Skip to:
Content

bbPress.org

Changeset 5692


Ignore:
Timestamp:
04/20/2015 04:40:37 PM (11 years ago)
Author:
johnjamesjacoby
Message:

All: ensure all URLs are escaped (2.5 branch)

Location:
branches/2.5/includes
Files:
9 edited

Legend:

Unmodified
Added
Removed

  • branches/2.5/includes/admin/admin.php

    r5630 r5692  
    510510        // Settings page link
    511511        if ( current_user_can( 'bbp_settings_page' ) ) {
    512             $new_links['settings'] = '<a href="' . add_query_arg( array( 'page' => 'bbpress'   ), admin_url( 'options-general.php' ) ) . '">' . esc_html__( 'Settings', 'bbpress' ) . '</a>';
     512            $new_links['settings'] = '<a href="' . esc_url( add_query_arg( array( 'page' => 'bbpress'   ), admin_url( 'options-general.php' ) ) ) . '">' . esc_html__( 'Settings', 'bbpress' ) . '</a>';
    513513        }
    514514
    515515        // About page link
    516516        if ( current_user_can( 'bbp_about_page' ) ) {
    517             $new_links['about']    = '<a href="' . add_query_arg( array( 'page' => 'bbp-about' ), admin_url( 'index.php'          ) ) . '">' . esc_html__( 'About',    'bbpress' ) . '</a>';
     517            $new_links['about']    = '<a href="' . esc_url( add_query_arg( array( 'page' => 'bbp-about' ), admin_url( 'index.php'           ) ) ) . '">' . esc_html__( 'About',    'bbpress' ) . '</a>';
    518518        }
    519519
    … …  
    541541     */
    542542    public function admin_bar_about_link( $wp_admin_bar ) {
    543 
    544543        if ( is_user_logged_in() ) {
    545 
    546544            $wp_admin_bar->add_menu( array(
    547545                'parent' => 'wp-logo',

