Skip to:
Content

BuddyPress.org

Changeset 9772


Ignore:
Timestamp:
04/20/2015 03:38:54 PM (10 years ago)
Author:
johnjamesjacoby
Message:

All: make sure URL variables are escaped (trunk)

Location:
trunk/src
Files:
18 edited

Legend:

Unmodified
Added
Removed

  • trunk/src/bp-activity/bp-activity-admin.php

    r9665 r9772  
    650650        <?php if ( ! empty( $activity ) ) : ?>
    651651
    652             <form action="<?php echo esc_attr( $form_url ); ?>" id="bp-activities-edit-form" method="post">
     652            <form action="<?php echo esc_url( $form_url ); ?>" id="bp-activities-edit-form" method="post">
    653653                <div id="poststuff">
    654654

  • trunk/src/bp-activity/bp-activity-functions.php

    r9650 r9772  
    13621362
    13631363    if ( is_multisite() ) {
    1364         $blog_link = '<a href="' . $blog_url . '">' . get_blog_option( $activity->item_id, 'blogname' ) . '</a>';
     1364        $blog_link = '<a href="' . esc_url( $blog_url ) . '">' . get_blog_option( $activity->item_id, 'blogname' ) . '</a>';
    13651365
    13661366        if ( ! empty( $bp->activity->track[ $activity->type ]->new_post_type_action_ms ) ) {
    13671367            $action = sprintf( $bp->activity->track[ $activity->type ]->new_post_type_action_ms, $user_link, $post_url, $blog_link );
    13681368        } else {
    1369             $action = sprintf( _x( '%1$s wrote a new <a href="%2$s">item</a>, on the site %3$s', 'Activity Custom Post Type post action', 'buddypress' ), $user_link, $post_url, $blog_link );
     1369            $action = sprintf( _x( '%1$s wrote a new <a href="%2$s">item</a>, on the site %3$s', 'Activity Custom Post Type post action', 'buddypress' ), $user_link, esc_url( $post_url ), $blog_link );
    13701370        }
    13711371    } else {
    … …  
    13731373            $action = sprintf( $bp->activity->track[ $activity->type ]->new_post_type_action, $user_link, $post_url );
    13741374        } else {
    1375             $action = sprintf( _x( '%1$s wrote a new <a href="%2$s">item</a>', 'Activity Custom Post Type post action', 'buddypress' ), $user_link, $post_url );
     1375            $action = sprintf( _x( '%1$s wrote a new <a href="%2$s">item</a>', 'Activity Custom Post Type post action', 'buddypress' ), $user_link, esc_url( $post_url ) );
    13761376        }
    13771377    }

  • trunk/src/bp-activity/bp-activity-template.php

    r9765 r9772  
    388388        if ( (int) $this->total_activity_count && (int) $this->pag_num ) {
    389389            $this->pag_links = paginate_links( array(
    390                 'base'      => add_query_arg( $page_arg, '%#%' ),
     390                'base'      => add_query_arg( $this->page_arg, '%#%' ),
    391391                'format'    => '',
    392392                'total'     => ceil( (int) $this->total_activity_count / (int) $this->pag_num ),
    … …  
    30903090     * @uses bp_is_activity_component()
    30913091     * @uses bp_current_action()
    3092      * @uses add_query_arg()
    30933092     * @uses wp_get_referer()
    30943093     * @uses wp_nonce_url()
    … …  
    33383337            $link = apply_filters( 'bp_get_activity_filter_link_href', $link, $component );
    33393338
    3340             $component_links[] = $before . '<a href="' . esc_attr( $link ) . '">' . ucwords( $component ) . '</a>' . $after;
     3339            $component_links[] = $before . '<a href="' . esc_url( $link ) . '">' . ucwords( $component ) . '</a>' . $after;
    33413340        }
    33423341
    … …  
    33443343
    33453344        if ( isset( $_GET['afilter'] ) ) {
    3346             $component_links[] = '<' . $tag . ' id="afilter-clear"><a href="' . esc_attr( $link ) . '">' . __( 'Clear Filter', 'buddypress' ) . '</a></' . $tag . '>';
     3345            $component_links[] = '<' . $tag . ' id="afilter-clear"><a href="' . esc_url( $link ) . '">' . __( 'Clear Filter', 'buddypress' ) . '</a></' . $tag . '>';
    33473346        }
    33483347
    … …  
    35923591 */
    35933592function bp_send_public_message_link() {
    3594     echo bp_get_send_public_message_link();
     3593    echo esc_url( bp_get_send_public_message_link() );
    35953594}
    35963595

