Changeset 14108

Timestamp:

03/20/2025 07:10:31 PM (3 months ago)

Author:

dcavins

Message:

Improve security of status update messages (14.0 branch).

• Only allow logged-in users to see status messages. (These messages are like "Group successfully created," so only apply to logged-in users.)
• When re-loading message content from the user's cookies, don't allow shortcodes to be included.

Many thanks to mikemyers for responsibly reporting the issue.

Props emaralive.

File:

• branches/12.0/src/bp-core/bp-core-functions.php (modified) (2 diffs)

branches/12.0/src/bp-core/bp-core-functions.php

@@ -1673 +1673 @@
  */
 function bp_core_setup_message() {
+    if ( ! is_user_logged_in() ) {
+        return;
+    }
 
     // Get BuddyPress.
@@ -1678 +1681 @@
 
     if ( empty( $bp->template_message ) && isset( $_COOKIE['bp-message'] ) ) {
-        $bp->template_message = stripslashes( $_COOKIE['bp-message'] );
+        $bp->template_message = strip_shortcodes( stripslashes( $_COOKIE['bp-message'] ) );
     }