  • branches/2.5/includes/admin/metaboxes.php

    r5630 r5692  
    5151                    if ( current_user_can( 'publish_forums' ) ) {
    5252                        $link = add_query_arg( array( 'post_type' => bbp_get_forum_post_type() ), get_admin_url( null, 'edit.php' ) );
    53                         $num  = '<a href="' . $link . '">' . $num  . '</a>';
    54                         $text = '<a href="' . $link . '">' . $text . '</a>';
     53                        $num  = '<a href="' . esc_url( $link ) . '">' . $num  . '</a>';
     54                        $text = '<a href="' . esc_url( $link ) . '">' . $text . '</a>';
    5555                    }
    5656                ?>
    … …  
    6868                    if ( current_user_can( 'publish_topics' ) ) {
    6969                        $link = add_query_arg( array( 'post_type' => bbp_get_topic_post_type() ), get_admin_url( null, 'edit.php' ) );
    70                         $num  = '<a href="' . $link . '">' . $num  . '</a>';
    71                         $text = '<a href="' . $link . '">' . $text . '</a>';
     70                        $num  = '<a href="' . esc_url( $link ) . '">' . $num  . '</a>';
     71                        $text = '<a href="' . esc_url( $link ) . '">' . $text . '</a>';
    7272                    }
    7373                ?>
    … …  
    8585                    if ( current_user_can( 'publish_replies' ) ) {
    8686                        $link = add_query_arg( array( 'post_type' => bbp_get_reply_post_type() ), get_admin_url( null, 'edit.php' ) );
    87                         $num  = '<a href="' . $link . '">' . $num  . '</a>';
    88                         $text = '<a href="' . $link . '">' . $text . '</a>';
     87                        $num  = '<a href="' . esc_url( $link ) . '">' . $num  . '</a>';
     88                        $text = '<a href="' . esc_url( $link ) . '">' . $text . '</a>';
    8989                    }
    9090                ?>
    … …  
    104104                        if ( current_user_can( 'manage_topic_tags' ) ) {
    105105                            $link = add_query_arg( array( 'taxonomy' => bbp_get_topic_tag_tax_id(), 'post_type' => bbp_get_topic_post_type() ), get_admin_url( null, 'edit-tags.php' ) );
    106                             $num  = '<a href="' . $link . '">' . $num  . '</a>';
    107                             $text = '<a href="' . $link . '">' . $text . '</a>';
     106                            $num  = '<a href="' . esc_url( $link ) . '">' . $num  . '</a>';
     107                            $text = '<a href="' . esc_url( $link ) . '">' . $text . '</a>';
    108108                        }
    109109                    ?>
    … …  
    136136                    if ( current_user_can( 'edit_users' ) ) {
    137137                        $link = get_admin_url( null, 'users.php' );
    138                         $num  = '<a href="' . $link . '">' . $num  . '</a>';
    139                         $text = '<a href="' . $link . '">' . $text . '</a>';
     138                        $num  = '<a href="' . esc_url( $link ) . '">' . $num  . '</a>';
     139                        $text = '<a href="' . esc_url( $link ) . '">' . $text . '</a>';
    140140                    }
    141141                ?>
    … …  
    157157                            $link = add_query_arg( array( 'post_status' => bbp_get_spam_status_id() ), $link );
    158158                        }
    159                         $num  = '<a href="' . $link . '" title="' . esc_attr( $r['hidden_topic_title'] ) . '">' . $num  . '</a>';
    160                         $text = '<a class="waiting" href="' . $link . '" title="' . esc_attr( $r['hidden_topic_title'] ) . '">' . $text . '</a>';
     159                        $num  = '<a href="' . esc_url( $link ) . '" title="' . esc_attr( $r['hidden_topic_title'] ) . '">' . $num  . '</a>';
     160                        $text = '<a class="waiting" href="' . esc_url( $link ) . '" title="' . esc_attr( $r['hidden_topic_title'] ) . '">' . $text . '</a>';
    161161                    ?>
    162162
    … …  
    179179                            $link = add_query_arg( array( 'post_status' => bbp_get_spam_status_id() ), $link );
    180180                        }
    181                         $num  = '<a href="' . $link . '" title="' . esc_attr( $r['hidden_reply_title'] ) . '">' . $num  . '</a>';
    182                         $text = '<a class="waiting" href="' . $link . '" title="' . esc_attr( $r['hidden_reply_title'] ) . '">' . $text . '</a>';
     181                        $num  = '<a href="' . esc_url( $link ) . '" title="' . esc_attr( $r['hidden_reply_title'] ) . '">' . $num  . '</a>';
     182                        $text = '<a class="waiting" href="' . esc_url( $link ) . '" title="' . esc_attr( $r['hidden_reply_title'] ) . '">' . $text . '</a>';
    183183                    ?>
    184184
    … …  
    198198                        $text = _n( 'Empty Topic Tag', 'Empty Topic Tags', $r['empty_topic_tag_count'], 'bbpress' );
    199199                        $link = add_query_arg( array( 'taxonomy' => bbp_get_topic_tag_tax_id(), 'post_type' => bbp_get_topic_post_type() ), get_admin_url( null, 'edit-tags.php' ) );
    200                         $num  = '<a href="' . $link . '">' . $num  . '</a>';
    201                         $text = '<a class="waiting" href="' . $link . '">' . $text . '</a>';
     200                        $num  = '<a href="' . esc_url( $link ) . '">' . $num  . '</a>';
     201                        $text = '<a class="waiting" href="' . esc_url( $link ) . '">' . $text . '</a>';
    202202                    ?>
    203203
    … …  
    457457        <strong class="label"><?php esc_html_e( 'Topic:', 'bbpress' ); ?></strong>
    458458        <label class="screen-reader-text" for="parent_id"><?php esc_html_e( 'Topic', 'bbpress' ); ?></label>
    459         <input name="parent_id" id="bbp_topic_id" type="text" value="<?php echo esc_attr( $reply_topic_id ); ?>" data-ajax-url="<?php echo wp_nonce_url( add_query_arg( array( 'action' => 'bbp_suggest_topic' ), admin_url( 'admin-ajax.php', 'relative' ) ), 'bbp_suggest_topic_nonce' ); ?>" />
     459        <input name="parent_id" id="bbp_topic_id" type="text" value="<?php echo esc_attr( $reply_topic_id ); ?>" data-ajax-url="<?php echo esc_url( wp_nonce_url( add_query_arg( array( 'action' => 'bbp_suggest_topic' ), admin_url( 'admin-ajax.php', 'relative' ) ) ), 'bbp_suggest_topic_nonce' ); ?>" />
    460460    </p>
    461461
    … …  
    516516            <strong class="label"><?php esc_html_e( 'ID:', 'bbpress' ); ?></strong>
    517517            <label class="screen-reader-text" for="bbp_author_id"><?php esc_html_e( 'ID', 'bbpress' ); ?></label>
    518             <input type="text" id="bbp_author_id" name="post_author_override" value="<?php echo esc_attr( bbp_get_global_post_field( 'post_author' ) ); ?>" data-ajax-url="<?php echo wp_nonce_url( add_query_arg( array( 'action' => 'bbp_suggest_user' ), admin_url( 'admin-ajax.php', 'relative' ) ), 'bbp_suggest_user_nonce' ); ?>" />
     518            <input type="text" id="bbp_author_id" name="post_author_override" value="<?php echo esc_attr( bbp_get_global_post_field( 'post_author' ) ); ?>" data-ajax-url="<?php echo esc_url( wp_nonce_url( add_query_arg( array( 'action' => 'bbp_suggest_user' ), admin_url( 'admin-ajax.php', 'relative' ) ) ), 'bbp_suggest_user_nonce' ); ?>" />
    519519        </p>
    520520

