Changeset 7080 for trunk/src/includes/core/sub-actions.php

Timestamp:

05/20/2020 07:31:47 PM (5 years ago)

Author:

johnjamesjacoby

Message:

Sub-Actions: add is_string() checks to bbp_get/post_request()` functions.

This commit prevents possible PHP warnings when action global variables are sent over as an array using the [] URI syntax, which is not supported.

Props dd32.

(In trunk, for 2.7.0.)

Fixes #3373.

File:

• trunk/src/includes/core/sub-actions.php (modified) (2 diffs)

trunk/src/includes/core/sub-actions.php

@@ -379 +379 @@
     }
 
-    // Bail if no action
-    if ( empty( $_POST['action'] ) ) {
+    // Bail if no action, of if not a string (arrays not supported)
+    if ( empty( $_POST['action'] ) || ! is_string( $_POST['action'] ) ) {
         return;
     }
@@ -412 +412 @@
     }
 
-    // Bail if no action
-    if ( empty( $_GET['action'] ) ) {
+    // Bail if no action, or if not a string (arrays not supported)
+    if ( empty( $_GET['action'] ) || ! is_string( $_GET['action'] ) ) {
         return;
     }