Changeset 5009 for trunk/includes/topics/functions.php

Timestamp:

07/04/2013 12:11:09 PM (13 years ago)

Author:

johnjamesjacoby

Message:

Introduce additional forum/topic ID validation when posting new topics and replies. Prevents empty/negative/non-existent post_parent. Fixes #2363.

File:

• trunk/includes/topics/functions.php (modified) (1 diff)

trunk/includes/topics/functions.php

@@ -189 +189 @@
     /** Topic Forum ***********************************************************/
 
-    // Forum id was not passed
-    if ( empty( $_POST['bbp_forum_id'] ) ) {
-        bbp_add_error( 'bbp_topic_forum_id', __( '<strong>ERROR</strong>: Forum ID is missing.', 'bbpress' ) );
-
-    // Forum id was passed
-    } elseif ( is_numeric( $_POST['bbp_forum_id'] ) ) {
-        $forum_id = (int) $_POST['bbp_forum_id'];
+    // Error check the POST'ed topic id
+    if ( isset( $_POST['bbp_forum_id'] ) ) {
+
+        // Empty Forum id was passed
+        if ( empty( $_POST['bbp_forum_id'] ) ) {
+            bbp_add_error( 'bbp_topic_forum_id', __( '<strong>ERROR</strong>: Forum ID is missing.', 'bbpress' ) );
+
+        // Forum id is not a number
+        } elseif ( ! is_numeric( $_POST['bbp_forum_id'] ) ) {
+            bbp_add_error( 'bbp_topic_forum_id', __( '<strong>ERROR</strong>: Forum ID must be a number.', 'bbpress' ) );
+
+        // Forum id might be valid
+        } else {
+
+            // Get the forum id
+            $posted_forum_id = intval( $_POST['bbp_forum_id'] );
+
+            // Forum id is empty
+            if ( 0 === $posted_forum_id ) {
+                bbp_add_error( 'bbp_topic_forum_id', __( '<strong>ERROR</strong>: Forum ID is missing.', 'bbpress' ) );
+
+            // Forum id is a negative number
+            } elseif ( 0 > $posted_forum_id ) {
+                bbp_add_error( 'bbp_topic_forum_id', __( '<strong>ERROR</strong>: Forum ID cannot be a negative number.', 'bbpress' ) );
+
+            // Forum does not exist
+            } elseif ( ! get_post( $posted_forum_id ) ) {
+                bbp_add_error( 'bbp_topic_forum_id', __( '<strong>ERROR</strong>: Forum does not exist.', 'bbpress' ) );
+
+            // Use the POST'ed forum id
+            } else {
+                $forum_id = $posted_forum_id;
+            }
+        }
     }