  • branches/2.5/includes/admin/replies.php

    r5040 r5692  
    593593     * @uses bbp_get_forum_permalink() To get the forum permalink
    594594     * @uses admin_url() To get the admin url of post.php
    595      * @uses add_query_arg() To add custom args to the url
    596595     * @uses apply_filters() Calls 'reply_topic_forum_row_actions' with an
    597596     *                        array of reply topic forum actions
    … …  
    746745            if ( bbp_get_trash_status_id() === $reply->post_status ) {
    747746                $post_type_object   = get_post_type_object( bbp_get_reply_post_type() );
    748                 $actions['untrash'] = "<a title='" . esc_attr__( 'Restore this item from the Trash', 'bbpress' ) . "' href='" . add_query_arg( array( '_wp_http_referer' => add_query_arg( array( 'post_type' => bbp_get_reply_post_type() ), admin_url( 'edit.php' ) ) ), wp_nonce_url( admin_url( sprintf( $post_type_object->_edit_link . '&amp;action=untrash', $reply->ID ) ), 'untrash-' . $reply->post_type . '_' . $reply->ID ) ) . "'>" . esc_html__( 'Restore', 'bbpress' ) . "</a>";
     747                $actions['untrash'] = "<a title='" . esc_attr__( 'Restore this item from the Trash', 'bbpress' ) . "' href='" . esc_url( add_query_arg( array( '_wp_http_referer' => add_query_arg( array( 'post_type' => bbp_get_reply_post_type() ), admin_url( 'edit.php' ) ) ), wp_nonce_url( admin_url( sprintf( $post_type_object->_edit_link . '&amp;action=untrash', $reply->ID ) ), 'untrash-' . $reply->post_type . '_' . $reply->ID ) ) ) . "'>" . esc_html__( 'Restore', 'bbpress' ) . "</a>";
    749748            } elseif ( EMPTY_TRASH_DAYS ) {
    750                 $actions['trash'] = "<a class='submitdelete' title='" . esc_attr__( 'Move this item to the Trash', 'bbpress' ) . "' href='" . add_query_arg( array( '_wp_http_referer' => add_query_arg( array( 'post_type' => bbp_get_reply_post_type() ), admin_url( 'edit.php' ) ) ), get_delete_post_link( $reply->ID ) ) . "'>" . esc_html__( 'Trash', 'bbpress' ) . "</a>";
     749                $actions['trash'] = "<a class='submitdelete' title='" . esc_attr__( 'Move this item to the Trash', 'bbpress' ) . "' href='" . esc_url( add_query_arg( array( '_wp_http_referer' => add_query_arg( array( 'post_type' => bbp_get_reply_post_type() ), admin_url( 'edit.php' ) ) ), get_delete_post_link( $reply->ID ) ) ) . "'>" . esc_html__( 'Trash', 'bbpress' ) . "</a>";
    751750            }
    752751
    753752            if ( bbp_get_trash_status_id() === $reply->post_status || !EMPTY_TRASH_DAYS ) {
    754                 $actions['delete'] = "<a class='submitdelete' title='" . esc_attr__( 'Delete this item permanently', 'bbpress' ) . "' href='" . add_query_arg( array( '_wp_http_referer' => add_query_arg( array( 'post_type' => bbp_get_reply_post_type() ), admin_url( 'edit.php' ) ) ), get_delete_post_link( $reply->ID, '', true ) ) . "'>" . esc_html__( 'Delete Permanently', 'bbpress' ) . "</a>";
     753                $actions['delete'] = "<a class='submitdelete' title='" . esc_attr__( 'Delete this item permanently', 'bbpress' ) . "' href='" . esc_url( add_query_arg( array( '_wp_http_referer' => add_query_arg( array( 'post_type' => bbp_get_reply_post_type() ), admin_url( 'edit.php' ) ) ), get_delete_post_link( $reply->ID, '', true ) ) ) . "'>" . esc_html__( 'Delete Permanently', 'bbpress' ) . "</a>";
    755754            } elseif ( bbp_get_spam_status_id() === $reply->post_status ) {
    756755                unset( $actions['trash'] );

