Changeset 8129 for trunk/bp-blogs/bp-blogs-functions.php

Timestamp:

03/14/2014 12:07:18 AM (11 years ago)

Author:

boonebgorges

Message:

Don't improperly sanitize meta_key in _meta() functions

Many BP meta functions have always stripped certain characters from the
$meta_key parameter before performing their operations. This is a terrible idea
on a number of levels: it doesn't provide any feedback to the user, it silently
performs actions that are not equivalent to the ones intended by the user, and
it doesn't serve any real purpose (since any necessary sanitization happens at
the level of $wpdb). Moreover, it wasn't even applied consistently across all
functions. A truly delightful grab bag.

This changeset removes the sanitization, and updates the necessary unit tests
to reflect the change.

See #5399

File:

• trunk/bp-blogs/bp-blogs-functions.php (modified) (3 diffs)

trunk/bp-blogs/bp-blogs-functions.php

@@ -854 +854 @@
     }
 
-    // Legacy - sanitize meta_key
-    $meta_key = preg_replace( '|[^a-z0-9_]|i', '', $meta_key );
-
     // Legacy - if no meta_key is passed, delete all for the blog_id
     if ( empty( $meta_key ) ) {
@@ -898 +895 @@
 function bp_blogs_get_blogmeta( $blog_id, $meta_key = '', $single = true ) {
 
-    // Legacy - Sanitize meta_key
-    $meta_key = preg_replace('|[^a-z0-9_]|i', '', $meta_key);
-
     add_filter( 'query', 'bp_filter_metaid_column_name' );
     $retval = get_metadata( 'blog', $blog_id, $meta_key, $single );
@@ -934 +928 @@
 function bp_blogs_update_blogmeta( $blog_id, $meta_key, $meta_value, $prev_value = '' ) {
 
-    // Legacy - Sanitize meta_key
-    $meta_key = preg_replace( '|[^a-z0-9_]|i', '', $meta_key );
-
     add_filter( 'query', 'bp_filter_metaid_column_name' );
     $retval = update_metadata( 'blog', $blog_id, $meta_key, $meta_value, $prev_value );