Changeset 9414 for trunk/src/bp-notifications/bp-notifications-template.php

Timestamp:

01/29/2015 04:30:16 PM (10 years ago)

Author:

johnjamesjacoby

Message:

Use bp_sanitize_pagination_arg() in BP_Notifications_Template and include related tests. This prevents pagination values from being overridden outside of anticipated boundaries. See #5796.

File:

• trunk/src/bp-notifications/bp-notifications-template.php (modified) (3 diffs)

trunk/src/bp-notifications/bp-notifications-template.php

@@ -283 +283 @@
         // Overrides
 
-        // Set which pagination page
-        if ( isset( $_GET[ $r['page_arg'] ] ) ) {
-            $r['page'] = intval( $_GET[ $r['page_arg'] ] );
-        }
-
-        // Set the number to show per page
-        if ( isset( $_GET['num'] ) ) {
-            $r['per_page'] = intval( $_GET['num'] );
-        } else {
-            $r['per_page'] = intval( $r['per_page'] );
-        }
-
         // Sort order direction
         $orders = array( 'ASC', 'DESC' );
@@ -304 +292 @@
 
         // Setup variables
-        $this->pag_page     = $r['page'];
-        $this->pag_num      = $r['per_page'];
+        $this->pag_arg      = sanitize_key( $r['page_arg'] );
+        $this->pag_page     = bp_sanitize_pagination_arg( $this->pag_arg, $r['page']     );
+        $this->pag_num      = bp_sanitize_pagination_arg( 'num',          $r['per_page'] );
         $this->user_id      = $r['user_id'];
         $this->is_new       = $r['is_new'];
         $this->search_terms = $r['search_terms'];
-        $this->page_arg     = $r['page_arg'];
         $this->order_by     = $r['order_by'];
         $this->sort_order   = $r['sort_order'];
@@ -339 +327 @@
 
             $this->pag_links = paginate_links( array(
-                'base'      => add_query_arg( $this->page_arg, '%#%' ),
+                'base'      => add_query_arg( $this->pag_arg, '%#%' ),
                 'format'    => '',
                 'total'     => ceil( (int) $this->total_notification_count / (int) $this->pag_num ),