  • trunk/src/bp-blogs/bp-blogs-activity.php

    r9621 r9772  
    173173
    174174    // Build the 'post link' part of the activity action string
    175     $post_link  = '<a href="' . $post_url . '">' . $post_title . '</a>';
     175    $post_link  = '<a href="' . esc_url( $post_url ) . '">' . $post_title . '</a>';
    176176
    177177    $user_link = bp_core_get_userlink( $activity->user_id );
    … …  
    250250    }
    251251
    252     $post_link = '<a href="' . $post_url . '">' . $post_title . '</a>';
     252    $post_link = '<a href="' . esc_url( $post_url ) . '">' . $post_title . '</a>';
    253253    $user_link = bp_core_get_userlink( $activity->user_id );
    254254

  • trunk/src/bp-blogs/bp-blogs-template.php

    r9765 r9772  
    908908 */
    909909function bp_blog_latest_post_permalink() {
    910     echo bp_get_blog_latest_post_permalink();
     910    echo esc_url( bp_get_blog_latest_post_permalink() );
    911911}
    912912    /**

  • trunk/src/bp-core/admin/bp-core-admin-components.php

    r9608 r9772  
    150150
    151151    <ul class="subsubsub">
    152         <li><a href="<?php echo add_query_arg( array( 'page' => 'bp-components', 'action' => 'all'      ), bp_get_admin_url( $page ) ); ?>" <?php if ( $action === 'all'      ) : ?>class="current"<?php endif; ?>><?php printf( _nx( 'All <span class="count">(%s)</span>',      'All <span class="count">(%s)</span>',      $all_count,         'plugins', 'buddypress' ), number_format_i18n( $all_count                    ) ); ?></a> | </li>
    153         <li><a href="<?php echo add_query_arg( array( 'page' => 'bp-components', 'action' => 'active'   ), bp_get_admin_url( $page ) ); ?>" <?php if ( $action === 'active'   ) : ?>class="current"<?php endif; ?>><?php printf( _n(  'Active <span class="count">(%s)</span>',   'Active <span class="count">(%s)</span>',   count( $active_components   ), 'buddypress' ), number_format_i18n( count( $active_components   ) ) ); ?></a> | </li>
    154         <li><a href="<?php echo add_query_arg( array( 'page' => 'bp-components', 'action' => 'inactive' ), bp_get_admin_url( $page ) ); ?>" <?php if ( $action === 'inactive' ) : ?>class="current"<?php endif; ?>><?php printf( _n(  'Inactive <span class="count">(%s)</span>', 'Inactive <span class="count">(%s)</span>', count( $inactive_components ), 'buddypress' ), number_format_i18n( count( $inactive_components ) ) ); ?></a> | </li>
    155         <li><a href="<?php echo add_query_arg( array( 'page' => 'bp-components', 'action' => 'mustuse'  ), bp_get_admin_url( $page ) ); ?>" <?php if ( $action === 'mustuse'  ) : ?>class="current"<?php endif; ?>><?php printf( _n(  'Must-Use <span class="count">(%s)</span>', 'Must-Use <span class="count">(%s)</span>', count( $required_components ), 'buddypress' ), number_format_i18n( count( $required_components ) ) ); ?></a> | </li>
    156         <li><a href="<?php echo add_query_arg( array( 'page' => 'bp-components', 'action' => 'retired'  ), bp_get_admin_url( $page ) ); ?>" <?php if ( $action === 'retired'  ) : ?>class="current"<?php endif; ?>><?php printf( _n(  'Retired <span class="count">(%s)</span>',  'Retired <span class="count">(%s)</span>',  count( $retired_components ),  'buddypress' ), number_format_i18n( count( $retired_components  ) ) ); ?></a></li>
     152        <li><a href="<?php echo esc_url( add_query_arg( array( 'page' => 'bp-components', 'action' => 'all'      ), bp_get_admin_url( $page ) ) ); ?>" <?php if ( $action === 'all'      ) : ?>class="current"<?php endif; ?>><?php printf( _nx( 'All <span class="count">(%s)</span>',      'All <span class="count">(%s)</span>',      $all_count,         'plugins', 'buddypress' ), number_format_i18n( $all_count                    ) ); ?></a> | </li>
     153        <li><a href="<?php echo esc_url( add_query_arg( array( 'page' => 'bp-components', 'action' => 'active'   ), bp_get_admin_url( $page ) ) ); ?>" <?php if ( $action === 'active'   ) : ?>class="current"<?php endif; ?>><?php printf( _n(  'Active <span class="count">(%s)</span>',   'Active <span class="count">(%s)</span>',   count( $active_components   ), 'buddypress' ), number_format_i18n( count( $active_components   ) ) ); ?></a> | </li>
     154        <li><a href="<?php echo esc_url( add_query_arg( array( 'page' => 'bp-components', 'action' => 'inactive' ), bp_get_admin_url( $page ) ) ); ?>" <?php if ( $action === 'inactive' ) : ?>class="current"<?php endif; ?>><?php printf( _n(  'Inactive <span class="count">(%s)</span>', 'Inactive <span class="count">(%s)</span>', count( $inactive_components ), 'buddypress' ), number_format_i18n( count( $inactive_components ) ) ); ?></a> | </li>
     155        <li><a href="<?php echo esc_url( add_query_arg( array( 'page' => 'bp-components', 'action' => 'mustuse'  ), bp_get_admin_url( $page ) ) ); ?>" <?php if ( $action === 'mustuse'  ) : ?>class="current"<?php endif; ?>><?php printf( _n(  'Must-Use <span class="count">(%s)</span>', 'Must-Use <span class="count">(%s)</span>', count( $required_components ), 'buddypress' ), number_format_i18n( count( $required_components ) ) ); ?></a> | </li>
     156        <li><a href="<?php echo esc_url( add_query_arg( array( 'page' => 'bp-components', 'action' => 'retired'  ), bp_get_admin_url( $page ) ) ); ?>" <?php if ( $action === 'retired'  ) : ?>class="current"<?php endif; ?>><?php printf( _n(  'Retired <span class="count">(%s)</span>',  'Retired <span class="count">(%s)</span>',  count( $retired_components ),  'buddypress' ), number_format_i18n( count( $retired_components  ) ) ); ?></a></li>
    157157    </ul>
    158158

