Skip to:
Content

bbPress.org


Ignore:
Timestamp:
07/17/2013 07:35:03 PM (13 years ago)
Author:
johnjamesjacoby
Message:

For all template functions that output URL's, always echo an escaped value using esc_url(). See #2367.

File:
1 edited

Legend:

Unmodified
Added
Removed

  • trunk/includes/users/template-tags.php

    r4995 r5037  
    256256
    257257        $user      = get_userdata( $user_id );
    258         $name      = esc_attr( $user->display_name );
    259         $user_link = '<a href="' . bbp_get_user_profile_url( $user_id ) . '">' . $name . '</a>';
     258        $user_link = '<a href="' . esc_url( bbp_get_user_profile_url( $user_id ) ) . '">' . esc_html( $user->display_name ) . '</a>';
    260259
    261260        return apply_filters( 'bbp_get_user_profile_link', $user_link, $user_id );
    … …  
    324323 */
    325324function bbp_user_profile_url( $user_id = 0, $user_nicename = '' ) {
    326     echo bbp_get_user_profile_url( $user_id, $user_nicename );
     325    echo esc_url( bbp_get_user_profile_url( $user_id, $user_nicename ) );
    327326}
    328327    /**
    … …  
    407406
    408407        $user      = get_userdata( $user_id );
    409         $name      = $user->display_name;
    410         $edit_link = '<a href="' . bbp_get_user_profile_url( $user_id ) . '">' . $name . '</a>';
     408        $edit_link = '<a href="' . esc_url( bbp_get_user_profile_url( $user_id ) ) . '">' . esc_html( $user->display_name ) . '</a>';
    411409        return apply_filters( 'bbp_get_user_profile_edit_link', $edit_link, $user_id );
    412410    }
    … …  
    422420 */
    423421function bbp_user_profile_edit_url( $user_id = 0, $user_nicename = '' ) {
    424     echo bbp_get_user_profile_edit_url( $user_id, $user_nicename );
     422    echo esc_url( bbp_get_user_profile_edit_url( $user_id, $user_nicename ) );
    425423}
    426424    /**
    … …  
    563561        ), 'get_admin_link' );
    564562
    565         $retval = $r['before'] . '<a href="' . admin_url() . '">' . $r['text'] . '</a>' . $r['after'];
     563        $retval = $r['before'] . '<a href="' . esc_url( admin_url() ) . '">' . $r['text'] . '</a>' . $r['after'];
    566564
    567565        return apply_filters( 'bbp_get_admin_link', $retval, $r );
    … …  
    626624 */
    627625function bbp_favorites_permalink( $user_id = 0 ) {
    628     echo bbp_get_favorites_permalink( $user_id );
     626    echo esc_url( bbp_get_favorites_permalink( $user_id ) );
    629627}
    630628    /**
    … …  
    788786 */
    789787function bbp_subscriptions_permalink( $user_id = 0 ) {
    790     echo bbp_get_subscriptions_permalink( $user_id );
     788    echo esc_url( bbp_get_subscriptions_permalink( $user_id ) );
    791789}
    792790    /**
    … …  
    11161114 */
    11171115function bbp_user_topics_created_url( $user_id = 0 ) {
    1118     echo bbp_get_user_topics_created_url( $user_id );
     1116    echo esc_url( bbp_get_user_topics_created_url( $user_id ) );
    11191117}
    11201118    /**
    … …  
    11761174 */
    11771175function bbp_user_replies_created_url( $user_id = 0 ) {
    1178     echo bbp_get_user_replies_created_url( $user_id );
     1176    echo esc_url( bbp_get_user_replies_created_url( $user_id ) );
    11791177}
    11801178    /**
Note: See TracChangeset for help on using the changeset viewer.