From 951fa36a9dc22dfa7efa4b1bf522037914cf9d3e Mon Sep 17 00:00:00 2001 From: Jitendra Banjara Date: Mon, 17 Feb 2025 14:22:11 +0530 Subject: [PATCH 1/2] PROD-7923 - Fixed - Trim extra pair of question mark-like symbols around the mentioned username in comments API --- src/bp-activity/bp-activity-filters.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/bp-activity/bp-activity-filters.php b/src/bp-activity/bp-activity-filters.php index 03a8cc60e5b..e2a0a203f7a 100644 --- a/src/bp-activity/bp-activity-filters.php +++ b/src/bp-activity/bp-activity-filters.php @@ -474,7 +474,7 @@ function bp_activity_at_name_filter( $content, $activity_id = 0 ) { if ( ! empty( $content_matches[1] ) ) { foreach ( $content_matches[1] as $replacement ) { $unique_index = '#BPAN' . $replace_count . '#'; - $replacements[ $unique_index ] = $replacement; + $replacements[ $unique_index ] = filter_var( $replacement, FILTER_UNSAFE_RAW, FILTER_FLAG_STRIP_LOW | FILTER_FLAG_STRIP_HIGH ); $content = str_replace( $replacement, $unique_index, $content ); $replace_count++; } From 01852e9701d56f5fc6c56bca01617c42966f09e7 Mon Sep 17 00:00:00 2001 From: Jitendra Banjara Date: Mon, 17 Feb 2025 14:31:03 +0530 Subject: [PATCH 2/2] PROD-7923 - Use str_replace instead of filter_var, as its unsafe --- src/bp-activity/bp-activity-filters.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/bp-activity/bp-activity-filters.php b/src/bp-activity/bp-activity-filters.php index e2a0a203f7a..5ec7a71dfcc 100644 --- a/src/bp-activity/bp-activity-filters.php +++ b/src/bp-activity/bp-activity-filters.php @@ -474,7 +474,7 @@ function bp_activity_at_name_filter( $content, $activity_id = 0 ) { if ( ! empty( $content_matches[1] ) ) { foreach ( $content_matches[1] as $replacement ) { $unique_index = '#BPAN' . $replace_count . '#'; - $replacements[ $unique_index ] = filter_var( $replacement, FILTER_UNSAFE_RAW, FILTER_FLAG_STRIP_LOW | FILTER_FLAG_STRIP_HIGH ); + $replacements[ $unique_index ] = str_replace( "\xef\xbb\xbf", '', $replacement ); $content = str_replace( $replacement, $unique_index, $content ); $replace_count++; }