  • branches/2.5/includes/admin/topics.php

    r5073 r5692  
    655655     * @uses bbp_get_forum_permalink() To get the forum permalink
    656656     * @uses admin_url() To get the admin url of post.php
    657      * @uses add_query_arg() To add custom args to the url
    658657     * @uses bbp_topic_reply_count() To output the topic reply count
    659658     * @uses bbp_topic_voice_count() To output the topic voice count
    … …  
    816815            if ( bbp_get_trash_status_id() === $topic->post_status ) {
    817816                $post_type_object   = get_post_type_object( bbp_get_topic_post_type() );
    818                 $actions['untrash'] = "<a title='" . esc_attr__( 'Restore this item from the Trash', 'bbpress' ) . "' href='" . wp_nonce_url( add_query_arg( array( '_wp_http_referer' => add_query_arg( array( 'post_type' => bbp_get_topic_post_type() ), admin_url( 'edit.php' ) ) ), admin_url( sprintf( $post_type_object->_edit_link . '&amp;action=untrash', $topic->ID ) ) ), 'untrash-' . $topic->post_type . '_' . $topic->ID ) . "'>" . esc_html__( 'Restore', 'bbpress' ) . "</a>";
     817                $actions['untrash'] = "<a title='" . esc_attr__( 'Restore this item from the Trash', 'bbpress' ) . "' href='" . esc_url( wp_nonce_url( add_query_arg( array( '_wp_http_referer' => add_query_arg( array( 'post_type' => bbp_get_topic_post_type() ), admin_url( 'edit.php' ) ) ), admin_url( sprintf( $post_type_object->_edit_link . '&amp;action=untrash', $topic->ID ) ) ), 'untrash-' . $topic->post_type . '_' . $topic->ID ) ) . "'>" . esc_html__( 'Restore', 'bbpress' ) . "</a>";
    819818            } elseif ( EMPTY_TRASH_DAYS ) {
    820                 $actions['trash'] = "<a class='submitdelete' title='" . esc_attr__( 'Move this item to the Trash', 'bbpress' ) . "' href='" . add_query_arg( array( '_wp_http_referer' => add_query_arg( array( 'post_type' => bbp_get_topic_post_type() ), admin_url( 'edit.php' ) ) ), get_delete_post_link( $topic->ID ) ) . "'>" . esc_html__( 'Trash', 'bbpress' ) . "</a>";
     819                $actions['trash'] = "<a class='submitdelete' title='" . esc_attr__( 'Move this item to the Trash', 'bbpress' ) . "' href='" . esc_url( add_query_arg( array( '_wp_http_referer' => add_query_arg( array( 'post_type' => bbp_get_topic_post_type() ), admin_url( 'edit.php' ) ) ), get_delete_post_link( $topic->ID ) ) ) . "'>" . esc_html__( 'Trash', 'bbpress' ) . "</a>";
    821820            }
    822821
    823822            if ( bbp_get_trash_status_id() === $topic->post_status || !EMPTY_TRASH_DAYS ) {
    824                 $actions['delete'] = "<a class='submitdelete' title='" . esc_attr__( 'Delete this item permanently', 'bbpress' ) . "' href='" . add_query_arg( array( '_wp_http_referer' => add_query_arg( array( 'post_type' => bbp_get_topic_post_type() ), admin_url( 'edit.php' ) ) ), get_delete_post_link( $topic->ID, '', true ) ) . "'>" . esc_html__( 'Delete Permanently', 'bbpress' ) . "</a>";
     823                $actions['delete'] = "<a class='submitdelete' title='" . esc_attr__( 'Delete this item permanently', 'bbpress' ) . "' href='" . esc_url( add_query_arg( array( '_wp_http_referer' => add_query_arg( array( 'post_type' => bbp_get_topic_post_type() ), admin_url( 'edit.php' ) ) ), get_delete_post_link( $topic->ID, '', true ) ) ) . "'>" . esc_html__( 'Delete Permanently', 'bbpress' ) . "</a>";
    825824            } elseif ( bbp_get_spam_status_id() === $topic->post_status ) {
    826825                unset( $actions['trash'] );

