Skip to:
Content

BuddyPress.org

Opened 10 years ago

Closed 10 years ago

Last modified 8 years ago

#7074 closed defect (bug) (fixed)

Templates should utilize esc_attr when setting a link title attribute to bp_group_name

Reported by: garrett-eclipse Owned by: boonebgorges
Priority: normal Milestone: 2.6
Component: Groups Version: 2.5.0
Severity: normal Keywords:
Cc:

Description

Hello,

I noticed in group-header.php and I'm sure it's in several other places, that the bp_group_name is being applied to the title attribute of a link without any handling, should employ esc_attr.

​https://github.com/buddypress/BuddyPress/blob/master/src/bp-templates/bp-legacy/buddypress/groups/single/group-header.php#L61

<a href="<?php bp_group_permalink(); ?>" title="<?php bp_group_name(); ?>">

Should be pushed through esc_attr either in the template by using bp_get_group_name instead or by creating a new bp_group_name_attr function.

Thanks

Change History (5)

#1 @boonebgorges
10 years ago

  • Milestone Awaiting Review → 2.6
  • Owner set to boonebgorges
  • Status new → assigned

Thanks, @garrett-eclipse. If you spot other instances of this, please feel free to submit a ticket.

#2 @boonebgorges
10 years ago

  • Resolution → fixed
  • Status assigned → closed

In 10777:

Improve escaping in group-header.php template.

Props garrett-eclipse.
Fixes #7074.

#4 @boonebgorges
10 years ago

@espellcaste Can you please open a separate ticket with that info? I don't think there's time to address this for 2.6, and I don't want it to be lost.

#5 @espellcaste
10 years ago

@boonebgorges #7132 created and templates with the suggested changes added. I'm still to check and confirm if more templates needs escaping changes.

Note: See TracTickets for help on using tickets.