| @@ -13,9 +13,8 @@ | ||
| 13 | 13 | use Activitypub\Sanitize; |
| 14 | 14 | use Activitypub\Webfinger; |
| 15 | 15 | |
| 16 | 16 | use function Activitypub\get_post_id; |
| 17 | -use function Activitypub\get_reaction_author_name; | |
| 18 | 17 | use function Activitypub\get_rest_url_by_path; |
| 19 | 18 | |
| 20 | 19 | /** |
| 21 | 20 | * Class Post_Controller |
| @@ -162,14 +161,17 @@ | ||
| 162 | 161 | 'label' => $label, |
| 163 | 162 | 'items' => \array_map( |
| 164 | 163 | static function ( $comment ) { |
| 165 | 164 | /* |
| 166 | - * `esc_url_raw()` rejects `javascript:` and other unsafe | |
| 167 | - * schemes without HTML-encoding ampersands (this is JSON, | |
| 168 | - * not markup). | |
| 165 | + * Decode entities first so a stored pseudo-tag like | |
| 166 | + * `<img>` becomes a real `<img>` for the next | |
| 167 | + * step to remove, then strip any tags so the JSON | |
| 168 | + * response contains only plain text. `esc_url_raw()` | |
| 169 | + * rejects `javascript:` and other unsafe schemes without | |
| 170 | + * HTML-encoding ampersands (this is JSON, not markup). | |
| 169 | 171 | */ |
| 170 | 172 | return array( |
| 171 | - 'name' => get_reaction_author_name( $comment ), | |
| 173 | + 'name' => \wp_strip_all_tags( \html_entity_decode( $comment->comment_author, ENT_QUOTES ) ), | |
| 172 | 174 | 'url' => \esc_url_raw( $comment->comment_author_url ), |
| 173 | 175 | 'avatar' => \esc_url_raw( \get_avatar_url( $comment ) ), |
| 174 | 176 | ); |
| 175 | 177 | }, |
