<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[BuddyPress][10386] trunk/src: Improve input handling on a variety of admin screens (trunk).</title>
</head>
<body>
<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; }
#msg dl a { font-weight: bold}
#msg dl a:link { color:#fc3; }
#msg dl a:active { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta" style="font-size: 105%">
<dt style="float: left; width: 6em; font-weight: bold">Revision</dt> <dd><a style="font-weight: bold" href="http://buddypress.trac.wordpress.org/changeset/10386">10386</a><script type="application/ld+json">{"@context":"http://schema.org","@type":"EmailMessage","description":"Review this Commit","action":{"@type":"ViewAction","url":"http://buddypress.trac.wordpress.org/changeset/10386","name":"Review Commit"}}</script></dd>
<dt style="float: left; width: 6em; font-weight: bold">Author</dt> <dd>djpaul</dd>
<dt style="float: left; width: 6em; font-weight: bold">Date</dt> <dd>2015-12-02 20:47:28 +0000 (Wed, 02 Dec 2015)</dd>
</dl>
<pre style='padding-left: 1em; margin: 2em 0; border-left: 2px solid #ccc; line-height: 1.25; font-size: 105%; font-family: sans-serif'>Improve input handling on a variety of admin screens (trunk).
An internal audit revealed some screens which react to form submission where we were not sanitising input as well as we could have been. We've added extra typecasting and existence checks to avoid mishandling causing PHP Notices.
Additionally, we moved a list of hardcoded BuddyPress "pages" (registration and account activation) into a filterable function to allow plugin developers to more easily customise or add to these, which also gives us the benefit of being able to use that function as a sanitisation whitelist, without duplicating that hardcoded list.
Props boonebgorges, DJPaul</pre>
<h3>Modified Paths</h3>
<ul>
<li><a href="#trunksrcbpcoreadminbpcoreadminslugsphp">trunk/src/bp-core/admin/bp-core-admin-slugs.php</a></li>
<li><a href="#trunksrcbpgroupsbpgroupsactionsphp">trunk/src/bp-groups/bp-groups-actions.php</a></li>
<li><a href="#trunksrcbpgroupsbpgroupsadminphp">trunk/src/bp-groups/bp-groups-admin.php</a></li>
</ul>
</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunksrcbpcoreadminbpcoreadminslugsphp"></a>
<div class="modfile"><h4 style="background-color: #eee; color: inherit; margin: 1em 0; padding: 1.3em; font-size: 115%">Modified: trunk/src/bp-core/admin/bp-core-admin-slugs.php</h4>
<pre class="diff"><span>
<span class="info" style="display: block; padding: 0 10px; color: #888">--- trunk/src/bp-core/admin/bp-core-admin-slugs.php 2015-12-02 19:49:54 UTC (rev 10385)
+++ trunk/src/bp-core/admin/bp-core-admin-slugs.php 2015-12-02 20:47:28 UTC (rev 10386)
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -13,7 +13,6 @@
</span><span class="cx" style="display: block; padding: 0 10px"> * Renders the page mapping admin panel.
</span><span class="cx" style="display: block; padding: 0 10px"> *
</span><span class="cx" style="display: block; padding: 0 10px"> * @since 1.6.0
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- *
</del><span class="cx" style="display: block; padding: 0 10px"> * @todo Use settings API
</span><span class="cx" style="display: block; padding: 0 10px"> * @uses bp_core_admin_component_options()
</span><span class="cx" style="display: block; padding: 0 10px"> */
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -40,20 +39,14 @@
</span><span class="cx" style="display: block; padding: 0 10px"> }
</span><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> /**
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- * Creates reusable markup for page setup on the Components and Pages dashboard panel.
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ * Generate a list of directory pages, for use when building Components panel markup.
</ins><span class="cx" style="display: block; padding: 0 10px"> *
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- * @since 1.6.0
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ * @since 2.4.1
</ins><span class="cx" style="display: block; padding: 0 10px"> *
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- * @todo Use settings API
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ * @return array
</ins><span class="cx" style="display: block; padding: 0 10px"> */
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">-function bp_core_admin_slugs_options() {
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+function bp_core_admin_get_directory_pages() {
</ins><span class="cx" style="display: block; padding: 0 10px"> $bp = buddypress();
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">-
- // Get the existing WP pages.
