Skip to:
Content

bbPress.org


Ignore:
Timestamp:
06/28/2012 05:24:22 PM (14 years ago)
Author:
johnjamesjacoby
Message:

Nonces:

  • Use bbp_verify_nonce_request() to prevent the awkward wp_die() experience in forums.
  • Add nonce checks to subscriptions and favorites.
  • More aggressive returns on edit/new forum/topic/reply nonce and capability checks. Prevents surplus processing when we already know nothing more should happen.
  • Bail early if bbp_has_errors() rather than wrapping around it.
  • Fixes #1863.
File:
1 edited

Legend:

Unmodified
Added
Removed
  • branches/plugin/bbp-includes/bbp-forum-functions.php

    r3966 r4024  
    7979 *
    8080 * @uses bbPress:errors::add() To log various error messages
    81  * @uses check_admin_referer() To verify the nonce and check the referer
     81 * @uses bbp_verify_nonce_request() To verify the nonce and check the request
    8282 * @uses bbp_is_anonymous() To check if an anonymous post is being made
    8383 * @uses current_user_can() To check if the current user can publish forum
     
    118118
    119119    // Nonce check
    120     check_admin_referer( 'bbp-new-forum' );
     120    if ( ! bbp_verify_nonce_request( 'bbp-new-forum' ) ) {
     121        bbp_add_error( 'bbp_rew_forum_nonce', __( '<strong>ERROR</strong>: Are you sure you wanted to do that?', 'bbpress' ) );
     122        return;
     123    }
    121124
    122125    // Define local variable(s)
     
    130133    if ( !current_user_can( 'publish_forums' ) ) {
    131134        bbp_add_error( 'bbp_forum_permissions', __( '<strong>ERROR</strong>: You do not have permission to create new forums.', 'bbpress' ) );
     135        return;
    132136    }
    133137
     