  • trunk/src/bp-core/admin/bp-core-admin-functions.php

    r9665 r9772  
    299299    if ( !empty( $orphaned_components ) ) {
    300300        $admin_url = bp_get_admin_url( add_query_arg( array( 'page' => 'bp-page-settings' ), 'admin.php' ) );
    301         $notice    = sprintf( __( 'The following active BuddyPress Components do not have associated WordPress Pages: %2$s. <a href="%1$s">Repair</a>', 'buddypress' ), $admin_url, '<strong>' . implode( '</strong>, <strong>', $orphaned_components ) . '</strong>' );
     301        $notice    = sprintf( __( 'The following active BuddyPress Components do not have associated WordPress Pages: %2$s. <a href="%1$s">Repair</a>', 'buddypress' ), esc_url( $admin_url ), '<strong>' . implode( '</strong>, <strong>', $orphaned_components ) . '</strong>' );
    302302
    303303        bp_core_add_admin_notice( $notice );
    … …  
    321321    if ( !empty( $dupe_names ) ) {
    322322        $admin_url = bp_get_admin_url( add_query_arg( array( 'page' => 'bp-page-settings' ), 'admin.php' ) );
    323         $notice    = sprintf( __( 'Each BuddyPress Component needs its own WordPress page. The following WordPress Pages have more than one component associated with them: %2$s. <a href="%1$s">Repair</a>', 'buddypress' ), $admin_url, '<strong>' . implode( '</strong>, <strong>', $dupe_names ) . '</strong>' );
     323        $notice    = sprintf( __( 'Each BuddyPress Component needs its own WordPress page. The following WordPress Pages have more than one component associated with them: %2$s. <a href="%1$s">Repair</a>', 'buddypress' ), esc_url( $admin_url ), '<strong>' . implode( '</strong>, <strong>', $dupe_names ) . '</strong>' );
    324324
    325325        bp_core_add_admin_notice( $notice );
    … …  
    910910        bp_core_process_spammer_status( $user_id, $status );
    911911
    912         $redirect = add_query_arg( array( 'updated' => 'marked-' . $status ), $redirect);
     912        $redirect = add_query_arg( array( 'updated' => 'marked-' . $status ), $redirect );
    913913
    914914        wp_redirect( $redirect );

