Skip to:
Content

bbPress.org

Changeset 5684


Ignore:
Timestamp:
04/15/2015 03:06:31 PM (11 years ago)
Author:
johnjamesjacoby
Message:

General: Use sanitize_text_field() in lieu of old-bbPress style pre-escaping technique.

Location:
trunk/src/includes
Files:
4 edited

Legend:

Unmodified
Added
Removed

  • trunk/src/includes/core/filters.php

    r5559 r5684  
    9292add_filter( 'bbp_get_forum_permalink', 'bbp_add_view_all' );
    9393
    94 // wp_filter_kses on new/edit topic/reply title
     94// wp_filter_kses on new/edit forum/topic/reply title
     95add_filter( 'bbp_new_forum_pre_title',  'wp_filter_kses'  );
    9596add_filter( 'bbp_new_reply_pre_title',  'wp_filter_kses'  );
    9697add_filter( 'bbp_new_topic_pre_title',  'wp_filter_kses'  );
     98add_filter( 'bbp_edit_forum_pre_title', 'wp_filter_kses'  );
    9799add_filter( 'bbp_edit_reply_pre_title', 'wp_filter_kses'  );
    98100add_filter( 'bbp_edit_topic_pre_title', 'wp_filter_kses'  );

  • trunk/src/includes/forums/functions.php

    r5676 r5684  
    8787 * @uses bbp_set_current_anonymous_user_data() To set the anonymous user cookies
    8888 * @uses is_wp_error() To check if the value retrieved is a {@link WP_Error}
    89  * @uses esc_attr() For sanitization
    9089 * @uses bbp_is_forum_category() To check if the forum is a category
    9190 * @uses bbp_is_forum_closed() To check if the forum is closed
    … …  
    147146
    148147        if ( !empty( $_POST['bbp_forum_title'] ) ) {
    149                 $forum_title = esc_attr( strip_tags( $_POST['bbp_forum_title'] ) );
     148                $forum_title = sanitize_text_field( $_POST['bbp_forum_title'] );
    150149        }
    151150
    … …  
    352351 * @uses bbp_filter_anonymous_post_data() To filter anonymous data
    353352 * @uses is_wp_error() To check if the value retrieved is a {@link WP_Error}
    354  * @uses esc_attr() For sanitization
    355353 * @uses bbp_is_forum_category() To check if the forum is a category
    356354 * @uses bbp_is_forum_closed() To check if the forum is closed
    … …  
    454452
    455453        if ( !empty( $_POST['bbp_forum_title'] ) ) {
    456                 $forum_title = esc_attr( strip_tags( $_POST['bbp_forum_title'] ) );
     454                $forum_title = sanitize_text_field( $_POST['bbp_forum_title'] );
    457455        }
    458456
    … …  
    522520        // Revision Reason
    523521        if ( !empty( $_POST['bbp_forum_edit_reason'] ) )
    524                 $forum_edit_reason = esc_attr( strip_tags( $_POST['bbp_forum_edit_reason'] ) );
     522                $forum_edit_reason = sanitize_text_field( $_POST['bbp_forum_edit_reason'] );
    525523
    526524        // Update revision log

