Skip to content
GitLab
Explore
Sign in
Commits on Source (1)
Properly escape all URLs and user-controlled strings
· 68477d79
ale
authored
May 02, 2022
68477d79
Hide whitespace changes
Inline
Side-by-side
ai-global-activity.php
View file @
68477d79
...
...
@@ -176,19 +176,19 @@ function ai_activity_display_recent_posts($tmp_number, $tmp_title_characters, $t
if
(
$tmp_title_link
==
'no'
)
{
$html
.
=
$title_short
;
}
else
{
$html
.
=
"<a href=
\"
{
$post_url
}
\"
>
{
$title_short
}
</a>"
;
$html
.
=
"<a href=
\"
"
.
esc_url
(
$post_url
)
.
"
\"
>"
.
esc_html
(
$title_short
)
.
"
</a>"
;
}
if
(
$show_blog
)
{
$blog_name
=
esc_html
(
ai_activity_get_blog_name
(
$blog_id
)
)
;
$blog_name
=
ai_activity_get_blog_name
(
$blog_id
);
$site_url
=
get_site_url
(
$blog_id
);
$html
.
=
" (<a href=
\"
{
$site_url
}
\"
>
{
$blog_name
}
</a>)"
;
$html
.
=
" (<a href=
\"
"
.
esc_url
(
$site_url
)
.
"
\"
>"
.
esc_html
(
$blog_name
)
.
"
</a>)"
;
}
$html
.
=
"</div>"
;
}
if
(
$post
->
thumbnail_url
)
{
$html
.
=
"<img src=
\"
{
$post
->
thumbnail_url
}
\"
class=
\"
alignleft wp-post-image
\"
>"
;
$html
.
=
"<img src=
\"
"
.
esc_url
(
$post
->
thumbnail_url
)
.
"
\"
class=
\"
alignleft wp-post-image
\"
>"
;
}
$html
.
=
"<div class=
\"
post-content
\"
>
{
$post
->
excerpt
}
</div>"
;
...
...
@@ -199,11 +199,11 @@ function ai_activity_display_recent_posts($tmp_number, $tmp_title_characters, $t
$html
.
=
'<div class="global-activity-pagination">'
;
$prev_link
=
ai_activity_get_previous_page_link
();
if
(
$prev_link
)
{
$html
.
=
"<div class=
\"
nav-previous align-left
\"
><a href=
\"
{
$prev_link
}
\"
>Newer</a></div>"
;
$html
.
=
"<div class=
\"
nav-previous align-left
\"
><a href=
\"
"
.
esc_url
(
$prev_link
)
.
"
\"
>Newer</a></div>"
;
}
$next_link
=
ai_activity_get_next_page_link
();
if
(
$next_link
)
{
$html
.
=
"<div class=
\"
nav-next align-right
\"
><a href=
\"
{
$next_link
}
\"
>Older</a></div>"
;
$html
.
=
"<div class=
\"
nav-next align-right
\"
><a href=
\"
"
.
esc_url
(
$next_link
)
.
"
\"
>Older</a></div>"
;
}
$html
.
=
'</div>'
;
...
...