Changeset 7014 for branches/1.7/bp-themes/bp-default/_inc/ajax.php

Timestamp:

05/07/2013 11:42:23 PM (12 years ago)

Author:

boonebgorges

Message:

Audit of parameter sanitization in Groups and Core database classes

• Uses wp_parse_id_list() to sanitize parameters of integer arrays
• Implements a more consistent approach to LIKE clause sanitization

See #4989

Props johnjamesjacoby

File:

• branches/1.7/bp-themes/bp-default/_inc/ajax.php (modified) (1 diff)

branches/1.7/bp-themes/bp-default/_inc/ajax.php

@@ -125 +125 @@
     // If page and search_terms have been passed via the AJAX post request, use those.
     if ( ! empty( $_POST['page'] ) && '-1' != $_POST['page'] )
-        $qs[] = 'page=' . $_POST['page'];
+        $qs[] = 'page=' . absint( $_POST['page'] );
 
     $object_search_text = bp_get_search_default_text( $object );