  • trunk/src/includes/replies/functions.php

    r5676 r5684  
    9090 * @uses is_wp_error() To check if the value retrieved is a {@link WP_Error}
    9191 * @uses remove_filter() To remove kses filters if needed
    92  * @uses esc_attr() For sanitization
    9392 * @uses bbp_check_for_flood() To check for flooding
    9493 * @uses bbp_check_for_duplicate() To check for duplicates
    … …  
    263262
    264263        if ( !empty( $_POST['bbp_reply_title'] ) ) {
    265                 $reply_title = esc_attr( strip_tags( $_POST['bbp_reply_title'] ) );
     264                $reply_title = sanitize_text_field( $_POST['bbp_reply_title'] );
    266265        }
    267266
    … …  
    330329        // Either replace terms
    331330        if ( bbp_allow_topic_tags() && current_user_can( 'assign_topic_tags' ) && ! empty( $_POST['bbp_topic_tags'] ) ) {
    332                 $terms = esc_attr( strip_tags( $_POST['bbp_topic_tags'] ) );
     331                $terms = sanitize_text_field( $_POST['bbp_topic_tags'] );
    333332
    334333        // ...or remove them.
    … …  
    472471 * @uses is_wp_error() To check if the value retrieved is a {@link WP_Error}
    473472 * @uses remove_filter() To remove kses filters if needed
    474  * @uses esc_attr() For sanitization
    475  * @uses apply_filters() Calls 'bbp_edit_reply_pre_title' with the title and
    476  *                       reply id
    477  * @uses apply_filters() Calls 'bbp_edit_reply_pre_content' with the content
    478  *                        reply id
     473 * @uses apply_filters() Calls 'bbp_edit_reply_pre_title' with the title and id
     474 * @uses apply_filters() Calls 'bbp_edit_reply_pre_content' with the content id
    479475 * @uses wp_set_post_terms() To set the topic tags
    480476 * @uses bbp_has_errors() To get the {@link WP_Error} errors
    … …  
    600596
    601597        if ( !empty( $_POST['bbp_reply_title'] ) ) {
    602                 $reply_title = esc_attr( strip_tags( $_POST['bbp_reply_title'] ) );
     598                $reply_title = sanitize_text_field( $_POST['bbp_reply_title'] );
    603599        }
    604600
    … …  
    652648        // Either replace terms
    653649        if ( bbp_allow_topic_tags() && current_user_can( 'assign_topic_tags' ) && ! empty( $_POST['bbp_topic_tags'] ) ) {
    654                 $terms = esc_attr( strip_tags( $_POST['bbp_topic_tags'] ) );
     650                $terms = sanitize_text_field( $_POST['bbp_topic_tags'] );
    655651
    656652        // ...or remove them.
    … …  
    718714        // Revision Reason
    719715        if ( !empty( $_POST['bbp_reply_edit_reason'] ) ) {
    720                 $reply_edit_reason = esc_attr( strip_tags( $_POST['bbp_reply_edit_reason'] ) );
     716                $reply_edit_reason = sanitize_text_field( $_POST['bbp_reply_edit_reason'] );
    721717        }
    722718
    … …  
    13841380                                        // Use the new title that was passed
    13851381                                        if ( !empty( $_POST['bbp_reply_move_destination_title'] ) ) {
    1386                                                 $destination_topic_title = esc_attr( strip_tags( $_POST['bbp_reply_move_destination_title'] ) );
     1382                                                $destination_topic_title = sanitize_text_field( $_POST['bbp_reply_move_destination_title'] );
    13871383
    13881384                                        // Use the source topic title

  • trunk/src/includes/topics/functions.php

    r5676 r5684  
    9292 * @uses bbp_set_current_anonymous_user_data() To set the anonymous user cookies
    9393 * @uses is_wp_error() To check if the value retrieved is a {@link WP_Error}
    94  * @uses esc_attr() For sanitization
    9594 * @uses bbp_is_forum_category() To check if the forum is a category
    9695 * @uses bbp_is_forum_closed() To check if the forum is closed
    … …  
    175174
    176175        if ( ! empty( $_POST['bbp_topic_title'] ) ) {
    177                 $topic_title = esc_attr( strip_tags( $_POST['bbp_topic_title'] ) );
     176                $topic_title = sanitize_text_field( $_POST['bbp_topic_title'] );
    178177        }
    179178
    … …  
    306305
    307306                // Escape tag input
    308                 $terms = esc_attr( strip_tags( $_POST['bbp_topic_tags'] ) );
     307                $terms = sanitize_text_field( $_POST['bbp_topic_tags'] );
    309308
    310309                // Explode by comma
    … …  
    464463 * @uses bbp_filter_anonymous_post_data() To filter anonymous data
    465464 * @uses is_wp_error() To check if the value retrieved is a {@link WP_Error}
    466  * @uses esc_attr() For sanitization
    467465 * @uses bbp_is_forum_category() To check if the forum is a category
    468466 * @uses bbp_is_forum_closed() To check if the forum is closed
    … …  
    600598
    601599        if ( ! empty( $_POST['bbp_topic_title'] ) ) {
    602                 $topic_title = esc_attr( strip_tags( $_POST['bbp_topic_title'] ) );
     600                $topic_title = sanitize_text_field( $_POST['bbp_topic_title'] );
    603601        }
    604602
    … …  
    656654
    657655                // Escape tag input
    658                 $terms = esc_attr( strip_tags( $_POST['bbp_topic_tags'] ) );
     656                $terms = sanitize_text_field( $_POST['bbp_topic_tags'] );
    659657
    660658                // Explode by comma
    … …  
    725723                // Revision Reason
    726724                if ( ! empty( $_POST['bbp_topic_edit_reason'] ) ) {
    727                         $topic_edit_reason = esc_attr( strip_tags( $_POST['bbp_topic_edit_reason'] ) );
     725                        $topic_edit_reason = sanitize_text_field( $_POST['bbp_topic_edit_reason'] );
    728726                }
    729727
    … …  
    15581556                                        // Use the new title that was passed
    15591557                                        if ( ! empty( $_POST['bbp_topic_split_destination_title'] ) ) {
    1560                                                 $destination_topic_title = esc_attr( strip_tags( $_POST['bbp_topic_split_destination_title'] ) );
     1558                                                $destination_topic_title = sanitize_text_field( $_POST['bbp_topic_split_destination_title'] );
    15611559
    15621560                                        // Use the source topic title
Note: See TracChangeset for help on using the changeset viewer.