| @@ -164,15 +164,16 @@ | ||
| 164 | 164 | /* |
| 165 | 165 | * Decode entities first so a stored pseudo-tag like |
| 166 | 166 | * `<img>` becomes a real `<img>` for the next |
| 167 | 167 | * step to remove, then strip any tags so the JSON |
| 168 | - * response contains only plain text. `esc_url()` | |
| 169 | - * rejects `javascript:` and other unsafe schemes. | |
| 168 | + * response contains only plain text. `esc_url_raw()` | |
| 169 | + * rejects `javascript:` and other unsafe schemes without | |
| 170 | + * HTML-encoding ampersands (this is JSON, not markup). | |
| 170 | 171 | */ |
| 171 | 172 | return array( |
| 172 | 173 | 'name' => \wp_strip_all_tags( \html_entity_decode( $comment->comment_author, ENT_QUOTES ) ), |
| 173 | - 'url' => \esc_url( $comment->comment_author_url ), | |
| 174 | - 'avatar' => \esc_url( \get_avatar_url( $comment ) ), | |
| 174 | + 'url' => \esc_url_raw( $comment->comment_author_url ), | |
| 175 | + 'avatar' => \esc_url_raw( \get_avatar_url( $comment ) ), | |
| 175 | 176 | ); |
| 176 | 177 | }, |
| 177 | 178 | $comments |
| 178 | 179 | ), |
| @@ -196,9 +197,9 @@ | ||
| 196 | 197 | if ( false === $collection ) { |
| 197 | 198 | return new \WP_Error( 'activitypub_post_not_found', \__( 'Post not found', 'activitypub' ), array( 'status' => 404 ) ); |
| 198 | 199 | } |
| 199 | 200 | |
| 200 | - $response = array_merge( | |
| 201 | + $response = \array_merge( | |
| 201 | 202 | array( |
| 202 | 203 | '@context' => Base_Object::JSON_LD_CONTEXT, |
| 203 | 204 | 'id' => get_rest_url_by_path( \sprintf( 'posts/%d/context', $post_id ) ), |
| 204 | 205 | ), |
