| @@ -380,31 +380,19 @@ | ||
| 380 | 380 | // badge text |
| 381 | 381 | if ( empty( $badge ) && empty($args['icon_class']) ) { |
| 382 | 382 | $badge = isset($field->site_title) ? $field->site_title : ''; |
| 383 | 383 | } |
| 384 | - // Decode entities in the admin-authored template text now, before any | |
| 385 | - // untrusted user values are substituted in below. Decoding after | |
| 386 | - // substitution would undo the escaping applied to those values. | |
| 387 | - if ( ! empty( $badge ) ) { | |
| 388 | - $badge = wp_specialchars_decode( $badge, ENT_QUOTES ); | |
| 389 | - } | |
| 390 | - if( !empty( $badge ) && $badge = str_replace("%%input%%", esc_html( (string) $match_value ), $badge) ){ | |
| 384 | + if( !empty( $badge ) && $badge = str_replace("%%input%%", $match_value,$badge) ){ | |
| 391 | 385 | // will be replace in condition check |
| 392 | 386 | } |
| 393 | - if( !empty( $badge ) && $user_id && $badge = str_replace("%%profile_url%%", esc_url( uwp_build_profile_tab_url($user_id) ),$badge) ){ | |
| 387 | + if( !empty( $badge ) && $user_id && $badge = str_replace("%%profile_url%%", uwp_build_profile_tab_url($user_id),$badge) ){ | |
| 394 | 388 | // will be replace in condition check |
| 395 | 389 | } |
| 396 | 390 | |
| 397 | - // link url, replace vars | |
| 398 | - if ( ! empty( $args['link'] ) && $args['link'] = str_replace( "%%input%%", $match_value, $args['link'] ) ) { | |
| 391 | + //link url, replace vars | |
| 392 | + if( !empty( $args['link'] ) && $args['link'] = str_replace("%%input%%", $match_value,$args['link']) ){ | |
| 399 | 393 | // will be replace in condition check |
| 400 | - if ( ! empty( $field->field_type ) && $field->field_type == 'url' ) { | |
| 401 | - $args['link'] = esc_url( $args['link'] ); | |
| 402 | - } else { | |
| 403 | - $args['link'] = esc_attr( $args['link'] ); | |
| 404 | - } | |
| 405 | 394 | } |
| 406 | - | |
| 407 | 395 | if( !empty( $args['link'] ) && $user_id && $args['link'] = str_replace("%%profile_url%%", uwp_build_profile_tab_url($user_id),$args['link']) ){ |
| 408 | 396 | // will be replace in condition check |
| 409 | 397 | } |
| 410 | 398 | |
| @@ -434,9 +422,9 @@ | ||
| 434 | 422 | if ( ! empty( $args['new_window'] ) ) { |
| 435 | 423 | $new_window = ' target="_blank" '; |
| 436 | 424 | } |
| 437 | 425 | |
| 438 | - $badge = ! empty( $badge ) ? __( $badge, 'userswp' ) : ''; | |
| 426 | + $badge = ! empty( $badge ) ? __( wp_specialchars_decode( $badge, ENT_QUOTES ), 'userswp' ) : ''; | |
| 439 | 427 | |
| 440 | 428 | // phone & email link |
| 441 | 429 | if ( ! empty( $field ) && ! empty( $field->field_type ) && ! empty( $args['link'] ) && strpos( $args['link'], 'http' ) !== 0 ) { |
| 442 | 430 | if ( $field->field_type == 'phone' ) { |
| @@ -601,11 +589,8 @@ | ||
| 601 | 589 | if(isset($user_data)){ |
| 602 | 590 | foreach($user_data as $key => $val) { |
| 603 | 591 | if ( ! in_array( $key, $excluded_fields ) ) { |
| 604 | 592 | $val = apply_filters( 'uwp_replace_variables_' . $key, $val, $text ); |
| 605 | - if ( is_scalar( $val ) ) { | |
| 606 | - $val = esc_html( (string) $val ); | |
| 607 | - } | |
| 608 | 593 | $text = str_replace( '%%' . $key . '%%', $val, $text ); |
| 609 | 594 | } |
| 610 | 595 | } |
| 611 | 596 | } |