  • trunk/src/bp-core/admin/bp-core-admin-settings.php

    r9551 r9772  
    243243        <h2 class="nav-tab-wrapper"><?php bp_core_admin_tabs( __( 'Settings', 'buddypress' ) ); ?></h2>
    244244
    245         <form action="<?php echo $form_action ?>" method="post">
     245        <form action="<?php echo esc_url( $form_action ) ?>" method="post">
    246246
    247247            <?php settings_fields( 'buddypress' ); ?>

  • trunk/src/bp-core/bp-core-admin.php

    r9599 r9772  
    440440        // Add a few links to the existing links array
    441441        return array_merge( $links, array(
    442             'settings' => '<a href="' . add_query_arg( array( 'page' => 'bp-components' ), bp_get_admin_url( $this->settings_page ) ) . '">' . esc_html__( 'Settings', 'buddypress' ) . '</a>',
    443             'about'    => '<a href="' . add_query_arg( array( 'page' => 'bp-about'      ), bp_get_admin_url( 'index.php'          ) ) . '">' . esc_html__( 'About',    'buddypress' ) . '</a>'
     442            'settings' => '<a href="' . esc_url( add_query_arg( array( 'page' => 'bp-components' ), bp_get_admin_url( $this->settings_page ) ) ) . '">' . esc_html__( 'Settings', 'buddypress' ) . '</a>',
     443            'about'    => '<a href="' . esc_url( add_query_arg( array( 'page' => 'bp-about'      ), bp_get_admin_url( 'index.php'          ) ) ) . '">' . esc_html__( 'About',    'buddypress' ) . '</a>'
    444444        ) );
    445445    }
    … …  
    516516                                <ul>
    517517                                    <li><?php printf(
    518                                     '<a href="%s" class="welcome-icon welcome-edit-page">' . __( 'Set Up Components', 'buddypress' ) . '</a>', bp_get_admin_url( add_query_arg( array( 'page' => 'bp-components' ), $this->settings_page ) )
     518                                    '<a href="%s" class="welcome-icon welcome-edit-page">' . __( 'Set Up Components', 'buddypress' ) . '</a>', esc_url( bp_get_admin_url( add_query_arg( array( 'page' => 'bp-components' ), $this->settings_page ) ) )
    519519                                    ); ?></li>
    520520                                    <li><?php printf(
    521                                     '<a href="%s" class="welcome-icon welcome-edit-page">' . __( 'Assign Components to Pages', 'buddypress' ) . '</a>', bp_get_admin_url( add_query_arg( array( 'page' => 'bp-page-settings' ), $this->settings_page ) )
     521                                    '<a href="%s" class="welcome-icon welcome-edit-page">' . __( 'Assign Components to Pages', 'buddypress' ) . '</a>', esc_url( bp_get_admin_url( add_query_arg( array( 'page' => 'bp-page-settings' ), $this->settings_page ) ) )
    522522                                    ); ?></li>
    523523                                    <li><?php printf(
    524                                     '<a href="%s" class="welcome-icon welcome-edit-page">' . __( 'Customize Settings', 'buddypress' ) . '</a>', bp_get_admin_url( add_query_arg( array( 'page' => 'bp-settings' ), $this->settings_page ) )
     524                                    '<a href="%s" class="welcome-icon welcome-edit-page">' . __( 'Customize Settings', 'buddypress' ) . '</a>', esc_url( bp_get_admin_url( add_query_arg( array( 'page' => 'bp-settings' ), $this->settings_page ) ) )
    525525                                    ); ?></li>
    526526                                </ul>
    … …  
    531531                                <ul>
    532532                                    <?php if ( bp_is_active( 'members' ) ) : ?>
