Skip to:
Content

BuddyPress.org


Ignore:
Timestamp:
03/14/2014 12:07:18 AM (10 years ago)
Author:
boonebgorges
Message:

Don't improperly sanitize meta_key in _meta() functions

Many BP meta functions have always stripped certain characters from the
$meta_key parameter before performing their operations. This is a terrible idea
on a number of levels: it doesn't provide any feedback to the user, it silently
performs actions that are not equivalent to the ones intended by the user, and
it doesn't serve any real purpose (since any necessary sanitization happens at
the level of $wpdb). Moreover, it wasn't even applied consistently across all
functions. A truly delightful grab bag.

This changeset removes the sanitization, and updates the necessary unit tests
to reflect the change.

See #5399

File:
1 edited

Legend:

Unmodified
Added
Removed
  • trunk/bp-activity/bp-activity-functions.php

    r8126 r8129  
    577577    }
    578578
    579     // Legacy - Sanitize key
    580     $meta_key = preg_replace( '|[^a-z0-9_]|i', '', $meta_key );
    581 
    582579    // Legacy - Trim off whitespace
    583580    $meta_value = trim( $meta_value );
     
    627624        return false;
    628625    }
    629 
    630     // Legacy - Sanitize keys
    631     $meta_key = preg_replace( '|[^a-z0-9_]|i', '', $meta_key );
    632626
    633627    add_filter( 'query', 'bp_filter_metaid_column_name' );
     
    684678        return false;
    685679    }
    686 
    687     // Legacy - Sanitize key
    688     $meta_key = preg_replace( '|[^a-z0-9_]|i', '', $meta_key );
    689680
    690681    add_filter( 'query', 'bp_filter_metaid_column_name' );
Note: See TracChangeset for help on using the changeset viewer.