In the AJAX object_template_loader() functions of bp-default and bp-legacy, use sanitize_title() instead of esc_attr() to properly sanitize the requested object.

Then, do a bp_is_active() against that object to ensure the object being requested is for an active component, to prevent potential arbitrary file inclusion. (Note: this needs testing with third party components that tap into this functionality, as it was originally intended only to be used by bundled components.)

git-svn-id: https://buddypress.svn.wordpress.org/trunk@7095 cdf35c40-ae34-48e0-9cc9-0c9da1808c22