Changeset 9411

Timestamp:

01/29/2015 03:40:09 PM (11 years ago)

Author:

johnjamesjacoby

Message:

Use bp_sanitize_pagination_arg() in BP_Activity_Template and include related tests. This prevents pagination values from being overridden outside of anticipated boundaries. Props boonebgorges. See #5796.

Location:

trunk

Files:

• src/bp-activity/bp-activity-template.php (modified) (1 diff)
• tests/phpunit/testcases/activity/template.php (modified) (1 diff)

trunk/src/bp-activity/bp-activity-template.php

@@ -215 +215 @@
         extract( $r );
 
-        $this->pag_arg  = $r['page_arg'];
-        $this->pag_page = isset( $_REQUEST[ $this->pag_arg ] ) ? intval( $_REQUEST[ $this->pag_arg ] ) : $page;
-        $this->pag_num  = isset( $_REQUEST['num'] ) ? intval( $_REQUEST['num'] ) : $per_page;
+        $this->pag_arg  = sanitize_key( $r['page_arg'] );
+        $this->pag_page = bp_sanitize_pagination_arg( $this->pag_arg, $r['page']     );
+        $this->pag_num  = bp_sanitize_pagination_arg( 'num',          $r['per_page'] );
 
         // Check if blog/forum replies are disabled

trunk/tests/phpunit/testcases/activity/template.php

@@ -1398 +1398 @@
         $this->assertEquals( $ids, array( $a1 ) );
     }
+
+    /**
+     * @group BP_Activity_Template
+     */
+    public function test_bp_activity_template_should_give_precedence_to_acpage_URL_param() {
+        $request = $_REQUEST;
+        $_REQUEST['acpage'] = '5';
+
+        $at = new BP_Activity_Template( array(
+            'page' => 8,
+        ) );
+
+        $this->assertEquals( 5, $at->pag_page );
+
+        $_REQUEST = $request;
+    }
+
+    /**
+     * @group BP_Activity_Template
+     */
+    public function test_bp_activity_template_should_reset_0_pag_page_URL_param_to_default_pag_page_value() {
+        $request = $_REQUEST;
+        $_REQUEST['acpage'] = '0';
+
+        $at = new BP_Activity_Template( array(
+            'page' => 8,
+        ) );
+
+        $this->assertEquals( 8, $at->pag_page );
+
+        $_REQUEST = $request;
+    }
+
+    /**
+     * @group BP_Activity_Template
+     */
+    public function test_bp_activity_template_should_give_precedence_to_num_URL_param() {
+        $request = $_REQUEST;
+        $_REQUEST['num'] = '14';
+
+        $at = new BP_Activity_Template( array(
+            'per_page' => 13,
+        ) );
+
+        $this->assertEquals( 14, $at->pag_num );
+
+        $_REQUEST = $request;
+    }
+
+    /**
+     * @group BP_Activity_Template
+     */
+    public function test_bp_activity_template_should_reset_0_pag_num_URL_param_to_default_pag_num_value() {
+        $request = $_REQUEST;
+        $_REQUEST['num'] = '0';
+
+        $at = new BP_Activity_Template( array(
+            'per_page' => 13,
+        ) );
+
+        $this->assertEquals( 13, $at->pag_num );
+
+        $_REQUEST = $request;
+    }
 }