    533                                         <li><?php printf( '<a href="%s" class="welcome-icon welcome-add-page">' . __( 'Add User Profile Fields', 'buddypress' ) . '</a>', bp_get_admin_url( add_query_arg( array( 'page' => 'bp-profile-setup' ), 'users.php' ) ) ); ?></li>
     533                                        <li><?php printf( '<a href="%s" class="welcome-icon welcome-add-page">' . __( 'Add User Profile Fields', 'buddypress' ) . '</a>', esc_url( bp_get_admin_url( add_query_arg( array( 'page' => 'bp-profile-setup' ), 'users.php' ) ) ) ); ?></li>
    534534                                    <?php endif; ?>
    535                                     <li><?php printf( '<a href="%s" class="welcome-icon welcome-add-page">' . __( 'Manage User Signups', 'buddypress' ) . '</a>', bp_get_admin_url( add_query_arg( array( 'page' => 'bp-signups' ), 'users.php' ) ) ); ?></li>
     535                                    <li><?php printf( '<a href="%s" class="welcome-icon welcome-add-page">' . __( 'Manage User Signups', 'buddypress' ) . '</a>', esc_url( bp_get_admin_url( add_query_arg( array( 'page' => 'bp-signups' ), 'users.php' ) ) ) ); ?></li>
    536536                                    <?php if ( bp_is_active( 'activity' ) ) : ?>
    537                                         <li><?php printf( '<a href="%s" class="welcome-icon welcome-add-page">' . __( 'Moderate Activity Streams', 'buddypress' ) . '</a>', bp_get_admin_url( add_query_arg( array( 'page' => 'bp-activity' ), 'admin.php' ) ) ); ?></li>
     537                                        <li><?php printf( '<a href="%s" class="welcome-icon welcome-add-page">' . __( 'Moderate Activity Streams', 'buddypress' ) . '</a>', esc_url( bp_get_admin_url( add_query_arg( array( 'page' => 'bp-activity' ), 'admin.php' ) ) ) ); ?></li>
    538538                                    <?php endif; ?>
    539539                                    <?php if ( bp_is_active( 'groups' ) ) : ?>
    540                                         <li><?php printf( '<a href="%s" class="welcome-icon welcome-add-page">' . __( 'Manage Groups', 'buddypress' ) . '</a>', bp_get_admin_url( add_query_arg( array( 'page' => 'bp-groups' ), 'admin.php' ) ) ); ?></li>
     540                                        <li><?php printf( '<a href="%s" class="welcome-icon welcome-add-page">' . __( 'Manage Groups', 'buddypress' ) . '</a>', esc_url( bp_get_admin_url( add_query_arg( array( 'page' => 'bp-groups' ), 'admin.php' ) ) ) ); ?></li>
    541541                                    <?php endif; ?>
    542                                     <li><?php printf( '<a href="%s" class="welcome-icon welcome-add-page">' . __( 'Repair Data', 'buddypress' ) . '</a>', bp_get_admin_url( add_query_arg( array( 'page' => 'bp-tools' ), 'tools.php' ) ) ); ?>
     542                                    <li><?php printf( '<a href="%s" class="welcome-icon welcome-add-page">' . __( 'Repair Data', 'buddypress' ) . '</a>', esc_url( bp_get_admin_url( add_query_arg( array( 'page' => 'bp-tools' ), 'tools.php' ) ) ) ); ?>
    543543                                    </li>
    544544                                </ul>

  • trunk/src/bp-core/bp-core-catchuri.php

    r9723 r9772  
    585585
    586586            $url = $root;
    587             if ( !empty( $redirect ) )
     587            if ( !empty( $redirect ) ) {
    588588                $url = add_query_arg( 'redirect_to', urlencode( $redirect ), $root );
     589            }
    589590
    590591            if ( !empty( $message ) ) {

  • trunk/src/bp-core/bp-core-functions.php

    r9683 r9772  
    16531653 */
    16541654function bp_admin_url( $path = '', $scheme = 'admin' ) {
    1655     echo bp_get_admin_url( $path, $scheme );
     1655    echo esc_url( bp_get_admin_url( $path, $scheme ) );
    16561656}
    16571657    /**

