Skip to:
Content

bbPress.org

Opened 3 years ago

Closed 3 years ago

Last modified 3 years ago

#3438 closed defect (bug) (fixed)

Some invalid Topic View IDs not 404'ing correctly

Reported by: johnjamesjacoby's profile johnjamesjacoby Owned by: johnjamesjacoby's profile johnjamesjacoby
Milestone: 2.6.7 Priority: high
Severity: normal Version: 2.0
Component: API - Topic Views Keywords: commit
Cc:

Description

URLs that contain specific variations of registered Topic View IDs will erroneously try to:

  • Trigger theme compatibility
  • Query for Topics
  • Load all Topics thanks to a partial query arguments array
  • Trigger PHP warnings from attempting to access invalid array indexes

To replicate:

  • bbPress comes with the /popular/ Topic View
  • Attempt to visit /popular[]/ or /popular||/

Originally discovered by @dd32.

Change History (3)

#1 @johnjamesjacoby
3 years ago

In 7211:

Topic Views: do not sanitize $view parameter of bbp_get_view_id().

(Removes the call to sanitize_key() inside of bbp_get_view_id().)

This change ensures that when checking for a registered view, the literal value is used for comparisons and not the sanitized version of it. This matches the behavior of other _get_*_id() functions, and also fixes a bug causing these invalid view IDs not to 404 as intended.

Props johnjamesjacoby, dd32.

In branches/2.6, for 2.6.7.

See #3438.

#2 @johnjamesjacoby
3 years ago

  • Resolution set to fixed
  • Status changed from assigned to closed

In 7212:

Topic Views: do not sanitize $view parameter of bbp_get_view_id().

(Removes the call to sanitize_key() inside of bbp_get_view_id().)

This change ensures that when checking for a registered view, the literal value is used for comparisons and not the sanitized version of it. This matches the behavior of other _get_*_id() functions, and also fixes a bug causing these invalid view IDs not to 404 as intended.

Props johnjamesjacoby, dd32.

In trunk, for 2.7.

Fixes #3438.

This ticket was mentioned in Slack in #bbpress by jjj. View the logs.


3 years ago

Note: See TracTickets for help on using tickets.