Changeset 7081

Timestamp:

05/20/2020 07:33:29 PM (6 years ago)

Author:

johnjamesjacoby

Message:

Sub-Actions: add is_string() checks to bbp_get/post_request()` functions.

This commit prevents possible PHP warnings when action global variables are sent over as an array using the [] URI syntax, which is not supported.

Props dd32.

(In branches/2.6, for 2.6.5.)

Fixes #3373.

File:

• branches/2.6/src/includes/core/sub-actions.php (modified) (2 diffs)

branches/2.6/src/includes/core/sub-actions.php

@@ -379 +379 @@
     }
 
-    // Bail if no action
-    if ( empty( $_POST['action'] ) ) {
+    // Bail if no action, or if not a string (arrays not supported)
+    if ( empty( $_POST['action'] ) || ! is_string( $_POST['action'] ) ) {
         return;
     }
@@ -412 +412 @@
     }
 
-    // Bail if no action
-    if ( empty( $_GET['action'] ) ) {
+    // Bail if no action, or if not a string (arrays not supported)
+    if ( empty( $_GET['action'] ) || ! is_string( $_GET['action'] ) ) {
         return;
     }