From fa2e7171e5e5b85465e449b67e5ced6672b9f3f9 Mon Sep 17 00:00:00 2001 From: Damien Regad Date: Mon, 17 Oct 2016 17:15:49 +0200 Subject: [PATCH] Gravatar plugin: escape ampersands in URLs Fixes #21804 --- plugins/Gravatar/Gravatar.php | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/plugins/Gravatar/Gravatar.php b/plugins/Gravatar/Gravatar.php index f1add35f0b..efa9049542 100644 --- a/plugins/Gravatar/Gravatar.php +++ b/plugins/Gravatar/Gravatar.php @@ -147,8 +147,15 @@ function user_get_avatar( $p_event, $p_user_id, $p_size = 80 ) { # Build Gravatar URL $t_avatar_url = self::getAvatarUrl() . - 'avatar/' . $t_email_hash . '?d=' . $t_default_avatar . - '&r=' . $t_rating . '&s=' . $p_size; + 'avatar/' . $t_email_hash . '?' . + http_build_query( + array( + 'd' => $t_default_avatar, + 'r' => $t_rating, + 's' => $p_size, + ), + '', '&' + ); $t_avatar = new Avatar(); $t_avatar->image = $t_avatar_url;