    227231    do_action( 'bbp_new_forum_pre_extras' );
    228232
     233    // Bail if errors
     234    if ( bbp_has_errors() )
     235        return;
     236
    229237    /** No Errors *************************************************************/
    230238
    231     if ( !bbp_has_errors() ) {
    232 
    233         /** Create new forum **************************************************/
    234 
    235         // Add the content of the form to $forum_data as an array
    236         $forum_data = array(
    237             'post_author'    => $forum_author,
    238             'post_title'     => $forum_title,
    239             'post_content'   => $forum_content,
    240             'post_parent'    => $forum_parent_id,
    241             'post_status'    => $post_status,
    242             'post_type'      => bbp_get_forum_post_type(),
    243             'comment_status' => 'closed'
     239    // Add the content of the form to $forum_data as an array
     240    // Just in time manipulation of forum data before being created
     241    $forum_data = apply_filters( 'bbp_new_forum_pre_insert', array(
     242        'post_author'    => $forum_author,
     243        'post_title'     => $forum_title,
     244        'post_content'   => $forum_content,
     245        'post_parent'    => $forum_parent_id,
     246        'post_status'    => $post_status,
     247        'post_type'      => bbp_get_forum_post_type(),
     248        'comment_status' => 'closed'
     249    ) );
     250
     251    // Insert forum
     252    $forum_id = wp_insert_post( $forum_data );
     253
     254    /** No Errors *************************************************************/
     255
     256    if ( !empty( $forum_id ) && !is_wp_error( $forum_id ) ) {
     257
     258        /** Trash Check *******************************************************/
     259
     260        // If the forum is trash, or the forum_status is switched to
     261        // trash, trash it properly
     262        if ( ( get_post_field( 'post_status', $forum_id ) == bbp_get_trash_status_id() ) || ( $forum_data['post_status'] == bbp_get_trash_status_id() ) ) {
     263
     264            // Trash the reply
     265            wp_trash_post( $forum_id );
     266
     267            // Force view=all
     268            $view_all = true;
     269        }
     270
     271        /** Spam Check ********************************************************/
     272
     273        // If reply or forum are spam, officially spam this reply
     274        if ( $forum_data['post_status'] == bbp_get_spam_status_id() ) {
     275            add_post_meta( $forum_id, '_bbp_spam_meta_status', bbp_get_public_status_id() );
     276
     277            // Force view=all
     278            $view_all = true;
     279        }
     280
     281        /** Update counts, etc... *********************************************/
     282
     283        $forum_args = array(
     284            'forum_id'           => $forum_id,
     285            'post_parent'        => $forum_parent_id,
     286            'forum_author'       => $forum_author,
     287            'last_topic_id'      => 0,
     288            'last_reply_id'      => 0,
     289            'last_active_id'     => 0,
     290            'last_active_time'   => 0,
     291            'last_active_status' => bbp_get_public_status_id()
    244292        );
    245 
    246         // Just in time manipulation of forum data before being created
    247         $forum_data = apply_filters( 'bbp_new_forum_pre_insert', $forum_data );
    248 
    249         // Insert forum
    250         $forum_id = wp_insert_post( $forum_data );
    251 
    252         /** No Errors *********************************************************/
    253 
    254         if ( !empty( $forum_id ) && !is_wp_error( $forum_id ) ) {
    255 
    256             /** Trash Check ***************************************************/
    257 
    258             // If the forum is trash, or the forum_status is switched to
    259             // trash, trash it properly
    260             if ( ( get_post_field( 'post_status', $forum_id ) == bbp_get_trash_status_id() ) || ( $forum_data['post_status'] == bbp_get_trash_status_id() ) ) {
    261 
    262                 // Trash the reply
    263                 wp_trash_post( $forum_id );
    264 
    265                 // Force view=all
    266                 $view_all = true;
     293        do_action( 'bbp_new_forum', $forum_args );
     294
     295        /** Additional Actions (After Save) ***********************************/
     296
     297        do_action( 'bbp_new_forum_post_extras', $forum_id );
     298
     299        /** Redirect **********************************************************/
     300
     301        // Redirect to
     302        $redirect_to = !empty( $_REQUEST['redirect_to'] ) ? $_REQUEST['redirect_to'] : '';
     303
     304        // Get the forum URL
     305        $redirect_url = bbp_get_forum_permalink( $forum_id, $redirect_to );
     306
     307        // Add view all?
     308        if ( bbp_get_view_all() || !empty( $view_all ) ) {
     309
     310            // User can moderate, so redirect to forum with view all set
     311            if ( current_user_can( 'moderate' ) ) {
     312                $redirect_url = bbp_add_view_all( $redirect_url );
     313
     314            // User cannot moderate, so redirect to forum
     315            } else {
     316                $redirect_url = bbp_get_forum_permalink( $forum_id );
    267317            }
    268 
    269             /** Spam Check ****************************************************/
    270 
    271             // If reply or forum are spam, officially spam this reply
    272             if ( $forum_data['post_status'] == bbp_get_spam_status_id() ) {
    273                 add_post_meta( $forum_id, '_bbp_spam_meta_status', bbp_get_public_status_id() );
    274 
    275                 // Force view=all
    276                 $view_all = true;
    277             }
    278 
    279             /** Update counts, etc... *****************************************/
    280 
    281             $forum_args = array(
    282                 'forum_id'           => $forum_id,
    283                 'post_parent'        => $forum_parent_id,
    284                 'forum_author'       => $forum_author,
    285                 'last_topic_id'      => 0,
    286                 'last_reply_id'      => 0,
    287                 'last_active_id'     => 0,
    288                 'last_active_time'   => 0,
    289                 'last_active_status' => bbp_get_public_status_id()
    290             );
    291             do_action( 'bbp_new_forum', $forum_args );
    292 
    293             /** Additional Actions (After Save) *******************************/
    294 
    295             do_action( 'bbp_new_forum_post_extras', $forum_id );
    296 
    297             /** Redirect ******************************************************/
    298 
    299             // Redirect to
    300             $redirect_to = !empty( $_REQUEST['redirect_to'] ) ? $_REQUEST['redirect_to'] : '';
    301 
    302             // Get the forum URL
    303             $redirect_url = bbp_get_forum_permalink( $forum_id, $redirect_to );
    304 
    305             // Add view all?
    306             if ( bbp_get_view_all() || !empty( $view_all ) ) {
    307 
    308                 // User can moderate, so redirect to forum with view all set
    309                 if ( current_user_can( 'moderate' ) ) {
    310                     $redirect_url = bbp_add_view_all( $redirect_url );
    311 
    312                 // User cannot moderate, so redirect to forum
    313                 } else {
    314                     $redirect_url = bbp_get_forum_permalink( $forum_id );
    315                 }
    316             }
    317 
    318             // Allow to be filtered
    319             $redirect_url = apply_filters( 'bbp_new_forum_redirect_to', $redirect_url, $redirect_to );
    320 
    321             /** Successful Save ***********************************************/
    322 
    323             // Redirect back to new forum
    324             wp_safe_redirect( $redirect_url );
    325 
    326             // For good measure
    327             exit();
    328 
    329         // Errors
    330         } else {
    331             $append_error = ( is_wp_error( $forum_id ) && $forum_id->get_error_message() ) ? $forum_id->get_error_message() . ' ' : '';
    332             bbp_add_error( 'bbp_forum_error', __( '<strong>ERROR</strong>: The following problem(s) have been found with your forum:' . $append_error, 'bbpress' ) );
    333         }
     318        }
     319
     320        // Allow to be filtered
     321        $redirect_url = apply_filters( 'bbp_new_forum_redirect_to', $redirect_url, $redirect_to );
     322
     323        /** Successful Save ***************************************************/
     324
     325        // Redirect back to new forum
     326        wp_safe_redirect( $redirect_url );
     327
     328        // For good measure
     329        exit();
     330
     331    // Errors
     332    } else {
     333        $append_error = ( is_wp_error( $forum_id ) && $forum_id->get_error_message() ) ? $forum_id->get_error_message() . ' ' : '';
     334        bbp_add_error( 'bbp_forum_error', __( '<strong>ERROR</strong>: The following problem(s) have been found with your forum:' . $append_error, 'bbpress' ) );
    334335    }
    335336}
     
