Changeset 5592 for trunk/src/includes/forums/template.php

Timestamp:

01/10/2015 10:59:32 PM (10 years ago)

Author:

johnjamesjacoby

Message:

Use sanitize_key() in forums/template.php to ensure values are within expected boundaries. See #2742.

File:

• trunk/src/includes/forums/template.php (modified) (5 diffs)

trunk/src/includes/forums/template.php

@@ -2299 +2299 @@
         // Get _POST data
         if ( bbp_is_forum_form_post_request() && isset( $_POST['bbp_forum_type'] ) ) {
-            $forum_type = $_POST['bbp_forum_type'];
+            $forum_type = sanitize_key( $_POST['bbp_forum_type'] );
 
         // Get edit data
@@ -2337 +2337 @@
         // Get _POST data
         if ( bbp_is_forum_form_post_request() && isset( $_POST['bbp_forum_visibility'] ) ) {
-            $forum_visibility = $_POST['bbp_forum_visibility'];
+            $forum_visibility = sanitize_key( $_POST['bbp_forum_visibility'] );
 
         // Get edit data
@@ -2466 +2466 @@
             // Post value is passed
             if ( bbp_is_forum_form_post_request() && isset( $_POST[ $r['select_id'] ] ) ) {
-                $r['selected'] = $_POST[ $r['select_id'] ];
+                $r['selected'] = sanitize_key( $_POST[ $r['select_id'] ] );
 
             // No Post value was passed
@@ -2558 +2558 @@
             // Post value is passed
             if ( bbp_is_forum_form_post_request() && isset( $_POST[ $r['select_id'] ] ) ) {
-                $r['selected'] = $_POST[ $r['select_id'] ];
+                $r['selected'] = sanitize_key( $_POST[ $r['select_id'] ] );
 
             // No Post value was passed
@@ -2650 +2650 @@
             // Post value is passed
             if ( bbp_is_forum_form_post_request() && isset( $_POST[ $r['select_id'] ] ) ) {
-                $r['selected'] = $_POST[ $r['select_id'] ];
+                $r['selected'] = sanitize_key( $_POST[ $r['select_id'] ] );
 
             // No Post value was passed