Ticket #3570: 3570.3.patch

includes/common/template.php

@@ -1338 +1338 @@
         // Make sure we are directing somewhere
         if ( empty( $redirect_to ) ) {
                 if ( isset( $_SERVER['REQUEST_URI'] ) ) {
-                        $redirect_to = bbp_get_url_scheme() . $_SERVER['HTTP_HOST'] . $_SERVER['REQUEST_URI'];
+                        $redirect_to = bbp_get_url_scheme() . sanitize_text_field( $_SERVER['HTTP_HOST'] ) . sanitize_text_field( $_SERVER['REQUEST_URI'] );
                 } else {
                         $redirect_to = wp_get_referer();
                 }

includes/search/functions.php

@@ -116 +116 @@
 
         // Get search terms if requested
         $terms = ! empty( $_REQUEST[ $query_arg ] )
-                ? $_REQUEST[ $query_arg ]
+                ? sanitize_text_field( $_REQUEST[ $query_arg ] )
                 : false;
 
         // Bail if query argument does not exist

includes/users/engagements.php

@@ -878 +878 @@
 
                 // Redirect back from whence we came
                 if ( ! empty( $_REQUEST['redirect_to'] ) ) {
-                        $redirect = $_REQUEST['redirect_to']; // Validated later
+                        $redirect = sanitize_text_field( $_REQUEST['redirect_to'] ); // Validated later
                 } elseif ( bbp_is_subscriptions() ) {
                         $redirect = bbp_get_subscriptions_permalink( $user_id );
                 } elseif ( bbp_is_single_user() ) {