| @@ -1,7 +1,8 @@ | ||
| 1 | 1 | <?php |
| 2 | 2 | |
| 3 | 3 | use FluentBoards\App\App; |
| 4 | +use FluentBoards\App\Services\Constant; | |
| 4 | 5 | |
| 5 | 6 | // $app is available |
| 6 | 7 | |
| 7 | 8 | if (!function_exists('fluentBoards')) { |
| @@ -27,8 +28,19 @@ | ||
| 27 | 28 | |
| 28 | 29 | return $url ? '[' . $url . '](' . str_replace(')', '%29', $url) . ')' : $matches[0]; |
| 29 | 30 | }, (string) $description); |
| 30 | 31 | |
| 32 | + // Markdown email autolinks otherwise look like disallowed HTML to KSES. | |
| 33 | + $description = preg_replace_callback('/<(?:mailto:)?([^<>\s]+@[^<>\s]+)>/i', function ($matches) { | |
| 34 | + $email = html_entity_decode($matches[1], ENT_QUOTES | ENT_HTML5, 'UTF-8'); | |
| 35 | + if (!is_email($email)) { | |
| 36 | + return $matches[0]; | |
| 37 | + } | |
| 38 | + | |
| 39 | + $label = str_replace(['*', '_', '`'], ['\\*', '\\_', '\\`'], $email); | |
| 40 | + return '[' . $label . '](mailto:' . $email . ')'; | |
| 41 | + }, $description); | |
| 42 | + | |
| 31 | 43 | // KSES encodes standalone > characters, which breaks Markdown quotes. |
| 32 | 44 | // Protect only quote prefixes; all HTML still passes through KSES. |
| 33 | 45 | $quotePrefix = 'fbs-quote-' . wp_generate_uuid4() . '-'; |
| 34 | 46 | $quotes = []; |
| @@ -47,9 +59,9 @@ | ||
| 47 | 59 | { |
| 48 | 60 | $user = get_user_by('email', $email); |
| 49 | 61 | |
| 50 | 62 | if ($user) { |
| 51 | - $photo_url = get_user_meta($user->ID, 'fbs_profile_photo', true); | |
| 63 | + $photo_url = get_user_meta($user->ID, Constant::PROFILE_PHOTO_META_KEY, true); | |
| 52 | 64 | if ($photo_url) { |
| 53 | 65 | return apply_filters('fluent_boards/get_avatar', $photo_url, $email); |
| 54 | 66 | } |
| 55 | 67 | |
