Changeset 9413

Timestamp:

01/29/2015 04:24:36 PM (10 years ago)

Author:

johnjamesjacoby

Message:

Use bp_sanitize_pagination_arg() in BP_Blogs_Template and include related (multisite only) tests. This prevents pagination values from being overridden outside of anticipated boundaries. See #5796.

Location:

trunk

Files:

• src/bp-blogs/bp-blogs-template.php (modified) (2 diffs)
• tests/phpunit/testcases/blogs/template.php (modified) (1 diff)

trunk/src/bp-blogs/bp-blogs-template.php

@@ -200 +200 @@
     public function __construct( $type, $page, $per_page, $max, $user_id, $search_terms, $page_arg = 'bpage', $update_meta_cache = true, $include_blog_ids = false ) {
 
-        $this->pag_page = isset( $_REQUEST[ $page_arg ] ) ? intval( $_REQUEST[ $page_arg ] ) : $page;
-        $this->pag_num  = isset( $_REQUEST['num']       ) ? intval( $_REQUEST['num']       ) : $per_page;
+        $this->pag_arg  = sanitize_key( $page_arg );
+        $this->pag_page = bp_sanitize_pagination_arg( $this->pag_arg, $page     );
+        $this->pag_num  = bp_sanitize_pagination_arg( 'num',          $per_page );
 
         // Backwards compatibility support for blogs by first letter
@@ -243 +244 @@
         if ( ! empty( $this->total_blog_count ) && ! empty( $this->pag_num ) ) {
             $this->pag_links = paginate_links( array(
-                'base'      => add_query_arg( $page_arg, '%#%' ),
+                'base'      => add_query_arg( $this->pag_arg, '%#%' ),
                 'format'    => '',
                 'total'     => ceil( (int) $this->total_blog_count / (int) $this->pag_num ),

trunk/tests/phpunit/testcases/blogs/template.php

@@ -203 +203 @@
         buddypress()->site_options = $old_settings;
     }
+
+    /**
+     * @group BP_Blogs_Template
+     */
+    public function test_bp_blogs_template_should_give_precedence_to_bpage_URL_param() {
+        if ( ! is_multisite() ) {
+            return;
+        }
+
+        $request = $_REQUEST;
+        $_REQUEST['bpage'] = '5';
+
+        $r = array(
+            'type'              => 'active',
+            'page_arg'          => 'bpage',
+            'page'              => 8,
+            'per_page'          => 20,
+            'max'               => false,
+            'user_id'           => 0,
+            'include_blog_ids'  => false,
+            'search_terms'      => '',
+            'update_meta_cache' => true
+        );
+
+        $at = new BP_Blogs_Template(
+            $r['type'],
+            $r['page'],
+            $r['per_page'],
+            $r['max'],
+            $r['user_id'],
+            $r['search_terms'],
+            $r['page_arg'],
+            $r['update_meta_cache'],
+            $r['include_blog_ids']
+        );
+
+        $this->assertEquals( 5, $at->pag_page );
+
+        $_REQUEST = $request;
+    }
+
+    /**
+     * @group BP_Blogs_Template
+     */
+    public function test_bp_blogs_template_should_reset_0_pag_page_URL_param_to_default_pag_page_value() {
+        if ( ! is_multisite() ) {
+            return;
+        }
+
+        $request = $_REQUEST;
+        $_REQUEST['bpage'] = '0';
+
+        $r = array(
+            'type'              => 'active',
+            'page_arg'          => 'bpage',
+            'page'              => 8,
+            'per_page'          => 20,
+            'max'               => false,
+            'user_id'           => 0,
+            'include_blog_ids'  => false,
+            'search_terms'      => '',
+            'update_meta_cache' => true
+        );
+
+        $at = new BP_Blogs_Template(
+            $r['type'],
+            $r['page'],
+            $r['per_page'],
+            $r['max'],
+            $r['user_id'],
+            $r['search_terms'],
+            $r['page_arg'],
+            $r['update_meta_cache'],
+            $r['include_blog_ids']
+        );
+
+        $this->assertEquals( 8, $at->pag_page );
+
+        $_REQUEST = $request;
+    }
+
+    /**
+     * @group BP_Blogs_Template
+     */
+    public function test_bp_blogs_template_should_give_precedence_to_num_URL_param() {
+        if ( ! is_multisite() ) {
+            return;
+        }
+
+        $request = $_REQUEST;
+        $_REQUEST['num'] = '14';
+
+        $r = array(
+            'type'              => 'active',
+            'page_arg'          => 'bpage',
+            'page'              => 1,
+            'per_page'          => 13,
+            'max'               => false,
+            'user_id'           => 0,
+            'include_blog_ids'  => false,
+            'search_terms'      => '',
+            'update_meta_cache' => true
+        );
+
+        $at = new BP_Blogs_Template(
+            $r['type'],
+            $r['page'],
+            $r['per_page'],
+            $r['max'],
+            $r['user_id'],
+            $r['search_terms'],
+            $r['page_arg'],
+            $r['update_meta_cache'],
+            $r['include_blog_ids']
+        );
+
+        $this->assertEquals( 14, $at->pag_num );
+
+        $_REQUEST = $request;
+    }
+
+    /**
+     * @group BP_Blogs_Template
+     */
+    public function test_bp_blogs_template_should_reset_0_pag_num_URL_param_to_default_pag_num_value() {
+        if ( ! is_multisite() ) {
+            return;
+        }
+
+        $request = $_REQUEST;
+        $_REQUEST['num'] = '0';
+
+        $r = array(
+            'type'              => 'active',
+            'page_arg'          => 'bpage',
+            'page'              => 1,
+            'per_page'          => 13,
+            'max'               => false,
+            'user_id'           => 0,
+            'include_blog_ids'  => false,
+            'search_terms'      => '',
+            'update_meta_cache' => true
+        );
+
+        $at = new BP_Blogs_Template(
+            $r['type'],
+            $r['page'],
+            $r['per_page'],
+            $r['max'],
+            $r['user_id'],
+            $r['search_terms'],
+            $r['page_arg'],
+            $r['update_meta_cache'],
+            $r['include_blog_ids']
+        );
+
+        $this->assertEquals( 13, $at->pag_num );
+
+        $_REQUEST = $request;
+    }
 }