Skip to:
Content

bbPress.org

Changeset 4979


Ignore:
Timestamp:
06/04/2013 04:42:44 AM (13 years ago)
Author:
johnjamesjacoby
Message:

Add $filter parameter and supporting phpdoc to bbp_displayed_user_field() && bbp_get_displayed_user_field() to allow more accurate sanitization of displayed user field values. Remove superfluous isset() check. Use 'edit' parameter in form-user-edit.php. See #1999.

Location:
trunk
Files:
2 edited

Legend:

Unmodified
Added
Removed

  • trunk/includes/users/template-tags.php

    r4977 r4979  
    110110 * Output a sanitized user field value
    111111 *
     112 * This function relies on the $filter parameter to decide how to sanitize
     113 * the field value that it finds. Since it uses the WP_User object's magic
     114 * __get() method, it can also be used to get user_meta values.
     115 *
    112116 * @since bbPress (r2688)
    113117 *
    114118 * @param string $field Field to get
     119 * @param string $filter How to filter the field value (null|raw|db|display|edit)
    115120 * @uses bbp_get_displayed_user_field() To get the field
    116121 */
    117 function bbp_displayed_user_field( $field = '' ) {
    118         echo bbp_get_displayed_user_field( $field );
     122function bbp_displayed_user_field( $field = '', $filter = 'display' ) {
     123        echo bbp_get_displayed_user_field( $field, $filter );
    119124}
    120125        /**
    121126         * Return a sanitized user field value
    122127         *
     128         * This function relies on the $filter parameter to decide how to sanitize
     129         * the field value that it finds. Since it uses the WP_User object's magic
     130         * __get() method, it can also be used to get user_meta values.
     131         *
    123132         * @since bbPress (r2688)
    124133         *
    125134         * @param string $field Field to get
    126          * @uses sanitize_text_field() To sanitize the field
    127          * @uses esc_attr() To sanitize the field
     135         * @param string $filter How to filter the field value (null|raw|db|display|edit)
     136         * @see WP_User::__get() for more on how the value is retrieved
     137         * @see sanitize_user_field() for more on how the value is sanitized
    128138         * @uses apply_filters() Calls 'bbp_get_displayed_user_field' with the value
    129139         * @return string|bool Value of the field if it exists, else false
    130140         */
    131         function bbp_get_displayed_user_field( $field = '' ) {
    132                 $bbp   = bbpress();
    133                 $value = false;
    134 
    135                 // Return field if exists
    136                 if ( isset( $bbp->displayed_user->$field ) )
    137                         $value = sanitize_text_field( $bbp->displayed_user->$field );
     141        function bbp_get_displayed_user_field( $field = '', $filter = 'display' ) {
     142                $bbp = bbpress();
     143
     144                // Juggle the user filter property because it's byref, and we don't want
     145                // to muck up how other code might interact with this object.
     146                $old_filter                  = $bbp->displayed_user->filter;
     147                $bbp->displayed_user->filter = $filter;
     148
     149                // Get the field value from the WP_User object. We don't need to perform
     150                // an isset() because the WP_User::__get() does it for us.
     151                $value = $bbp->displayed_user->$field;
     152
     153                // Put back the user filter property that was previously juggled above.
     154                $bbp->displayed_user->filter = $old_filter;
     155
     156                // Clean up the temporary variable
     157                unset( $old_filter );
    138158
    139159                // Return empty