- $existing_pages = bp_core_get_directory_page_ids();
-
- // Set up an array of components (along with component names) that have
- // directory pages.
</del><span class="cx" style="display: block; padding: 0 10px"> $directory_pages = array();
</span><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> // Loop through loaded components and collect directories.
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -69,8 +62,7 @@
</span><span class="cx" style="display: block; padding: 0 10px"> }
</span><span class="cx" style="display: block; padding: 0 10px"> }
</span><span class="cx" style="display: block; padding: 0 10px">
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- /** Directory Display ****************************************************
- */
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ /** Directory Display *****************************************************/
</ins><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> /**
</span><span class="cx" style="display: block; padding: 0 10px"> * Filters the loaded components needing directory page association to a WordPress page.
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -79,8 +71,50 @@
</span><span class="cx" style="display: block; padding: 0 10px"> *
</span><span class="cx" style="display: block; padding: 0 10px"> * @param array $directory_pages Array of available components to set associations for.
</span><span class="cx" style="display: block; padding: 0 10px"> */
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- $directory_pages = apply_filters( 'bp_directory_pages', $directory_pages );
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ return apply_filters( 'bp_directory_pages', $directory_pages );
+}
</ins><span class="cx" style="display: block; padding: 0 10px">
</span><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+/**
+ * Generate a list of static pages, for use when building Components panel markup.
+ *
+ * By default, this list contains 'register' and 'activate'.
+ *
+ * @since 2.4.1
+ *
+ * @return array
+ */
+function bp_core_admin_get_static_pages() {
+ $static_pages = array(
+ 'register' => __( 'Register', 'buddypress' ),
+ 'activate' => __( 'Activate', 'buddypress' ),
+ );
+
+ /**
+ * Filters the default static pages for BuddyPress setup.
+ *
+ * @since 1.6.0
+ *
+ * @param array $static_pages Array of static default static pages.
+ */
+ return apply_filters( 'bp_static_pages', $static_pages );
+}
+
+/**
+ * Creates reusable markup for page setup on the Components and Pages dashboard panel.
+ *
+ * @package BuddyPress
+ * @since 1.6.0
+ * @todo Use settings API
+ */
+function bp_core_admin_slugs_options() {
+ $bp = buddypress();
+
+ // Get the existing WP pages
+ $existing_pages = bp_core_get_directory_page_ids();
+
+ // Set up an array of components (along with component names) that have directory pages.
+ $directory_pages = bp_core_admin_get_directory_pages();
+
</ins><span class="cx" style="display: block; padding: 0 10px"> if ( !empty( $directory_pages ) ) : ?>
</span><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> <h3><?php _e( 'Directories', 'buddypress' ); ?></h3>
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -140,24 +174,10 @@
</span><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> endif;
</span><span class="cx" style="display: block; padding: 0 10px">
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- /** Static Display *******************************************************
- */
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ /** Static Display ********************************************************/
</ins><span class="cx" style="display: block; padding: 0 10px">
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- // Static pages.
- $static_pages = array(
- 'register' => __( 'Register', 'buddypress' ),
- 'activate' => __( 'Activate', 'buddypress' ),
- );
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ $static_pages = bp_core_admin_get_static_pages();
</ins><span class="cx" style="display: block; padding: 0 10px">
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- /**
- * Filters the default static pages for BuddyPress setup.
- *
- * @since 1.6.0
- *
- * @param array $static_pages Array of static default static pages.
- */
- $static_pages = apply_filters( 'bp_static_pages', $static_pages );
-
</del><span class="cx" style="display: block; padding: 0 10px"> if ( !empty( $static_pages ) ) : ?>
</span><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> <h3><?php _e( 'Registration', 'buddypress' ); ?></h3>
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -218,7 +238,6 @@
</span><span class="cx" style="display: block; padding: 0 10px"> * Handle saving of the BuddyPress slugs.
</span><span class="cx" style="display: block; padding: 0 10px"> *
</span><span class="cx" style="display: block; padding: 0 10px"> * @since 1.6.0
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- *
</del><span class="cx" style="display: block; padding: 0 10px"> * @todo Use settings API
</span><span class="cx" style="display: block; padding: 0 10px"> */
</span><span class="cx" style="display: block; padding: 0 10px"> function bp_core_admin_slugs_setup_handler() {
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -229,15 +248,15 @@
</span><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> // Then, update the directory pages.
