Changeset 3125 for branches/plugin/bbp-includes/bbp-reply-template.php

Timestamp:

05/09/2011 06:51:40 AM (15 years ago)

Author:

johnjamesjacoby

Message:

Prevent forum and topic ID's from being poisoned by functions that attempt to make calculations out of turn. Also prevent incorrect assignment of parent topic and forum ID's when posting from admin area. Fixes #1433.

File:

• branches/plugin/bbp-includes/bbp-reply-template.php (modified) (2 diffs)

branches/plugin/bbp-includes/bbp-reply-template.php

@@ -1071 +1071 @@
     function bbp_get_reply_topic_id( $reply_id = 0 ) {
 
+        // Assume there is no topic id
+        $topic_id = 0;
+
         // Check that reply_id is valid
-        if ( $reply_id = bbp_get_reply_id( $reply_id ) ) {
+        if ( $reply_id = bbp_get_reply_id( $reply_id ) )
 
             // Get topic_id from reply
-            $topic_id = get_post_meta( $reply_id, '_bbp_topic_id', true );
-            $topic_id = bbp_get_topic_id( $topic_id );
-
-        // reply_id is not valid, so no topic exists
-        } else {
-            $topic_id = 0;
-        }
+            if ( $topic_id = get_post_meta( $reply_id, '_bbp_topic_id', true ) )
+
+                // Validate the topic_id
+                $topic_id = bbp_get_topic_id( $topic_id );
 
         return apply_filters( 'bbp_get_reply_topic_id', (int) $topic_id, $reply_id );
@@ -1111 +1111 @@
     function bbp_get_reply_forum_id( $reply_id = 0 ) {
 
+        // Assume there is no forum
+        $forum_id = 0;
+
         // Check that reply_id is valid
-        if ( $reply_id = bbp_get_reply_id( $reply_id ) ) {
+        if ( $reply_id = bbp_get_reply_id( $reply_id ) )
 
             // Get forum_id from reply
-            $forum_id = get_post_meta( $reply_id, '_bbp_forum_id', true );
-            $forum_id = bbp_get_forum_id( $forum_id );
-
-        // reply_id is not valid, so no forum exists
-        } else {
-            $forum_id = 0;
-        }
+            if ( $forum_id = get_post_meta( $reply_id, '_bbp_forum_id', true ) )
+
+                // Validate the forum_id
+                $forum_id = bbp_get_forum_id( $forum_id );
 
         return apply_filters( 'bbp_get_reply_forum_id', (int) $forum_id, $reply_id );