Changeset 9702

Timestamp:

04/06/2015 03:25:24 PM (10 years ago)

Author:

boonebgorges

Message:

Improved attribute escaping when outputting subnav link items.

Props pareshradadiya.
Fixes #6353.

File:

• trunk/src/bp-core/bp-core-template.php (modified) (1 diff)

trunk/src/bp-core/bp-core-template.php

@@ -73 +73 @@
 
         // echo out the final list item
-        echo apply_filters( 'bp_get_options_nav_' . $subnav_item['css_id'], '<li id="' . $subnav_item['css_id'] . '-' . $list_type . '-li" ' . $selected . '><a id="' . $subnav_item['css_id'] . '" href="' . $subnav_item['link'] . '">' . $subnav_item['name'] . '</a></li>', $subnav_item, $selected_item );
+        echo apply_filters( 'bp_get_options_nav_' . $subnav_item['css_id'], '<li id="' . esc_attr( $subnav_item['css_id'] . '-' . $list_type . '-li' ) . '" ' . $selected . '><a id="' . esc_attr( $subnav_item['css_id'] ) . '" href="' . esc_url( $subnav_item['link'] ) . '">' . $subnav_item['name'] . '</a></li>', $subnav_item, $selected_item );
     }
 }