  • trunk/src/bp-forums/bp-forums-template.php

    r9765 r9772  
    17761776 */
    17771777function bp_forum_topic_new_reply_link() {
    1778     echo bp_get_forum_topic_new_reply_link();
     1778    echo esc_url( bp_get_forum_topic_new_reply_link() );
    17791779}
    17801780    /**

  • trunk/src/bp-forums/deprecated/1.6.php

    r9517 r9772  
    104104
    105105                <div>
    106                     <a class="button thickbox button-primary" href="<?php echo esc_attr( $button_url ) ?>"><?php echo esc_html( $button_text ) ?></a> &nbsp;
     106                    <a class="button thickbox button-primary" href="<?php echo esc_url( $button_url ) ?>"><?php echo esc_html( $button_text ) ?></a> &nbsp;
    107107                </div>
    108108            </div>
    … …  
    185185                <p><?php _e( "You've decided to set up a new installation of bbPress for forum management in BuddyPress. This is very simple and is usually just a one click
    186186                process. When you're ready, hit the link below.", 'buddypress' ) ?></p>
    187                 <p><a class="button-primary" href="<?php echo wp_nonce_url( $post_url . '&step=new&doinstall=1', 'bp_forums_new_install_init' ) ?>"><?php _e( 'Complete Installation', 'buddypress' ) ?></a></p>
     187                <p><a class="button-primary" href="<?php echo esc_url( wp_nonce_url( $post_url . '&step=new&doinstall=1', 'bp_forums_new_install_init' ) ); ?>"><?php _e( 'Complete Installation', 'buddypress' ) ?></a></p>
    188188
    189189                <?php
    … …  
    223223
    224224                    <div>
    225                         <a class="button button-primary" href="<?php echo $post_url . '&step=new' ?>"><?php _e( 'Install Group Forums', 'buddypress' ) ?></a> &nbsp;
    226                         <a class="button" href="<?php echo $post_url . '&step=existing' ?>"><?php _e( 'Use Existing Installation', 'buddypress' ) ?></a>
     225                        <a class="button button-primary" href="<?php echo esc_url( $post_url ) . '&step=new' ?>"><?php _e( 'Install Group Forums', 'buddypress' ) ?></a> &nbsp;
     226                        <a class="button" href="<?php echo esc_url( $post_url ) . '&step=existing' ?>"><?php _e( 'Use Existing Installation', 'buddypress' ) ?></a>
    227227                    </div>
    228228                </div>
    … …  
    246246                    <p><?php printf( __( 'If you decide to use bbPress, you will need to deactivate the legacy group forum component.  For more info, <a href="%s">read this codex article</a>.', 'buddypress' ), 'https://codex.buddypress.org/legacy/getting-started/using-bbpress-2-2-with-buddypress/' ) ?></p>
    247247                    <div>
    248                         <a class="button button-primary <?php if ( ! $bbpress_plugin_is_active ) { echo esc_attr( 'thickbox' ); }?>" href="<?php echo esc_attr( $button_url ) ?>"><?php echo esc_html( $button_text ) ?></a> &nbsp;
     248                        <a class="button button-primary <?php if ( ! $bbpress_plugin_is_active ) { echo esc_attr( 'thickbox' ); }?>" href="<?php echo esc_url( $button_url ) ?>"><?php echo esc_html( $button_text ) ?></a> &nbsp;
    249249                    </div>
    250250                </div>

