Skip to:
Content

bbPress.org

Changeset 4979


Ignore:
Timestamp:
06/04/2013 04:42:44 AM (13 years ago)
Author:
johnjamesjacoby
Message:

Add $filter parameter and supporting phpdoc to bbp_displayed_user_field() && bbp_get_displayed_user_field() to allow more accurate sanitization of displayed user field values. Remove superfluous isset() check. Use 'edit' parameter in form-user-edit.php. See #1999.

Location:
trunk
Files:
2 edited

Legend:

Unmodified
Added
Removed

  • trunk/includes/users/template-tags.php

    r4977 r4979  
    110110 * Output a sanitized user field value
    111111 *
     112 * This function relies on the $filter parameter to decide how to sanitize
     113 * the field value that it finds. Since it uses the WP_User object's magic
     114 * __get() method, it can also be used to get user_meta values.
     115 *
    112116 * @since bbPress (r2688)
    113117 *
    114118 * @param string $field Field to get
     119 * @param string $filter How to filter the field value (null|raw|db|display|edit)
    115120 * @uses bbp_get_displayed_user_field() To get the field
    116121 */
    117 function bbp_displayed_user_field( $field = '' ) {
    118     echo bbp_get_displayed_user_field( $field );
     122function bbp_displayed_user_field( $field = '', $filter = 'display' ) {
     123    echo bbp_get_displayed_user_field( $field, $filter );
    119124}
    120125    /**
    121126     * Return a sanitized user field value
    122127     *
     128     * This function relies on the $filter parameter to decide how to sanitize
     129     * the field value that it finds. Since it uses the WP_User object's magic
     130     * __get() method, it can also be used to get user_meta values.
     131     *
    123132     * @since bbPress (r2688)
    124133     *
    125134     * @param string $field Field to get
    126      * @uses sanitize_text_field() To sanitize the field
    127      * @uses esc_attr() To sanitize the field
     135     * @param string $filter How to filter the field value (null|raw|db|display|edit)
     136     * @see WP_User::__get() for more on how the value is retrieved
     137     * @see sanitize_user_field() for more on how the value is sanitized
    128138     * @uses apply_filters() Calls 'bbp_get_displayed_user_field' with the value
    129139     * @return string|bool Value of the field if it exists, else false
    130140     */
    131     function bbp_get_displayed_user_field( $field = '' ) {
    132         $bbp   = bbpress();
    133         $value = false;
    134 
    135         // Return field if exists
    136         if ( isset( $bbp->displayed_user->$field ) )
    137             $value = sanitize_text_field( $bbp->displayed_user->$field );
     141    function bbp_get_displayed_user_field( $field = '', $filter = 'display' ) {
     142        $bbp = bbpress();
     143
     144        // Juggle the user filter property because it's byref, and we don't want
     145        // to muck up how other code might interact with this object.
     146        $old_filter                  = $bbp->displayed_user->filter;
     147        $bbp->displayed_user->filter = $filter;
     148
     149        // Get the field value from the WP_User object. We don't need to perform
     150        // an isset() because the WP_User::__get() does it for us.
     151        $value = $bbp->displayed_user->$field;
     152
     153        // Put back the user filter property that was previously juggled above.
     154        $bbp->displayed_user->filter = $old_filter;
     155
     156        // Clean up the temporary variable
     157        unset( $old_filter );
    138158
    139159        // Return empty

