Changeset 14301

Timestamp:

12/17/2024 04:02:40 AM (13 months ago)

Author:

dd32

Message:

Support Forums: Don't allow HTML in user notes.

Location:

sites/trunk/wordpress.org/public_html/wp-content/plugins/support-forums/inc

Files:

• class-audit-log.php (modified) (1 diff)
• class-ratings-compat.php (modified) (1 diff)
• class-user-notes.php (modified) (1 diff)

sites/trunk/wordpress.org/public_html/wp-content/plugins/support-forums/inc/class-audit-log.php

@@ -225 +225 @@
                     "\n",
                     "\n> ",
-                    $note_text
+                    htmlspecialchars_decode(
+                        $note_text
+                    )
                 )
             );

sites/trunk/wordpress.org/public_html/wp-content/plugins/support-forums/inc/class-ratings-compat.php

@@ -107 +107 @@
         // Don't adjust if it's looking for a specific users review, such as, `::review_exists()`
         if ( $query->get( 'author' ) ) {
-            return $clauses;    
+            return $clauses;
         }
 

sites/trunk/wordpress.org/public_html/wp-content/plugins/support-forums/inc/class-user-notes.php

@@ -350 +350 @@
             $this->user_notes[ $user_id ]->html .= sprintf(
                 '<div class="bbp-template-notice warning">%s %s</div>' . "\n",
-                apply_filters( 'comment_text', $note->text, null, array() ),
+                apply_filters( 'comment_text', esc_html( $note->text ), null, array() ),
                 sprintf( '<p class="wporg-bbp-user-note-meta">%s</p>' . "\n",
                     implode( ' | ', $note_meta )