  • trunk/src/bp-groups/bp-groups-admin.php

    r9765 r9772  
    582582        <?php if ( ! empty( $group ) ) : ?>
    583583
    584             <form action="<?php echo esc_attr( $form_url ); ?>" id="bp-groups-edit-form" method="post">
     584            <form action="<?php echo esc_url( $form_url ); ?>" id="bp-groups-edit-form" method="post">
    585585                <div id="poststuff">
    586586
    … …  
    674674        <p><strong><?php _e( 'This action cannot be undone.', 'buddypress' ) ?></strong></p>
    675675
    676         <a class="button-primary" href="<?php echo wp_nonce_url( add_query_arg( array( 'action' => 'do_delete', 'gid' => implode( ',', $gids ) ), $base_url ), 'bp-groups-delete' ) ?>"><?php _e( 'Delete Permanently', 'buddypress' ) ?></a>
     676        <a class="button-primary" href="<?php echo esc_url( wp_nonce_url( add_query_arg( array( 'action' => 'do_delete', 'gid' => implode( ',', $gids ) ), $base_url ), 'bp-groups-delete' ) ); ?>"><?php _e( 'Delete Permanently', 'buddypress' ) ?></a>
    677677        <a class="button" href="<?php echo esc_attr( $base_url ); ?>"><?php _e( 'Cancel', 'buddypress' ) ?></a>
    678678    </div>
    … …  
    981981        <div id="major-publishing-actions">
    982982            <div id="delete-action">
    983                 <a class="submitdelete deletion" href="<?php echo wp_nonce_url( add_query_arg( 'action', 'delete', $base_url ), 'bp-groups-delete' ) ?>"><?php _e( 'Delete Group', 'buddypress' ) ?></a>
     983                <a class="submitdelete deletion" href="<?php echo esc_url( wp_nonce_url( add_query_arg( 'action', 'delete', $base_url ), 'bp-groups-delete' ) ); ?>"><?php _e( 'Delete Group', 'buddypress' ) ?></a>
    984984            </div>
    985985
    … …  
    13791379
    13801380        <ul class="subsubsub">
    1381             <li class="all"><a href="<?php echo esc_attr( esc_url( $url_base ) ); ?>" class="<?php if ( 'all' == $this->view ) echo 'current'; ?>"><?php _e( 'All', 'buddypress' ); ?></a> |</li>
    1382             <li class="public"><a href="<?php echo esc_attr( esc_url( add_query_arg( 'group_status', 'public', $url_base ) ) ); ?>" class="<?php if ( 'public' == $this->view ) echo 'current'; ?>"><?php printf( _n( 'Public <span class="count">(%s)</span>', 'Public <span class="count">(%s)</span>', $this->group_counts['public'], 'buddypress' ), number_format_i18n( $this->group_counts['public'] ) ); ?></a> |</li>
    1383             <li class="private"><a href="<?php echo esc_attr( esc_url( add_query_arg( 'group_status', 'private', $url_base ) ) ); ?>" class="<?php if ( 'private' == $this->view ) echo 'current'; ?>"><?php printf( _n( 'Private <span class="count">(%s)</span>', 'Private <span class="count">(%s)</span>', $this->group_counts['private'], 'buddypress' ), number_format_i18n( $this->group_counts['private'] ) ); ?></a> |</li>
    1384             <li class="hidden"><a href="<?php echo esc_attr( esc_url( add_query_arg( 'group_status', 'hidden', $url_base ) ) ); ?>" class="<?php if ( 'hidden' == $this->view ) echo 'current'; ?>"><?php printf( _n( 'Hidden <span class="count">(%s)</span>', 'Hidden <span class="count">(%s)</span>', $this->group_counts['hidden'], 'buddypress' ), number_format_i18n( $this->group_counts['hidden'] ) ); ?></a></li>
     1381            <li class="all"><a href="<?php echo esc_url( $url_base ); ?>" class="<?php if ( 'all' == $this->view ) echo 'current'; ?>"><?php _e( 'All', 'buddypress' ); ?></a> |</li>
     1382            <li class="public"><a href="<?php echo esc_url( add_query_arg( 'group_status', 'public', $url_base ) ); ?>" class="<?php if ( 'public' == $this->view ) echo 'current'; ?>"><?php printf( _n( 'Public <span class="count">(%s)</span>', 'Public <span class="count">(%s)</span>', $this->group_counts['public'], 'buddypress' ), number_format_i18n( $this->group_counts['public'] ) ); ?></a> |</li>
     1383            <li class="private"><a href="<?php echo esc_url( add_query_arg( 'group_status', 'private', $url_base ) ); ?>" class="<?php if ( 'private' == $this->view ) echo 'current'; ?>"><?php printf( _n( 'Private <span class="count">(%s)</span>', 'Private <span class="count">(%s)</span>', $this->group_counts['private'], 'buddypress' ), number_format_i18n( $this->group_counts['private'] ) ); ?></a> |</li>
     1384            <li class="hidden"><a href="<?php echo esc_url( add_query_arg( 'group_status', 'hidden', $url_base ) ); ?>" class="<?php if ( 'hidden' == $this->view ) echo 'current'; ?>"><?php printf( _n( 'Hidden <span class="count">(%s)</span>', 'Hidden <span class="count">(%s)</span>', $this->group_counts['hidden'], 'buddypress' ), number_format_i18n( $this->group_counts['hidden'] ) ); ?></a></li>
    13851385
    13861386            <?php

