Changeset 5587

Timestamp:

01/10/2015 10:52:51 PM (10 years ago)

Author:

johnjamesjacoby

Message:

Use sanitize_key() in bbp_post_request() and bbp_get_request(), improving the predictability of possible actions. See #2742.

File:

• trunk/src/includes/core/sub-actions.php (modified) (2 diffs)

trunk/src/includes/core/sub-actions.php

@@ -364 +364 @@
     }
 
+    // Sanitize the POST action
+    $action = sanitize_key( $_POST['action'] );
+
     // This dynamic action is probably the one you want to use. It narrows down
     // the scope of the 'action' without needing to check it in your function.
-    do_action( 'bbp_post_request_' . $_POST['action'] );
+    do_action( 'bbp_post_request_' . $action );
 
     // Use this static action if you don't mind checking the 'action' yourself.
-    do_action( 'bbp_post_request',   $_POST['action'] );
+    do_action( 'bbp_post_request',   $action );
 }
 
@@ -390 +393 @@
     }
 
+    // Sanitize the POST action
+    $action = sanitize_key( $_GET['action'] );
+
     // This dynamic action is probably the one you want to use. It narrows down
     // the scope of the 'action' without needing to check it in your function.
-    do_action( 'bbp_get_request_' . $_GET['action'] );
+    do_action( 'bbp_get_request_' . $action );
 
     // Use this static action if you don't mind checking the 'action' yourself.
-    do_action( 'bbp_get_request',   $_GET['action'] );
+    do_action( 'bbp_get_request',   $action );
 }