Changeset 9413 for trunk/src/bp-blogs/bp-blogs-template.php

Timestamp:

01/29/2015 04:24:36 PM (12 years ago)

Author:

johnjamesjacoby

Message:

Use bp_sanitize_pagination_arg() in BP_Blogs_Template and include related (multisite only) tests. This prevents pagination values from being overridden outside of anticipated boundaries. See #5796.

File:

• trunk/src/bp-blogs/bp-blogs-template.php (modified) (2 diffs)

trunk/src/bp-blogs/bp-blogs-template.php

@@ -200 +200 @@
         public function __construct( $type, $page, $per_page, $max, $user_id, $search_terms, $page_arg = 'bpage', $update_meta_cache = true, $include_blog_ids = false ) {
 
-                $this->pag_page = isset( $_REQUEST[ $page_arg ] ) ? intval( $_REQUEST[ $page_arg ] ) : $page;
-                $this->pag_num  = isset( $_REQUEST['num']       ) ? intval( $_REQUEST['num']       ) : $per_page;
+                $this->pag_arg  = sanitize_key( $page_arg );
+                $this->pag_page = bp_sanitize_pagination_arg( $this->pag_arg, $page     );
+                $this->pag_num  = bp_sanitize_pagination_arg( 'num',          $per_page );
 
                 // Backwards compatibility support for blogs by first letter
@@ -243 +244 @@
                 if ( ! empty( $this->total_blog_count ) && ! empty( $this->pag_num ) ) {
                         $this->pag_links = paginate_links( array(
-                                'base'      => add_query_arg( $page_arg, '%#%' ),
+                                'base'      => add_query_arg( $this->pag_arg, '%#%' ),
                                 'format'    => '',
                                 'total'     => ceil( (int) $this->total_blog_count / (int) $this->pag_num ),