author:

imath

Message:

Make sure BP_User_Query returns correct results when search term contains the Ampersand character

1. Search terms containing this character was problematic as the "&" is a query var delimiter used in bp_legacy_theme_ajax_querystring() to build the ajax querystring

2. When a xProfile field is saved, the value is sanitized using the xprofile_filter_kses() filter which is converting "&" to "&" before inserting the value in database.

Urlencoding the search terms in bp_legacy_theme_ajax_querystring() and applying wp_kses_normalize_entities() to search terms in BP_User_Query & in bp_xprofile_bp_user_query_search() make sure the correct results are returned to the user.

Fixes #5694

Location:

trunk

Files:

• src/bp-core/bp-core-classes.php (modified) (1 diff)
• src/bp-templates/bp-legacy/buddypress-functions.php (modified) (1 diff)
• src/bp-xprofile/bp-xprofile-functions.php (modified) (1 diff)
• tests/phpunit/testcases/core/class-bp-user-query.php (modified) (1 diff)

trunk/src/bp-core/bp-core-classes.php

@@ -369 +369 @@
         // xprofile field matches happen in bp_xprofile_bp_user_query_search()
         if ( false !== $search_terms ) {
-            $search_terms = bp_esc_like( $search_terms );
+            $search_terms = bp_esc_like( wp_kses_normalize_entities( $search_terms ) );
 
             if ( $search_wildcard === 'left' ) {

trunk/src/bp-templates/bp-legacy/buddypress-functions.php

@@ -537 +537 @@
     $object_search_text = bp_get_search_default_text( $object );
     if ( ! empty( $_POST['search_terms'] ) && $object_search_text != $_POST['search_terms'] && 'false' != $_POST['search_terms'] && 'undefined' != $_POST['search_terms'] )
-        $qs[] = 'search_terms=' . $_POST['search_terms'];
+        $qs[] = 'search_terms=' . urlencode( $_POST['search_terms'] );
 
     // Now pass the querystring to override default values.

trunk/src/bp-xprofile/bp-xprofile-functions.php

@@ -686 +686 @@
     $bp = buddypress();
 
-    $search_terms_clean = bp_esc_like( $query->query_vars['search_terms'] );
+    $search_terms_clean = bp_esc_like( wp_kses_normalize_entities( $query->query_vars['search_terms'] ) );
 
     if ( $query->query_vars['search_wildcard'] === 'left' ) {

trunk/tests/phpunit/testcases/core/class-bp-user-query.php

@@ -202 +202 @@
     }
 
+    public function test_bp_user_query_search_with_ampersand_sign() {
+
+        // LIKE special character: &
+        $user_id = $this->create_user();
+        xprofile_set_field_data( 1, $user_id, "a&mpersand" );
+        $q = new BP_User_Query( array( 'search_terms' => "a&m", ) );
+
+        $found_user_id = null;
+        if ( ! empty( $q->results ) ) {
+            $found_user = array_pop( $q->results );
+            $found_user_id = $found_user->ID;
+        }
+
+        $this->assertEquals( $user_id, $found_user_id );
+
+    }
+
     /**
      * @group search_terms