Changeset 2359

Timestamp:

01/19/2010 03:34:06 PM (15 years ago)

Author:

apeatling

Message:

Fixes #1591 - accessing non-existent profile field groups.

Location:

trunk

Files:

• bp-xprofile.php (modified) (2 diffs)
• bp-xprofile/bp-xprofile-classes.php (modified) (2 diffs)

trunk/bp-xprofile.php

@@ -276 +276 @@
     global $bp;
 
-    if ( !bp_is_home() && !is_site_admin() )
-        return false;
+    if ( !bp_is_my_profile() && !is_site_admin() )
+        return false;
+
+    /* Make sure a group is set. */
+    if ( empty( $bp->action_variables[1] ) )
+        bp_core_redirect( $bp->displayed_user->domain . BP_XPROFILE_SLUG . '/edit/group/1' );
+
+    /* Check the field group exists */
+    if ( !xprofile_get_field_group( $bp->action_variables[1] ) )
+        bp_core_redirect( $bp->root_domain );
 
     /* Check to see if any new information has been submitted */
-    if ( isset($_POST['field_ids']) ) {
+    if ( isset( $_POST['field_ids'] ) ) {
 
         /* Check the nonce */
@@ -556 +564 @@
 
 function xprofile_get_field_group( $field_group_id ) {
-    return new BP_XProfile_Group( $field_group_id );
+    $field_group = new BP_XProfile_Group( $field_group_id );
+
+    if ( empty( $field_group->id ) )
+        return false;
+
+    return $field_group;
 }
 

trunk/bp-xprofile/bp-xprofile-classes.php

@@ -12 +12 @@
 
         if ( $id ) {
-            $this->populate($id);
+            $this->populate( $id );
         }
     }
@@ -19 +19 @@
         global $wpdb, $bp;
 
-        $sql = $wpdb->prepare("SELECT * FROM {$bp->profile->table_name_groups} WHERE id = %d", $id);
-
-        if ( $group = $wpdb->get_row($sql) ) {
-            $this->id = $group->id;
-            $this->name = $group->name;
-            $this->description = $group->description;
-            $this->can_delete = $group->can_delete;
-        }
-
+        $sql = $wpdb->prepare( "SELECT * FROM {$bp->profile->table_name_groups} WHERE id = %d", $id );
+
+        if ( !$group = $wpdb->get_row($sql) )
+            return false;
+
+        $this->id = $group->id;
+        $this->name = $group->name;
+        $this->description = $group->description;
+        $this->can_delete = $group->can_delete;
     }