  • trunk/templates/default/bbpress/form-user-edit.php

    r4956 r4979  
    2323        <div>
    2424            <label for="first_name"><?php _e( 'First Name', 'bbpress' ) ?></label>
    25             <input type="text" name="first_name" id="first_name" value="<?php bbp_displayed_user_field( 'first_name' ); ?>" class="regular-text" tabindex="<?php bbp_tab_index(); ?>" />
     25            <input type="text" name="first_name" id="first_name" value="<?php bbp_displayed_user_field( 'first_name', 'edit' ); ?>" class="regular-text" tabindex="<?php bbp_tab_index(); ?>" />
    2626        </div>
    2727
    2828        <div>
    2929            <label for="last_name"><?php _e( 'Last Name', 'bbpress' ) ?></label>
    30             <input type="text" name="last_name" id="last_name" value="<?php bbp_displayed_user_field( 'last_name' ); ?>" class="regular-text" tabindex="<?php bbp_tab_index(); ?>" />
     30            <input type="text" name="last_name" id="last_name" value="<?php bbp_displayed_user_field( 'last_name', 'edit' ); ?>" class="regular-text" tabindex="<?php bbp_tab_index(); ?>" />
    3131        </div>
    3232
    3333        <div>
    3434            <label for="nickname"><?php _e( 'Nickname', 'bbpress' ); ?></label>
    35             <input type="text" name="nickname" id="nickname" value="<?php bbp_displayed_user_field( 'nickname' ); ?>" class="regular-text" tabindex="<?php bbp_tab_index(); ?>" />
     35            <input type="text" name="nickname" id="nickname" value="<?php bbp_displayed_user_field( 'nickname', 'edit' ); ?>" class="regular-text" tabindex="<?php bbp_tab_index(); ?>" />
    3636        </div>
    3737
    … …  
    5656        <div>
    5757            <label for="url"><?php _e( 'Website', 'bbpress' ) ?></label>
    58             <input type="text" name="url" id="url" value="<?php bbp_displayed_user_field( 'user_url' ); ?>" class="regular-text code" tabindex="<?php bbp_tab_index(); ?>" />
     58            <input type="text" name="url" id="url" value="<?php bbp_displayed_user_field( 'user_url', 'edit' ); ?>" class="regular-text code" tabindex="<?php bbp_tab_index(); ?>" />
    5959        </div>
    6060
    … …  
    8181        <div>
    8282            <label for="description"><?php _e( 'Biographical Info', 'bbpress' ); ?></label>
    83             <textarea name="description" id="description" rows="5" cols="30" tabindex="<?php bbp_tab_index(); ?>"><?php echo esc_attr( bbp_get_displayed_user_field( 'description' ) ); ?></textarea>
     83            <textarea name="description" id="description" rows="5" cols="30" tabindex="<?php bbp_tab_index(); ?>"><?php echo bbp_get_displayed_user_field( 'stuff', 'edit' ); ?></textarea>
    8484        </div>
    8585
    … …  
    9797        <div>
    9898            <label for="user_login"><?php _e( 'Username', 'bbpress' ); ?></label>
    99             <input type="text" name="user_login" id="user_login" value="<?php bbp_displayed_user_field( 'user_login' ); ?>" disabled="disabled" class="regular-text" tabindex="<?php bbp_tab_index(); ?>" />
     99            <input type="text" name="user_login" id="user_login" value="<?php bbp_displayed_user_field( 'user_login', 'edit' ); ?>" disabled="disabled" class="regular-text" tabindex="<?php bbp_tab_index(); ?>" />
    100100        </div>
    101101
    … …  
    103103            <label for="email"><?php _e( 'Email', 'bbpress' ); ?></label>
    104104
    105             <input type="text" name="email" id="email" value="<?php bbp_displayed_user_field( 'user_email' ); ?>" class="regular-text" tabindex="<?php bbp_tab_index(); ?>" />
     105            <input type="text" name="email" id="email" value="<?php bbp_displayed_user_field( 'user_email', 'edit' ); ?>" class="regular-text" tabindex="<?php bbp_tab_index(); ?>" />
    106106
    107107            <?php
    … …  
    109109            // Handle address change requests
    110110            $new_email = get_option( bbp_get_displayed_user_id() . '_new_email' );
    111             if ( $new_email && $new_email != bbp_get_displayed_user_field( 'user_email' ) ) : ?>
     111            if ( $new_email && $new_email != bbp_get_displayed_user_field( 'user_email', 'edit' ) ) : ?>
    112112
    113113                <span class="updated inline">
Note: See TracChangeset for help on using the changeset viewer.