Changeset 5566

Timestamp:

11/12/2014 07:34:09 PM (10 years ago)

Author:

johnjamesjacoby

Message:

Add nonce checks to admin area topic & author suggest usages.

Location:

trunk/src/includes/admin

Files:

• admin.php (modified) (2 diffs)
• js/common.js (modified) (1 diff)
• js/replies.js (modified) (1 diff)
• metaboxes.php (modified) (2 diffs)

trunk/src/includes/admin/admin.php

@@ -697 +697 @@
      */
     public function suggest_topic() {
+        global $wpdb;
+
+        // Bail early if no request
+        if ( empty( $_REQUEST['q'] ) ) {
+            wp_die( '0' );
+        }
+
+        // Check the ajax nonce
+        check_ajax_referer( 'bbp_suggest_topic_nonce' );
 
         // Try to get some topics
         $topics = get_posts( array(
-            's'         => like_escape( $_REQUEST['q'] ),
+            's'         => $wpdb->esc_like( $_REQUEST['q'] ),
             'post_type' => bbp_get_topic_post_type()
         ) );
@@ -719 +728 @@
      */
     public function suggest_user() {
+        global $wpdb;
+
+        // Bail early if no request
+        if ( empty( $_REQUEST['q'] ) ) {
+            wp_die( '0' );
+        }
+
+        // Check the ajax nonce
+        check_ajax_referer( 'bbp_suggest_user_nonce' );
 
         // Try to get some users
         $users_query = new WP_User_Query( array(
-            'search'         => '*' . like_escape( $_REQUEST['q'] ) . '*',
+            'search'         => '*' . $wpdb->esc_like( $_REQUEST['q'] ) . '*',
             'fields'         => array( 'ID', 'user_nicename' ),
             'search_columns' => array( 'ID', 'user_nicename', 'user_email' ),

trunk/src/includes/admin/js/common.js

@@ -3 +3 @@
     var bbp_author_id = jQuery( '#bbp_author_id' );
 
-    bbp_author_id.suggest( ajaxurl + '?action=bbp_suggest_user', {
-        onSelect: function() {
-            var value = this.value;
-            bbp_author_id.val( value.substr( 0, value.indexOf( ' ' ) ) );
+    bbp_author_id.suggest(
+        bbp_author_id.data( 'ajax-url' ),
+        {
+            onSelect: function() {
+                var value = this.value;
+                bbp_author_id.val( value.substr( 0, value.indexOf( ' ' ) ) );
+            }
         }
-    } );
+    );
 } );

trunk/src/includes/admin/js/replies.js

@@ -6 +6 @@
     var bbp_topic_id = jQuery( '#bbp_topic_id' );
 
-    bbp_topic_id.suggest( ajaxurl + '?action=bbp_suggest_topic', {
-        onSelect: function() {
-            var value = this.value;
-            bbp_topic_id.val( value.substr( 0, value.indexOf( ' ' ) ) );
+    bbp_topic_id.suggest(
+        bbp_topic_id.data( 'ajax-url' ),
+        {
+            onSelect: function() {
+                console.log( 'hi' );
+                var value = this.value;
+                bbp_topic_id.val( value.substr( 0, value.indexOf( ' ' ) ) );
+            }
         }
-    } );
+    );
 } );

trunk/src/includes/admin/metaboxes.php

@@ -522 +522 @@
         <strong class="label"><?php esc_html_e( 'Topic:', 'bbpress' ); ?></strong>
         <label class="screen-reader-text" for="parent_id"><?php esc_html_e( 'Topic', 'bbpress' ); ?></label>
-        <input name="parent_id" id="bbp_topic_id" type="text" value="<?php echo esc_attr( $reply_topic_id ); ?>" />
+        <input name="parent_id" id="bbp_topic_id" type="text" value="<?php echo esc_attr( $reply_topic_id ); ?>" data-ajax-url="<?php echo wp_nonce_url( add_query_arg( array( 'action' => 'bbp_suggest_topic' ), admin_url( 'admin-ajax.php', 'relative' ) ), 'bbp_suggest_topic_nonce' ); ?>" />
     </p>
 
@@ -587 +587 @@
             <strong class="label"><?php esc_html_e( 'ID:', 'bbpress' ); ?></strong>
             <label class="screen-reader-text" for="bbp_author_id"><?php esc_html_e( 'ID', 'bbpress' ); ?></label>
-            <input type="text" id="bbp_author_id" name="post_author_override" value="<?php echo esc_attr( bbp_get_global_post_field( 'post_author' ) ); ?>" />
+            <input type="text" id="bbp_author_id" name="post_author_override" value="<?php echo esc_attr( bbp_get_global_post_field( 'post_author' ) ); ?>" data-ajax-url="<?php echo wp_nonce_url( add_query_arg( array( 'action' => 'bbp_suggest_user' ), admin_url( 'admin-ajax.php', 'relative' ) ), 'bbp_suggest_user_nonce' ); ?>" />
         </p>