</span><span class="cx" style="display: block; padding: 0 10px"> if ( isset( $_POST['bp_pages'] ) ) {
</span><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ $valid_pages = array_merge( bp_core_admin_get_directory_pages(), bp_core_admin_get_static_pages() );
</ins><span class="cx" style="display: block; padding: 0 10px">
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- $directory_pages = array();
-
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ $new_directory_pages = array();
</ins><span class="cx" style="display: block; padding: 0 10px"> foreach ( (array) $_POST['bp_pages'] as $key => $value ) {
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- if ( !empty( $value ) ) {
- $directory_pages[$key] = (int) $value;
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ if ( isset( $valid_pages[ $key ] ) ) {
+ $new_directory_pages[ $key ] = (int) $value;
</ins><span class="cx" style="display: block; padding: 0 10px"> }
</span><span class="cx" style="display: block; padding: 0 10px"> }
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- bp_core_update_directory_page_ids( $directory_pages );
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ bp_core_update_directory_page_ids( $new_directory_pages );
</ins><span class="cx" style="display: block; padding: 0 10px"> }
</span><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> $base_url = bp_get_admin_url( add_query_arg( array( 'page' => 'bp-page-settings', 'updated' => 'true' ), 'admin.php' ) );
</span></span></pre></div>
<a id="trunksrcbpgroupsbpgroupsactionsphp"></a>
<div class="modfile"><h4 style="background-color: #eee; color: inherit; margin: 1em 0; padding: 1.3em; font-size: 115%">Modified: trunk/src/bp-groups/bp-groups-actions.php</h4>
<pre class="diff"><span>
<span class="info" style="display: block; padding: 0 10px; color: #888">--- trunk/src/bp-groups/bp-groups-actions.php 2015-12-02 19:49:54 UTC (rev 10385)
+++ trunk/src/bp-groups/bp-groups-actions.php 2015-12-02 20:47:28 UTC (rev 10386)
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -209,7 +209,7 @@
</span><span class="cx" style="display: block; padding: 0 10px"> if ( ! empty( $_POST['friends'] ) ) {
</span><span class="cx" style="display: block; padding: 0 10px"> foreach ( (array) $_POST['friends'] as $friend ) {
</span><span class="cx" style="display: block; padding: 0 10px"> groups_invite_user( array(
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- 'user_id' => $friend,
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ 'user_id' => (int) $friend,
</ins><span class="cx" style="display: block; padding: 0 10px"> 'group_id' => $bp->groups->new_group_id,
</span><span class="cx" style="display: block; padding: 0 10px"> ) );
</span><span class="cx" style="display: block; padding: 0 10px"> }
</span></span></pre></div>
<a id="trunksrcbpgroupsbpgroupsadminphp"></a>
<div class="modfile"><h4 style="background-color: #eee; color: inherit; margin: 1em 0; padding: 1.3em; font-size: 115%">Modified: trunk/src/bp-groups/bp-groups-admin.php</h4>
<pre class="diff"><span>
<span class="info" style="display: block; padding: 0 10px; color: #888">--- trunk/src/bp-groups/bp-groups-admin.php 2015-12-02 19:49:54 UTC (rev 10385)
+++ trunk/src/bp-groups/bp-groups-admin.php 2015-12-02 20:47:28 UTC (rev 10386)
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -310,10 +310,12 @@
</span><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> // Process only those users who have had their roles changed.
</span><span class="cx" style="display: block; padding: 0 10px"> foreach ( (array) $_POST['bp-groups-role'] as $user_id => $new_role ) {
</span><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ $user_id = (int) $user_id;
</ins><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> $existing_role = isset( $_POST['bp-groups-existing-role'][$user_id] ) ? $_POST['bp-groups-existing-role'][$user_id] : '';
</span><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> if ( $existing_role != $new_role ) {
</span><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ $result = false;
</ins><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> switch ( $new_role ) {
</span><span class="cx" style="display: block; padding: 0 10px"> case 'mod' :
</span></span></pre>
</div>
</div>
</body>
</html>