    340341 * @uses bbPress:errors::add() To log various error messages
    341342 * @uses bbp_get_forum() To get the forum
    342  * @uses check_admin_referer() To verify the nonce and check the referer
     343 * @uses bbp_verify_nonce_request() To verify the nonce and check the request
    343344 * @uses bbp_is_forum_anonymous() To check if forum is by an anonymous user
    344345 * @uses current_user_can() To check if the current user can edit the forum
     
    386387    // Forum id was not passed
    387388    if ( empty( $_POST['bbp_forum_id'] ) ) {
    388         bbp_add_error( 'bbp_edit_forum_id', __( '<strong>ERROR</strong>: Forum ID not found.', 'bbpress' ) );
     389        $forum_id = 0;
    389390
    390391    // Forum id was passed
     
    394395    }
    395396
     397    // Nonce check
     398    if ( ! bbp_verify_nonce_request( 'bbp-edit-forum_' . $forum_id ) ) {
     399        bbp_add_error( 'bbp_edit_forum_nonce', __( '<strong>ERROR</strong>: Are you sure you wanted to do that?', 'bbpress' ) );
     400        return;
     401
    396402    // Forum does not exist
    397     if ( empty( $forum ) ) {
     403    } elseif ( empty( $forum ) ) {
    398404        bbp_add_error( 'bbp_edit_forum_not_found', __( '<strong>ERROR</strong>: The forum you want to edit was not found.', 'bbpress' ) );
    399 
    400     // Forum exists
    401     } else {
    402 
    403         // Nonce check
    404         check_admin_referer( 'bbp-edit-forum_' . $forum_id );
    405 
    406         // User cannot edit this forum
    407         if ( !current_user_can( 'edit_forum', $forum_id ) ) {
    408             bbp_add_error( 'bbp_edit_forum_permissions', __( '<strong>ERROR</strong>: You do not have permission to edit that forum.', 'bbpress' ) );
    409         }
     405        return;
     406
     407    // User cannot edit this forum
     408    } elseif ( !current_user_can( 'edit_forum', $forum_id ) ) {
     409        bbp_add_error( 'bbp_edit_forum_permissions', __( '<strong>ERROR</strong>: You do not have permission to edit that forum.', 'bbpress' ) );
     410        return;
    410411    }
    411412
     
