[buddypress-trac] [BuddyPress Trac] #9312: Avatar AJAX responses use esc_url() instead of esc_url_raw(), breaking JavaScript URL handling

[buddypress-trac]

#9312: Avatar AJAX responses use esc_url() instead of esc_url_raw(), breaking
JavaScript URL handling
--------------------------+---------------------
 Reporter:  GaryJ         |       Owner:  (none)
     Type:  defect (bug)  |      Status:  new
 Priority:  normal        |   Milestone:  14.5.0
Component:  Core          |     Version:
 Severity:  normal        |  Resolution:
 Keywords:  has-patch     |
--------------------------+---------------------

Comment (by espellcaste):

 In [changeset:"14155" 14155]:
 {{{
 #!CommitTicketReference repository="" revision="14155"
 Replace `esc_url()` with `esc_url_raw()` for almost all avatar URLs
 returned in AJAX/JSON responses.

 This change addresses an issue where a site modifies the url returned by
 `bp_core_fetch_avatar`, and those URLs are returned as image src
 attributes.

 In the process of escaping the url, `esc_url` converts those attributes
 becoming malformed. `esc_url_raw()` sanitizes the url without HTML entity
 encoding, which is correct for non-HTML contexts.

 Since BuddyPress DOES NOT return the image src attributes by default as
 part of the url, this change should have no impact to regular users.
 Unless the site is purposefully changing them (the use case here is an
 image CDN that returns the image [on demand] using the src attributes as
 image params in the avatar url).

 Originally at [12338].

 Props GaryJ.

 See https://github.com/buddypress/buddypress/pull/427
 See #9312 (14.0)
 }}}

-- 
Ticket URL: <https://buddypress.trac.wordpress.org/ticket/9312#comment:7>
BuddyPress Trac <http://buddypress.org/>
BuddyPress Trac