  • trunk/templates/default/bbpress/form-user-edit.php

    r4956 r4979  
    2323                <div>
    2424                        <label for="first_name"><?php _e( 'First Name', 'bbpress' ) ?></label>
    25                         <input type="text" name="first_name" id="first_name" value="<?php bbp_displayed_user_field( 'first_name' ); ?>" class="regular-text" tabindex="<?php bbp_tab_index(); ?>" />
     25                        <input type="text" name="first_name" id="first_name" value="<?php bbp_displayed_user_field( 'first_name', 'edit' ); ?>" class="regular-text" tabindex="<?php bbp_tab_index(); ?>" />
    2626                </div>
    2727
    2828                <div>
    2929                        <label for="last_name"><?php _e( 'Last Name', 'bbpress' ) ?></label>
    30                         <input type="text" name="last_name" id="last_name" value="<?php bbp_displayed_user_field( 'last_name' ); ?>" class="regular-text" tabindex="<?php bbp_tab_index(); ?>" />
     30                        <input type="text" name="last_name" id="last_name" value="<?php bbp_displayed_user_field( 'last_name', 'edit' ); ?>" class="regular-text" tabindex="<?php bbp_tab_index(); ?>" />
    3131                </div>
    3232
    3333                <div>
    3434                        <label for="nickname"><?php _e( 'Nickname', 'bbpress' ); ?></label>
    35                         <input type="text" name="nickname" id="nickname" value="<?php bbp_displayed_user_field( 'nickname' ); ?>" class="regular-text" tabindex="<?php bbp_tab_index(); ?>" />
     35                        <input type="text" name="nickname" id="nickname" value="<?php bbp_displayed_user_field( 'nickname', 'edit' ); ?>" class="regular-text" tabindex="<?php bbp_tab_index(); ?>" />
    3636                </div>
    3737
    … …  
    5656                <div>
    5757                        <label for="url"><?php _e( 'Website', 'bbpress' ) ?></label>
    58                         <input type="text" name="url" id="url" value="<?php bbp_displayed_user_field( 'user_url' ); ?>" class="regular-text code" tabindex="<?php bbp_tab_index(); ?>" />
     58                        <input type="text" name="url" id="url" value="<?php bbp_displayed_user_field( 'user_url', 'edit' ); ?>" class="regular-text code" tabindex="<?php bbp_tab_index(); ?>" />
    5959                </div>
    6060
    … …  
    8181                <div>
    8282                        <label for="description"><?php _e( 'Biographical Info', 'bbpress' ); ?></label>
    83                         <textarea name="description" id="description" rows="5" cols="30" tabindex="<?php bbp_tab_index(); ?>"><?php echo esc_attr( bbp_get_displayed_user_field( 'description' ) ); ?></textarea>
     83                        <textarea name="description" id="description" rows="5" cols="30" tabindex="<?php bbp_tab_index(); ?>"><?php echo bbp_get_displayed_user_field( 'stuff', 'edit' ); ?></textarea>
    8484                </div>
    8585
    … …  
    9797                <div>
    9898                        <label for="user_login"><?php _e( 'Username', 'bbpress' ); ?></label>
    99                         <input type="text" name="user_login" id="user_login" value="<?php bbp_displayed_user_field( 'user_login' ); ?>" disabled="disabled" class="regular-text" tabindex="<?php bbp_tab_index(); ?>" />
     99                        <input type="text" name="user_login" id="user_login" value="<?php bbp_displayed_user_field( 'user_login', 'edit' ); ?>" disabled="disabled" class="regular-text" tabindex="<?php bbp_tab_index(); ?>" />
    100100                </div>
    101101
    … …  
    103103                        <label for="email"><?php _e( 'Email', 'bbpress' ); ?></label>
    104104
    105                         <input type="text" name="email" id="email" value="<?php bbp_displayed_user_field( 'user_email' ); ?>" class="regular-text" tabindex="<?php bbp_tab_index(); ?>" />
     105                        <input type="text" name="email" id="email" value="<?php bbp_displayed_user_field( 'user_email', 'edit' ); ?>" class="regular-text" tabindex="<?php bbp_tab_index(); ?>" />
    106106
    107107                        <?php
    … …  
    109109                        // Handle address change requests
    110110                        $new_email = get_option( bbp_get_displayed_user_id() . '_new_email' );
    111                         if ( $new_email && $new_email != bbp_get_displayed_user_field( 'user_email' ) ) : ?>
     111                        if ( $new_email && $new_email != bbp_get_displayed_user_field( 'user_email', 'edit' ) ) : ?>
    112112
    113113                                <span class="updated inline">
Note: See TracChangeset for help on using the changeset viewer.