Skip to:
Content

bbPress.org

Changeset 5684


Ignore:
Timestamp:
04/15/2015 03:06:31 PM (11 years ago)
Author:
johnjamesjacoby
Message:

General: Use sanitize_text_field() in lieu of old-bbPress style pre-escaping technique.

Location:
trunk/src/includes
Files:
4 edited

Legend:

Unmodified
Added
Removed

  • trunk/src/includes/core/filters.php

    r5559 r5684  
    9292add_filter( 'bbp_get_forum_permalink', 'bbp_add_view_all' );
    9393
    94 // wp_filter_kses on new/edit topic/reply title
     94// wp_filter_kses on new/edit forum/topic/reply title
     95add_filter( 'bbp_new_forum_pre_title',  'wp_filter_kses'  );
    9596add_filter( 'bbp_new_reply_pre_title',  'wp_filter_kses'  );
    9697add_filter( 'bbp_new_topic_pre_title',  'wp_filter_kses'  );
     98add_filter( 'bbp_edit_forum_pre_title', 'wp_filter_kses'  );
    9799add_filter( 'bbp_edit_reply_pre_title', 'wp_filter_kses'  );
    98100add_filter( 'bbp_edit_topic_pre_title', 'wp_filter_kses'  );

  • trunk/src/includes/forums/functions.php

    r5676 r5684  
    8787 * @uses bbp_set_current_anonymous_user_data() To set the anonymous user cookies
    8888 * @uses is_wp_error() To check if the value retrieved is a {@link WP_Error}
    89  * @uses esc_attr() For sanitization
    9089 * @uses bbp_is_forum_category() To check if the forum is a category
    9190 * @uses bbp_is_forum_closed() To check if the forum is closed
    … …  
    147146
    148147    if ( !empty( $_POST['bbp_forum_title'] ) ) {
    149         $forum_title = esc_attr( strip_tags( $_POST['bbp_forum_title'] ) );
     148        $forum_title = sanitize_text_field( $_POST['bbp_forum_title'] );
    150149    }
    151150
    … …  
    352351 * @uses bbp_filter_anonymous_post_data() To filter anonymous data
    353352 * @uses is_wp_error() To check if the value retrieved is a {@link WP_Error}
    354  * @uses esc_attr() For sanitization
    355353 * @uses bbp_is_forum_category() To check if the forum is a category
    356354 * @uses bbp_is_forum_closed() To check if the forum is closed
    … …  
    454452
    455453    if ( !empty( $_POST['bbp_forum_title'] ) ) {
    456         $forum_title = esc_attr( strip_tags( $_POST['bbp_forum_title'] ) );
     454        $forum_title = sanitize_text_field( $_POST['bbp_forum_title'] );
    457455    }
    458456
    … …  
    522520    // Revision Reason
    523521    if ( !empty( $_POST['bbp_forum_edit_reason'] ) )
    524         $forum_edit_reason = esc_attr( strip_tags( $_POST['bbp_forum_edit_reason'] ) );
     522        $forum_edit_reason = sanitize_text_field( $_POST['bbp_forum_edit_reason'] );
    525523
    526524    // Update revision log