    484485    do_action( 'bbp_edit_forum_pre_extras', $forum_id );
    485486
     487    // Bail if errors
     488    if ( bbp_has_errors() )
     489        return;
     490
    486491    /** No Errors *************************************************************/
    487492
    488     if ( !bbp_has_errors() ) {
    489 
    490         /** Update the forum **************************************************/
    491 
    492         // Add the content of the form to $forum_data as an array
    493         $forum_data = array(
    494             'ID'           => $forum_id,
    495             'post_title'   => $forum_title,
    496             'post_content' => $forum_content,
    497             'post_status'  => $post_status,
    498             'post_parent'  => $forum_parent_id
     493    // Add the content of the form to $forum_data as an array
     494    // Just in time manipulation of forum data before being edited
     495    $forum_data = apply_filters( 'bbp_edit_forum_pre_insert', array(
     496        'ID'           => $forum_id,
     497        'post_title'   => $forum_title,
     498        'post_content' => $forum_content,
     499        'post_status'  => $post_status,
     500        'post_parent'  => $forum_parent_id
     501    ) );
     502
     503    // Insert forum
     504    $forum_id = wp_update_post( $forum_data );
     505
     506    /** Revisions *************************************************************/
     507
     508    /**
     509     * @todo omitted for 2.1
     510    // Revision Reason
     511    if ( !empty( $_POST['bbp_forum_edit_reason'] ) )
     512        $forum_edit_reason = esc_attr( strip_tags( $_POST['bbp_forum_edit_reason'] ) );
     513
     514    // Update revision log
     515    if ( !empty( $_POST['bbp_log_forum_edit'] ) && ( 1 == $_POST['bbp_log_forum_edit'] ) && ( $revision_id = wp_save_post_revision( $forum_id ) ) ) {
     516        bbp_update_forum_revision_log( array(
     517            'forum_id'    => $forum_id,
     518            'revision_id' => $revision_id,
     519            'author_id'   => bbp_get_current_user_id(),
     520            'reason'      => $forum_edit_reason
     521        ) );
     522    }
     523     */
     524
     525    /** No Errors *************************************************************/
     526
     527    if ( !empty( $forum_id ) && !is_wp_error( $forum_id ) ) {
     528
     529        // Update counts, etc...
     530        $forum_args = array(
     531            'forum_id'           => $forum_id,
     532            'post_parent'        => $forum_parent_id,
     533            'forum_author'       => $forum->post_author,
     534            'last_topic_id'      => 0,
     535            'last_reply_id'      => 0,
     536            'last_active_id'     => 0,
     537            'last_active_time'   => 0,
     538            'last_active_status' => bbp_get_public_status_id()
    499539        );
    500 
    501         // Just in time manipulation of forum data before being edited
    502         $forum_data = apply_filters( 'bbp_edit_forum_pre_insert', $forum_data );
    503 
    504         // Insert forum
    505         $forum_id = wp_update_post( $forum_data );
    506 
    507         /** Revisions *********************************************************/
    508 
    509         /**
    510          * @todo omitted for 2.1
    511         // Revision Reason
    512         if ( !empty( $_POST['bbp_forum_edit_reason'] ) )
    513             $forum_edit_reason = esc_attr( strip_tags( $_POST['bbp_forum_edit_reason'] ) );
    514 
    515         // Update revision log
    516         if ( !empty( $_POST['bbp_log_forum_edit'] ) && ( 1 == $_POST['bbp_log_forum_edit'] ) && ( $revision_id = wp_save_post_revision( $forum_id ) ) ) {
    517             bbp_update_forum_revision_log( array(
    518                 'forum_id'    => $forum_id,
    519                 'revision_id' => $revision_id,
    520                 'author_id'   => bbp_get_current_user_id(),
    521                 'reason'      => $forum_edit_reason
    522             ) );
    523         }
    524          *
    525          */
    526 
    527         /** No Errors *********************************************************/
    528 
    529         if ( !empty( $forum_id ) && !is_wp_error( $forum_id ) ) {
    530 
    531             // Update counts, etc...
    532             $forum_args = array(
    533                 'forum_id'           => $forum_id,
    534                 'post_parent'        => $forum_parent_id,
    535                 'forum_author'       => $forum->post_author,
    536                 'last_topic_id'      => 0,
    537                 'last_reply_id'      => 0,
