Gravatar plugin: escape ampersands in URLs

Fixes #21804
mantisbt · Oct 20, 2016 · fa2e717 · fa2e717
1 parent 44151b6
commit fa2e717
Showing 1 changed file with 9 additions and 2 deletions.
diff --git a/plugins/Gravatar/Gravatar.php b/plugins/Gravatar/Gravatar.php
@@ -147,8 +147,15 @@ function user_get_avatar( $p_event, $p_user_id, $p_size = 80 ) {
 
 		# Build Gravatar URL
 		$t_avatar_url = self::getAvatarUrl() .
-			'avatar/' . $t_email_hash . '?d=' . $t_default_avatar .
-			'&r=' . $t_rating . '&s=' . $p_size;
+			'avatar/' . $t_email_hash . '?' .
+			http_build_query(
+				array(
+					'd' => $t_default_avatar,
+					'r' => $t_rating,
+					's' => $p_size,
+				),
+				'', '&amp;'
+			);
 
 		$t_avatar = new Avatar();
 		$t_avatar->image = $t_avatar_url;