Ticket #3373: 3373.diff

includes/core/sub-actions.php

@@ -400 +400 @@
 }
 
 /**
  * The main action used for handling theme-side GET requests
  *
  * @since 2.3.0 bbPress (r4550)
  */
 function bbp_get_request() {
 
         // Bail if not a POST action
         if ( ! bbp_is_get_request() ) {
                 return;
         }
 
         // Bail if no action
-        if ( empty( $_GET['action'] ) ) {
+        if ( empty( $_GET['action'] ) || ! is_string( $_GET['action'] ) ) {
                 return;
         }
 
         // Sanitize the GET action
         $action = sanitize_key( $_GET['action'] );
 
         // Bail if action was totally invalid
         if ( empty( $action ) ) {
                 return;
         }
 
         // This dynamic action is probably the one you want to use. It narrows down
         // the scope of the 'action' without needing to check it in your function.
         do_action( 'bbp_get_request_' . $action );