Changeset 7084 for trunk/src/includes/admin/forums.php

Timestamp:

05/28/2020 11:40:56 AM (5 years ago)

Author:

johnjamesjacoby

Message:

Forums: Escape forum descriptions in admin-area list tables.

This commit ensures that HTML is not rendered where it is not intended to be, most important to users having the unfiltered_html capability.

Props binit.

In trunk, for 2.7.0.

See #3374.

File:

• trunk/src/includes/admin/forums.php (modified) (1 diff)

trunk/src/includes/admin/forums.php

@@ -636 +636 @@
         }
 
-        // simple hack to show the forum description under the title
-        bbp_forum_content( $forum->ID );
+        // Only show content if user can read it and there is no password
+        if ( current_user_can( 'read_forum', $forum->ID ) && ! post_password_required( $forum ) ) {
+
+            // Get the forum description
+            $content = bbp_get_forum_content( $forum->ID );
+
+            // Only proceed if there is a description
+            if ( ! empty( $content ) ) {
+                echo '<div class="bbp-escaped-content">' . esc_html( wp_trim_excerpt( $content, $forum ) ) . '</div>';
+            }
+        }
 
         // Sort & return