Improve form field post request retention

[johnjamesjacoby]

When submitting a theme-side form, bbPress retains form field data to avoid the possibility of losing user submitted data should an error occur. These fields and their _form_ functions are a bit too trusting in their approach, and are mildly susceptible to a simple form of cross-site request forgery allowing form data to be set without user input.

The good news here (and why I'm publishing this publicly here) is all user input appears to be appropriately validated before it's saved, making this less of an exploit and more of an unintended consequence of a convenience feature.

The bad news is it affects several fields across the forum, topic, and reply components, making it a relatively sprawling change. I'm creating this ticket to get more eyes on the fix, and see if anything else smells similarly funky.

[johnjamesjacoby]

In 5558:

Improve form field output sanitization when posting theme-side forum/topic/reply content. Thanks planetzuda. See #2719.

[johnjamesjacoby]

In 5559:

Update to newer slashing functions, as our minimum requirement is WordPress 3.6.

Also add filters to topic-title & topic-tags form fields. See #2719.

[netweb]

What else is left to do here?

[johnjamesjacoby]

I don't think anything. Thanks for the nudge.