  • trunk/src/bp-members/admin/bp-members-admin-classes.php

    r9670 r9772  
    9898        // Remove the 'current' class from the 'All' link
    9999        $views['all']        = str_replace( 'class="current"', '', $views['all'] );
    100         $views['registered'] = sprintf( '<a href="%1$s" class="current">%2$s</a>', add_query_arg( 'page', 'bp-signups', bp_get_admin_url( 'users.php' ) ), sprintf( _x( 'Pending %s', 'signup users', 'buddypress' ), '<span class="count">(' . number_format_i18n( $this->signup_counts ) . ')</span>' ) );
     100        $views['registered'] = sprintf( '<a href="%1$s" class="current">%2$s</a>', esc_url( add_query_arg( 'page', 'bp-signups', bp_get_admin_url( 'users.php' ) ) ), sprintf( _x( 'Pending %s', 'signup users', 'buddypress' ), '<span class="count">(' . number_format_i18n( $this->signup_counts ) . ')</span>' ) );
    101101
    102102        return $views;
    … …  
    465465        // Remove the 'current' class from the 'All' link
    466466        $views['all']        = str_replace( 'class="current"', '', $views['all'] );
    467         $views['registered'] = sprintf( '<a href="%1$s" class="current">%2$s</a>', add_query_arg( 'page', 'bp-signups', bp_get_admin_url( 'users.php' ) ), sprintf( _x( 'Pending %s', 'signup users', 'buddypress' ), '<span class="count">(' . number_format_i18n( $this->signup_counts ) . ')</span>' ) );
     467        $views['registered'] = sprintf( '<a href="%1$s" class="current">%2$s</a>', esc_url( add_query_arg( 'page', 'bp-signups', bp_get_admin_url( 'users.php' ) ) ), sprintf( _x( 'Pending %s', 'signup users', 'buddypress' ), '<span class="count">(' . number_format_i18n( $this->signup_counts ) . ')</span>' ) );
    468468
    469469        return $views;

  • trunk/src/bp-members/bp-members-admin.php

    r9765 r9772  
    13341334        $text    = sprintf( _x( 'Pending %s', 'signup users', 'buddypress' ), '<span class="count">(' . number_format_i18n( $signups ) . ')</span>' );
    13351335
    1336         $views['registered'] = sprintf( '<a href="%1$s" class="%2$s">%3$s</a>', $url, $class, $text );
     1336        $views['registered'] = sprintf( '<a href="%1$s" class="%2$s">%3$s</a>', esc_url( $url ), $class, $text );
    13371337
    13381338        return $views;

  • trunk/src/bp-members/bp-members-functions.php

    r9723 r9772  
    22992299    );
    23002300
    2301     $resend_string = '<br /><br />' . sprintf( __( 'If you have not received an email yet, <a href="%s">click here to resend it</a>.', 'buddypress' ), $resend_url );
     2301    $resend_string = '<br /><br />' . sprintf( __( 'If you have not received an email yet, <a href="%s">click here to resend it</a>.', 'buddypress' ), esc_url( $resend_url ) );
    23022302
    23032303    return new WP_Error( 'bp_account_not_activated', __( '<strong>ERROR</strong>: Your account has not been activated. Check your email for the activation link.', 'buddypress' ) . $resend_string );

  • trunk/src/bp-members/bp-members-template.php

    r9765 r9772  
    23422342 */
    23432343function bp_members_component_link( $component, $action = '', $query_args = '', $nonce = false ) {
    2344     echo bp_get_members_component_link( $component, $action, $query_args, $nonce );
     2344    echo esc_url( bp_get_members_component_link( $component, $action, $query_args, $nonce ) );
    23452345}
    23462346    /**
Note: See TracChangeset for help on using the changeset viewer.