Need Sanity Check for Plugin Page Callbacks

[filosofo]

bbPress should verify that a plugin page callback is actually one of the registered plugin pages. The problem is that it currently executes any callable argument, such as this:

bb-admin/admin-base.php?plugin=phpinfo

[_ck_]

I am bumping this to major/high because even though at least regular users cannot access the admin panel like on WordPress, moderators can escalate their access via certain functions which is bad situation.

This problem also exists on 0.9 so if easy, let's backport as a security issue.

[sambauers]

(In [2347]) Maintain registry of valid plugin page callbacks. Fixes #1172.

[sambauers]

(In [2348]) branches 0.9: Maintain registry of valid plugin page callbacks. See #1172.

[sambauers]

This needs testing in both trunk and the 0.9 branch.