  • branches/2.5/includes/common/template.php

    r5247 r5692  
    11351135 * @since bbPress (r2815)
    11361136 *
    1137  * @param string $url Pass a URL to redirect to
     1137 * @param string $args Pass a URL to redirect to
    11381138 * @uses add_query_arg() To add a arg to the url
    11391139 * @uses site_url() Toget the site url
    … …  
    11411141 */
    11421142function bbp_wp_login_action( $args = '' ) {
    1143 
    1144     // Parse arguments against default values
    1145     $r = bbp_parse_args( $args, array(
    1146         'action'  => '',
    1147         'context' => ''
    1148     ), 'login_action' );
    1149 
    1150     // Add action as query arg
    1151     if ( !empty( $r['action'] ) ) {
    1152         $login_url = add_query_arg( array( 'action' => $r['action'] ), 'wp-login.php' );
    1153 
    1154     // No query arg
    1155     } else {
    1156         $login_url = 'wp-login.php';
     1143    echo esc_url( bbp_wp_login_action( $args ) );
     1144}
     1145
     1146    /**
     1147     * return the login form action url
     1148     *
     1149     * @since bbPress (r5691)
     1150     *
     1151     * @param string $args Pass a URL to redirect to
     1152     * @uses add_query_arg() To add a arg to the url
     1153     * @uses site_url() Toget the site url
     1154     * @uses apply_filters() Calls 'bbp_wp_login_action' with the url and args
     1155     */
     1156    function bbp_get_wp_login_action( $args = '' ) {
     1157
     1158        // Parse arguments against default values
     1159        $r = bbp_parse_args( $args, array(
     1160            'action'  => '',
     1161            'context' => '',
     1162            'url'     => 'wp-login.php'
     1163        ), 'login_action' );
     1164
     1165        // Add action as query arg
     1166        if ( !empty( $r['action'] ) ) {
     1167            $login_url = add_query_arg( array( 'action' => $r['action'] ), $r['url'] );
     1168
     1169        // No query arg
     1170        } else {
     1171            $login_url = $r['url'];
     1172        }
     1173
     1174        $login_url = site_url( $login_url, $r['context'] );
     1175
     1176        return apply_filters( 'bbp_wp_login_action', $login_url, $r, $args );
    11571177    }
    1158 
    1159     $login_url = site_url( $login_url, $r['context'] );
    1160 
    1161     echo apply_filters( 'bbp_wp_login_action', $login_url, $r );
    1162 }
    11631178
    11641179/**
    … …  
    11881203
    11891204    // Remove loggedout query arg if it's there
    1190     $redirect_to    = (string) esc_attr( remove_query_arg( 'loggedout', $redirect_to ) );
    1191     $redirect_field = '<input type="hidden" id="bbp_redirect_to" name="redirect_to" value="' . $redirect_to . '" />';
     1205    $redirect_to    = remove_query_arg( 'loggedout', $redirect_to );
     1206    $redirect_field = '<input type="hidden" id="bbp_redirect_to" name="redirect_to" value="' . esc_url( $redirect_to ) . '" />';
    11921207
    11931208    echo apply_filters( 'bbp_redirect_to_field', $redirect_field, $redirect_to );

  • branches/2.5/includes/replies/functions.php

    r5377 r5692  
    14961496 *                    and action
    14971497 * @uses bbp_get_reply_url() To get the reply url
    1498  * @uses add_query_arg() To add custom args to the reply url
    14991498 * @uses wp_safe_redirect() To redirect to the reply
    15001499 * @uses bbPress::errors:add() To log the error messages

  • branches/2.5/includes/replies/template.php

    r5377 r5692  
    459459     *
    460460     * @param int $reply_id Optional. Reply id
    461      * @param $string $redirect_to Optional. Pass a redirect value for use with
     461     * @param string $redirect_to Optional. Pass a redirect value for use with
    462462     *                              shortcodes and other fun things.
    463463     * @uses bbp_get_reply_id() To get the reply id

  • branches/2.5/includes/topics/functions.php

    r5377 r5692  
    20522052 * @uses bbp_get_forum_permalink() To get the forum link
    20532053 * @uses bbp_get_topic_permalink() To get the topic link
    2054  * @uses add_query_arg() To add args to the url
    20552054 * @uses wp_safe_redirect() To redirect to the topic
    20562055 * @uses bbPress::errors:add() To log the error messages

  • branches/2.5/includes/topics/template.php

    r5237 r5692  
    20942094     * @uses current_user_can() To check if the current user can edit others
    20952095     *                           replies
    2096      * @uses add_query_arg() To add custom args to the url
    20972096     * @uses apply_filters() Calls 'bbp_get_topic_replies_link' with the
    20982097     *                        replies link and topic id
Note: See TracChangeset for help on using the changeset viewer.