Escaping BuddyPress Templates Files

[espellcaste]

I'm listing and sending below the BuddyPress templates files that I think should use some escaping.

​https://github.com/buddypress/BuddyPress/blob/master/src/bp-templates/bp-legacy/buddypress/members/members-loop.php#L60

​https://github.com/buddypress/BuddyPress/blob/master/src/bp-templates/bp-legacy/buddypress/members/members-loop.php#L55

​https://github.com/buddypress/BuddyPress/blob/master/src/bp-templates/bp-legacy/buddypress/members/single/cover-image-header.php#L25

​https://github.com/buddypress/BuddyPress/blob/master/src/bp-templates/bp-legacy/buddypress/members/single/cover-image-header.php#L21

​https://github.com/buddypress/BuddyPress/blob/master/src/bp-templates/bp-legacy/buddypress/members/index.php#L53

...

Maybe there is more, I'm checking...

[r-a-y]

Moving to 2.7 for now.

This could also make 2.6.1 if we deem this important enough.

[mercime]

@espellcaste Thank you. One more thing to do to get the patch in step. See ​https://make.wordpress.org/core/handbook/tutorials/trac/submitting-a-patch/

[r-a-y]

In 11149:

Members: Escape various URL output functions.

Props espellcaste.

See #7132.

[r-a-y]

@espellcaste - I've committed the spots that you've pointed out.

If you or anyone else has some time to look over the rest of the templates, that would be great. Going to leave this open until we release v2.6 for now.

[espellcaste]

Thank you @r-a-y! Gonna try to take a deeper look soon! =)