Skip to:

Opened 6 months ago

Closed 2 months ago

#9079 closed defect (bug) (fixed)

PHP code is printed to document source in JS templates

Reported by: chairmanbrando's profile chairmanbrando Owned by: imath's profile imath
Milestone: 14.0.0 Priority: normal
Severity: normal Version: 12.1.1
Component: Templates Keywords: has-patch


bp_get_dynamic_template_part() uses file_get_contents() which means the PHP code in these templates isn't processed by the server. wp_kses() would strip it, but it's not run when the $type parameter in this function is set to "js". The entirety of the file's contents is output including the PHP comment at the top. This seems to affect three blocks/widgets:

  • bp-friends/bp-friends-blocks.php
  • bp-groups/bp-groups-blocks.php
  • bp-members/bp-members-blocks.php

Attachments (1)

Screenshot 2024-01-22 at 1.44.16 PM.png (36.0 KB) - added by chairmanbrando 6 months ago.
Screenshot of the document source when using the Dynamic Members widget

Download all attachments as: .zip

Change History (5)

6 months ago

Screenshot of the document source when using the Dynamic Members widget

#1 @imath
6 months ago

  • Keywords needs-patch added
  • Milestone changed from Awaiting Review to 14.0.0

Hi @chairmanbrando

Thanks a lot for your feedback. We’ll have it fixed 👌

#2 @imath
5 months ago

  • Owner set to imath
  • Status changed from new to assigned

This ticket was mentioned in PR #289 on buddypress/buddypress by imath.

2 months ago

  • Keywords has-patch added; needs-patch removed

This template part is used to preview and display the dynamic widget blocks content. As previewing is made using the REST API, we need to buffer the rendered template to perform token replacements.

Trac ticket:

#4 @imath
2 months ago

  • Resolution set to fixed
  • Status changed from assigned to closed

In 13867:

Stop getting dynamic widget block template parts, use buffer instead

Dynamic widget block template parts are used to preview and display the corresponding blocks content. As previewing within the Block Editor is made using the REST API, we need to add the rendered templates to the buffer to perform token replacements.

Props chairmanbrando

Fixes #9079

Note: See TracTickets for help on using tickets.