Gravatar Link printed as plain text

[vapvarun]

At member's change cover image section

Gravatar.com link is printed as plain text due to use of esc_html_e

bp-templates/bp-nouveau/buddypress/members/single/profile/change-avatar.php

Line 18 & Line 77

[vapvarun]

Gravatar.com link

[imath]

Thanks for your feedback @vapvarun I’ll work on a patch asap.

[imath]

7895.patch is my suggestion to fix the issue, another more straightforward way could be to use _e() instead of esc_html_e().

[DJPaul]

Current best practice is to HTML escape translations because translations could come from an untrustworthy source.

[DJPaul]

Or... just take the link to Gravatar out entirely.

[imath]

Well we have this situation for strings used into feedback messages anyway so the patch is simply creating a specific function to escape it out of the filters that are actually used. It’s the same issue than #7894 where it’s a bit difficult to remove the link there. Splitting strings is a bit risky imho but that’s another possibility.

[DJPaul]

For this specific issue, it's just the Gravatar link. #7894 is similar but different.

If there is no way to avoid having HTML in a translatable strings, then the easiest solution is to use sprintf and a translator's comment along the lines of "do not remove <a> tags". Adding in a template-pack specific sanitisation function for a string is over-engineering.

I think in #7894 we can try re-phrasing the sentence so that it is understandable and moves any HTML markup out of the translatable string (minus the placeholder). Over the next couple of weeks, I hope to have time to suggest some way of rephrasing the messages.

[imath]

Ok, fine with me. I suggest 7895.2.patch then. Here's the result :

Now people can use the Gravatar site of their area in the translation file, eg: ​https://fr.gravatar.com

[imath]

In ​7895.3.patch I'm updating the patch I think @spdustin shared on the wrong ticket see the ​timeline. His patch improves mine by not forgetting to fix the same issue a few lines under when avatar uploads are disabled.

I think we should go with it.

[spdustin]

Whoops. My bad. I think I crossed patches.

[imath]

In 12216:

BP Nouveau: escape properly the user Profile Photo Gravatar fallback

Props vapvarun, DJPaul, spdustin

See #7895 (branch 3.0)

[imath]

In 12217:

BP Nouveau: escape properly the user Profile Photo Gravatar fallback

Props vapvarun, DJPaul, spdustin

Fixes #7895 (trunk)