Changeset 12324 for trunk/src/bp-blogs/classes/class-bp-blogs-recent-posts-widget.php

Timestamp:

01/11/2019 02:37:16 AM (6 years ago)

Author:

boonebgorges

Message:

Widgets: Place an upper bound on item counts in widget forms.

This prevents widgets from triggering performance problems when initialized
with unreasonably high max item counts.

Use the bp_get_widget_max_count_limit filter to increase the default
ceiling of 50.

Fixes #8036.

File:

• trunk/src/bp-blogs/classes/class-bp-blogs-recent-posts-widget.php (modified) (4 diffs)

trunk/src/bp-blogs/classes/class-bp-blogs-recent-posts-widget.php

@@ -62 +62 @@
         echo $args['before_title'] . $title . $args['after_title'];
 
-        if ( empty( $instance['max_posts'] ) || empty( $instance['max_posts'] ) ) {
+        $max_limit = bp_get_widget_max_count_limit( __CLASS__ );
+        if ( empty( $instance['max_posts'] ) || $instance['max_posts'] > $max_limit ) {
             $instance['max_posts'] = 10;
         }
@@ -129 +130 @@
      */
     public function update( $new_instance, $old_instance ) {
-        $instance               = $old_instance;
+        $instance = $old_instance;
+
+        $max_limit = bp_get_widget_max_count_limit( __CLASS__ );
+
         $instance['title']      = strip_tags( $new_instance['title'] );
-        $instance['max_posts']  = strip_tags( $new_instance['max_posts'] );
+        $instance['max_posts']  = $new_instance['max_posts'] > $max_limit ? $max_limit : intval( $new_instance['max_posts'] );
         $instance['link_title'] = ! empty( $new_instance['link_title'] );
 
@@ -151 +155 @@
         ) );
 
+        $max_limit = bp_get_widget_max_count_limit( __CLASS__ );
+
         $title      = strip_tags( $instance['title'] );
-        $max_posts  = strip_tags( $instance['max_posts'] );
+        $max_posts  = $instance['max_posts'] > $max_limit ? $max_limit : intval( $instance['max_posts'] );
         $link_title = (bool) $instance['link_title'];
 
@@ -159 +165 @@
         <p><label for="<?php echo $this->get_field_id( 'title' ); ?>"><?php _ex( 'Title:', 'Label for the Title field of the Recent Networkwide Posts widget', 'buddypress' ); ?> <input class="widefat" id="<?php echo $this->get_field_id( 'title' ); ?>" name="<?php echo $this->get_field_name( 'title' ); ?>" type="text" value="<?php echo esc_attr( $title ); ?>" style="width: 100%;" /></label></p>
         <p><label for="<?php echo $this->get_field_id( 'link_title' ); ?>"><input type="checkbox" name="<?php echo $this->get_field_name( 'link_title' ); ?>" value="1" <?php checked( $link_title ); ?> /> <?php _e( 'Link widget title to Blogs directory', 'buddypress' ); ?></label></p>
-        <p><label for="<?php echo $this->get_field_id( 'max_posts' ); ?>"><?php _e( 'Max posts to show:', 'buddypress' ); ?> <input class="widefat" id="<?php echo $this->get_field_id( 'max_posts' ); ?>" name="<?php echo $this->get_field_name( 'max_posts' ); ?>" type="text" value="<?php echo esc_attr( $max_posts ); ?>" style="width: 30%" /></label></p>
+        <p><label for="<?php echo $this->get_field_id( 'max_posts' ); ?>"><?php _e( 'Max posts to show:', 'buddypress' ); ?> <input class="widefat" id="<?php echo $this->get_field_id( 'max_posts' ); ?>" name="<?php echo $this->get_field_name( 'max_posts' ); ?>" type="number" min="1" max="<?php echo esc_attr( $max_limit ); ?>" value="<?php echo esc_attr( $max_posts ); ?>" style="width: 30%" /></label></p>
         <?php
     }