New topics and replies can be parentless

[johnjamesjacoby]

When posting a new topic or reply, we currently do not force the proposed post_parent post ID to exist. This was originally by design, to allow for flexibility in the forum/topic/reply relationship, but because the eventual post_parent is passed via a form field, it's easy to manipulate.

To duplicate:

• Login
• Visit a single forum page
• Inspect the "New Topic" fieldset
• Change the 'bbp_forum_id' field value to -1
• Submit a new topic

The same can be done with a new reply on a single topic.

The solution is to add more error handling to the bbp_new_reply_handler() and bbp_new_topic_handler() functions, to make sure the proposed post_parent actually exists, and to explicitly prevent negative post ID's.

[johnjamesjacoby]

2363.2.patch fixes some inline doc.

[johnjamesjacoby]

In 5009:

Introduce additional forum/topic ID validation when posting new topics and replies. Prevents empty/negative/non-existent post_parent. Fixes #2363.