Changeset 5009 for trunk/includes/topics/functions.php

Timestamp:

07/04/2013 12:11:09 PM (13 years ago)

Author:

johnjamesjacoby

Message:

Introduce additional forum/topic ID validation when posting new topics and replies. Prevents empty/negative/non-existent post_parent. Fixes #2363.

File:

• trunk/includes/topics/functions.php (modified) (1 diff)

trunk/includes/topics/functions.php

@@ -189 +189 @@
         /** Topic Forum ***********************************************************/
 
-        // Forum id was not passed
-        if ( empty( $_POST['bbp_forum_id'] ) ) {
-                bbp_add_error( 'bbp_topic_forum_id', __( '<strong>ERROR</strong>: Forum ID is missing.', 'bbpress' ) );
-
-        // Forum id was passed
-        } elseif ( is_numeric( $_POST['bbp_forum_id'] ) ) {
-                $forum_id = (int) $_POST['bbp_forum_id'];
+        // Error check the POST'ed topic id
+        if ( isset( $_POST['bbp_forum_id'] ) ) {
+
+                // Empty Forum id was passed
+                if ( empty( $_POST['bbp_forum_id'] ) ) {
+                        bbp_add_error( 'bbp_topic_forum_id', __( '<strong>ERROR</strong>: Forum ID is missing.', 'bbpress' ) );
+
+                // Forum id is not a number
+                } elseif ( ! is_numeric( $_POST['bbp_forum_id'] ) ) {
+                        bbp_add_error( 'bbp_topic_forum_id', __( '<strong>ERROR</strong>: Forum ID must be a number.', 'bbpress' ) );
+
+                // Forum id might be valid
+                } else {
+
+                        // Get the forum id
+                        $posted_forum_id = intval( $_POST['bbp_forum_id'] );
+
+                        // Forum id is empty
+                        if ( 0 === $posted_forum_id ) {
+                                bbp_add_error( 'bbp_topic_forum_id', __( '<strong>ERROR</strong>: Forum ID is missing.', 'bbpress' ) );
+
+                        // Forum id is a negative number
+                        } elseif ( 0 > $posted_forum_id ) {
+                                bbp_add_error( 'bbp_topic_forum_id', __( '<strong>ERROR</strong>: Forum ID cannot be a negative number.', 'bbpress' ) );
+
+                        // Forum does not exist
+                        } elseif ( ! get_post( $posted_forum_id ) ) {
+                                bbp_add_error( 'bbp_topic_forum_id', __( '<strong>ERROR</strong>: Forum does not exist.', 'bbpress' ) );
+
+                        // Use the POST'ed forum id
+                        } else {
+                                $forum_id = $posted_forum_id;
+                        }
+                }
         }