    538                 'last_active_id'     => 0,
    539                 'last_active_time'   => 0,
    540                 'last_active_status' => bbp_get_public_status_id()
    541             );
    542             do_action( 'bbp_edit_forum', $forum_args );
    543 
    544             // If the new forum parent id is not equal to the old forum parent
    545             // id, run the bbp_move_forum action and pass the forum's parent id
    546             // as the first arg and new forum parent id as the second.
    547             // @todo implement
    548             //if ( $forum_id != $forum->post_parent )
    549             //  bbp_move_forum_handler( $forum_parent_id, $forum->post_parent, $forum_id );
    550 
    551             /** Additional Actions (After Save) *******************************/
    552 
    553             do_action( 'bbp_edit_forum_post_extras', $forum_id );
    554 
    555             /** Redirect ******************************************************/
    556 
    557             // Redirect to
    558             $redirect_to = !empty( $_REQUEST['redirect_to'] ) ? $_REQUEST['redirect_to'] : '';
    559 
    560             // View all?
    561             $view_all = bbp_get_view_all();
    562 
    563             // Get the forum URL
    564             $forum_url = bbp_get_forum_permalink( $forum_id, $redirect_to );
    565 
    566             // Add view all?
    567             if ( !empty( $view_all ) )
    568                 $forum_url = bbp_add_view_all( $forum_url );
    569 
    570             // Allow to be filtered
    571             $forum_url = apply_filters( 'bbp_edit_forum_redirect_to', $forum_url, $view_all, $redirect_to );
    572 
    573             /** Successful Edit ***********************************************/
    574 
    575             // Redirect back to new forum
    576             wp_safe_redirect( $forum_url );
    577 
    578             // For good measure
    579             exit();
    580 
    581         /** Errors ************************************************************/
    582 
    583         } else {
    584             $append_error = ( is_wp_error( $forum_id ) && $forum_id->get_error_message() ) ? $forum_id->get_error_message() . ' ' : '';
    585             bbp_add_error( 'bbp_forum_error', __( '<strong>ERROR</strong>: The following problem(s) have been found with your forum:' . $append_error . 'Please try again.', 'bbpress' ) );
    586         }
     540        do_action( 'bbp_edit_forum', $forum_args );
     541
     542        // If the new forum parent id is not equal to the old forum parent
     543        // id, run the bbp_move_forum action and pass the forum's parent id
     544        // as the first arg and new forum parent id as the second.
     545        // @todo implement
     546        //if ( $forum_id != $forum->post_parent )
     547        //  bbp_move_forum_handler( $forum_parent_id, $forum->post_parent, $forum_id );
     548
     549        /** Additional Actions (After Save) ***********************************/
     550
     551        do_action( 'bbp_edit_forum_post_extras', $forum_id );
     552
     553        /** Redirect **********************************************************/
     554
     555        // Redirect to
     556        $redirect_to = !empty( $_REQUEST['redirect_to'] ) ? $_REQUEST['redirect_to'] : '';
     557
     558        // View all?
     559        $view_all = bbp_get_view_all();
     560
     561        // Get the forum URL
     562        $forum_url = bbp_get_forum_permalink( $forum_id, $redirect_to );
     563
     564        // Add view all?
     565        if ( !empty( $view_all ) )
     566            $forum_url = bbp_add_view_all( $forum_url );
     567
     568        // Allow to be filtered
     569        $forum_url = apply_filters( 'bbp_edit_forum_redirect_to', $forum_url, $view_all, $redirect_to );
     570
     571        /** Successful Edit ***************************************************/
     572
     573        // Redirect back to new forum
     574        wp_safe_redirect( $forum_url );
     575
     576        // For good measure
     577        exit();
     578
     579    /** Errors ****************************************************************/
     580
     581    } else {
     582        $append_error = ( is_wp_error( $forum_id ) && $forum_id->get_error_message() ) ? $forum_id->get_error_message() . ' ' : '';
     583        bbp_add_error( 'bbp_forum_error', __( '<strong>ERROR</strong>: The following problem(s) have been found with your forum:' . $append_error . 'Please try again.', 'bbpress' ) );
    587584    }
    588585}
Note: See TracChangeset for help on using the changeset viewer.