  • trunk/src/includes/replies/functions.php

    r5676 r5684  
    9090 * @uses is_wp_error() To check if the value retrieved is a {@link WP_Error}
    9191 * @uses remove_filter() To remove kses filters if needed
    92  * @uses esc_attr() For sanitization
    9392 * @uses bbp_check_for_flood() To check for flooding
    9493 * @uses bbp_check_for_duplicate() To check for duplicates
    … …  
    263262
    264263    if ( !empty( $_POST['bbp_reply_title'] ) ) {
    265         $reply_title = esc_attr( strip_tags( $_POST['bbp_reply_title'] ) );
     264        $reply_title = sanitize_text_field( $_POST['bbp_reply_title'] );
    266265    }
    267266
    … …  
    330329    // Either replace terms
    331330    if ( bbp_allow_topic_tags() && current_user_can( 'assign_topic_tags' ) && ! empty( $_POST['bbp_topic_tags'] ) ) {
    332         $terms = esc_attr( strip_tags( $_POST['bbp_topic_tags'] ) );
     331        $terms = sanitize_text_field( $_POST['bbp_topic_tags'] );
    333332
    334333    // ...or remove them.
    … …  
    472471 * @uses is_wp_error() To check if the value retrieved is a {@link WP_Error}
    473472 * @uses remove_filter() To remove kses filters if needed
    474  * @uses esc_attr() For sanitization
    475  * @uses apply_filters() Calls 'bbp_edit_reply_pre_title' with the title and
    476  *                       reply id
    477  * @uses apply_filters() Calls 'bbp_edit_reply_pre_content' with the content
    478  *                        reply id
     473 * @uses apply_filters() Calls 'bbp_edit_reply_pre_title' with the title and id
     474 * @uses apply_filters() Calls 'bbp_edit_reply_pre_content' with the content id
    479475 * @uses wp_set_post_terms() To set the topic tags
    480476 * @uses bbp_has_errors() To get the {@link WP_Error} errors
    … …  
    600596
    601597    if ( !empty( $_POST['bbp_reply_title'] ) ) {
    602         $reply_title = esc_attr( strip_tags( $_POST['bbp_reply_title'] ) );
     598        $reply_title = sanitize_text_field( $_POST['bbp_reply_title'] );
    603599    }
    604600
    … …  
    652648    // Either replace terms
    653649    if ( bbp_allow_topic_tags() && current_user_can( 'assign_topic_tags' ) && ! empty( $_POST['bbp_topic_tags'] ) ) {
    654         $terms = esc_attr( strip_tags( $_POST['bbp_topic_tags'] ) );
     650        $terms = sanitize_text_field( $_POST['bbp_topic_tags'] );
    655651
    656652    // ...or remove them.
    … …  
    718714    // Revision Reason
    719715    if ( !empty( $_POST['bbp_reply_edit_reason'] ) ) {
    720         $reply_edit_reason = esc_attr( strip_tags( $_POST['bbp_reply_edit_reason'] ) );
     716        $reply_edit_reason = sanitize_text_field( $_POST['bbp_reply_edit_reason'] );
    721717    }
    722718
    … …  
    13841380                    // Use the new title that was passed
    13851381                    if ( !empty( $_POST['bbp_reply_move_destination_title'] ) ) {
    1386                         $destination_topic_title = esc_attr( strip_tags( $_POST['bbp_reply_move_destination_title'] ) );
     1382                        $destination_topic_title = sanitize_text_field( $_POST['bbp_reply_move_destination_title'] );
    13871383
    13881384                    // Use the source topic title

  • trunk/src/includes/topics/functions.php

    r5676 r5684  
    9292 * @uses bbp_set_current_anonymous_user_data() To set the anonymous user cookies
    9393 * @uses is_wp_error() To check if the value retrieved is a {@link WP_Error}
    94  * @uses esc_attr() For sanitization
    9594 * @uses bbp_is_forum_category() To check if the forum is a category
    9695 * @uses bbp_is_forum_closed() To check if the forum is closed
    … …  
    175174
    176175    if ( ! empty( $_POST['bbp_topic_title'] ) ) {
    177         $topic_title = esc_attr( strip_tags( $_POST['bbp_topic_title'] ) );
     176        $topic_title = sanitize_text_field( $_POST['bbp_topic_title'] );
    178177    }
    179178
    … …  
    306305
    307306        // Escape tag input
    308         $terms = esc_attr( strip_tags( $_POST['bbp_topic_tags'] ) );
     307        $terms = sanitize_text_field( $_POST['bbp_topic_tags'] );
    309308
    310309        // Explode by comma
    … …  
    464463 * @uses bbp_filter_anonymous_post_data() To filter anonymous data
    465464 * @uses is_wp_error() To check if the value retrieved is a {@link WP_Error}
    466  * @uses esc_attr() For sanitization
    467465 * @uses bbp_is_forum_category() To check if the forum is a category
    468466 * @uses bbp_is_forum_closed() To check if the forum is closed
    … …  
    600598
    601599    if ( ! empty( $_POST['bbp_topic_title'] ) ) {
    602         $topic_title = esc_attr( strip_tags( $_POST['bbp_topic_title'] ) );
     600        $topic_title = sanitize_text_field( $_POST['bbp_topic_title'] );
    603601    }
    604602
    … …  
    656654
    657655        // Escape tag input
    658         $terms = esc_attr( strip_tags( $_POST['bbp_topic_tags'] ) );
     656        $terms = sanitize_text_field( $_POST['bbp_topic_tags'] );
    659657
    660658        // Explode by comma
    … …  
    725723        // Revision Reason
    726724        if ( ! empty( $_POST['bbp_topic_edit_reason'] ) ) {
    727             $topic_edit_reason = esc_attr( strip_tags( $_POST['bbp_topic_edit_reason'] ) );
     725            $topic_edit_reason = sanitize_text_field( $_POST['bbp_topic_edit_reason'] );
    728726        }
    729727
    … …  
    15581556                    // Use the new title that was passed
    15591557                    if ( ! empty( $_POST['bbp_topic_split_destination_title'] ) ) {
    1560                         $destination_topic_title = esc_attr( strip_tags( $_POST['bbp_topic_split_destination_title'] ) );
     1558                        $destination_topic_title = sanitize_text_field( $_POST['bbp_topic_split_destination_title'] );
    15611559
    15621560                    // Use the source topic title
Note: See TracChangeset for help on using the changeset viewer.