Changeset 5366

Timestamp:

06/05/2014 08:44:55 PM (10 years ago)

Author:

johnjamesjacoby

Message:

Introduce bbp_sanitize_slug() function for sanitizing permalink slugs, and use it as the callback for any slug settings. Props mazengamal. See #2496 (2.5 branch).

Location:

branches/2.5/includes/admin

Files:

• functions.php (modified) (1 diff)
• settings.php (modified) (12 diffs)

branches/2.5/includes/admin/functions.php

@@ -136 +136 @@
     // Return post link
     return $post_link;
+}
+
+/**
+ * Sanitize permalink slugs when saving the settings page.
+ *
+ * @since bbPress (r5364)
+ *
+ * @param string $slug
+ * @return string
+ */
+function bbp_sanitize_slug( $slug = '' ) {
+
+    // Don't allow multiple slashes in a row
+    $value = preg_replace( '#/+#', '/', str_replace( '#', '', $slug ) );
+
+    // Strip out unsafe or unusable chars
+    $value = esc_url_raw( $value );
+
+    // esc_url_raw() adds a scheme via esc_url(), so let's remove it
+    $value = str_replace( 'http://', '', $value );
+
+    // Trim off first and last slashes.
+    //
+    // We already prevent double slashing elsewhere, but let's prevent
+    // accidental poisoning of options values where we can.
+    $value = ltrim( $value, '/' );
+    $value = rtrim( $value, '/' );
+
+    // Filter the result and return
+    return apply_filters( 'bbp_sanitize_slug', $value, $slug );
 }
 

branches/2.5/includes/admin/settings.php

@@ -264 +264 @@
                 'title'             => __( 'Forum Root', 'bbpress' ),
                 'callback'          => 'bbp_admin_setting_callback_root_slug',
-                'sanitize_callback' => 'esc_sql',
+                'sanitize_callback' => 'bbp_sanitize_slug',
                 'args'              => array()
             ),
@@ -293 +293 @@
                 'title'             => __( 'Forum', 'bbpress' ),
                 'callback'          => 'bbp_admin_setting_callback_forum_slug',
-                'sanitize_callback' => 'sanitize_title',
+                'sanitize_callback' => 'bbp_sanitize_slug',
                 'args'              => array()
             ),
@@ -301 +301 @@
                 'title'             => __( 'Topic', 'bbpress' ),
                 'callback'          => 'bbp_admin_setting_callback_topic_slug',
-                'sanitize_callback' => 'sanitize_title',
+                'sanitize_callback' => 'bbp_sanitize_slug',
                 'args'              => array()
             ),
@@ -309 +309 @@
                 'title'             => __( 'Topic Tag', 'bbpress' ),
                 'callback'          => 'bbp_admin_setting_callback_topic_tag_slug',
-                'sanitize_callback' => 'sanitize_title',
+                'sanitize_callback' => 'bbp_sanitize_slug',
                 'args'              => array()
             ),
@@ -317 +317 @@
                 'title'             => __( 'Topic View', 'bbpress' ),
                 'callback'          => 'bbp_admin_setting_callback_view_slug',
-                'sanitize_callback' => 'sanitize_title',
+                'sanitize_callback' => 'bbp_sanitize_slug',
                 'args'              => array()
             ),
@@ -325 +325 @@
                 'title'             => __( 'Reply', 'bbpress' ),
                 'callback'          => 'bbp_admin_setting_callback_reply_slug',
-                'sanitize_callback' => 'sanitize_title',
+                'sanitize_callback' => 'bbp_sanitize_slug',
                 'args'              => array()
             ),
@@ -333 +333 @@
                 'title'             => __( 'Search', 'bbpress' ),
                 'callback'          => 'bbp_admin_setting_callback_search_slug',
-                'sanitize_callback' => 'sanitize_title',
+                'sanitize_callback' => 'bbp_sanitize_slug',
                 'args'              => array()
             )
@@ -346 +346 @@
                 'title'             => __( 'User Base', 'bbpress' ),
                 'callback'          => 'bbp_admin_setting_callback_user_slug',
-                'sanitize_callback' => 'sanitize_title',
+                'sanitize_callback' => 'bbp_sanitize_slug',
                 'args'              => array()
             ),
@@ -354 +354 @@
                 'title'             => __( 'Topics Started', 'bbpress' ),
                 'callback'          => 'bbp_admin_setting_callback_topic_archive_slug',
-                'sanitize_callback' => 'esc_sql',
+                'sanitize_callback' => 'bbp_sanitize_slug',
                 'args'              => array()
             ),
@@ -362 +362 @@
                 'title'             => __( 'Replies Created', 'bbpress' ),
                 'callback'          => 'bbp_admin_setting_callback_reply_archive_slug',
-                'sanitize_callback' => 'esc_sql',
+                'sanitize_callback' => 'bbp_sanitize_slug',
                 'args'              => array()
             ),
@@ -370 +370 @@
                 'title'             => __( 'Favorite Topics', 'bbpress' ),
                 'callback'          => 'bbp_admin_setting_callback_user_favs_slug',
-                'sanitize_callback' => 'esc_sql',
+                'sanitize_callback' => 'bbp_sanitize_slug',
                 'args'              => array()
             ),
@@ -378 +378 @@
                 'title'             => __( 'Topic Subscriptions', 'bbpress' ),
                 'callback'          => 'bbp_admin_setting_callback_user_subs_slug',
-                'sanitize_callback' => 'esc_sql',
+                'sanitize_callback' => 'bbp_sanitize_slug',
                 'args'              => array()
             )