Changeset 9415

Timestamp:

01/29/2015 04:33:39 PM (10 years ago)

Author:

johnjamesjacoby

Message:

Use bp_sanitize_pagination_arg() in BP_Messages_Box_Template and include related tests. This prevents pagination values from being overridden outside of anticipated boundaries. See #5796.

Location:

trunk

Files:

• src/bp-messages/bp-messages-template.php (modified) (1 diff)
• tests/phpunit/testcases/messages/template.php (modified) (1 diff)

trunk/src/bp-messages/bp-messages-template.php

@@ -140 +140 @@
 
         $r = wp_parse_args( $args, array(
+            'page'         => 1,
+            'per_page'     => 10,
+            'page_arg'     => 'mpage',
+            'box'          => 'inbox',
+            'type'         => 'all',
             'user_id'      => bp_loggedin_user_id(),
-            'box'          => 'inbox',
-            'per_page'     => 10,
             'max'          => false,
-            'type'         => 'all',
             'search_terms' => '',
-            'page_arg'     => 'mpage',
             'meta_query'   => array(),
         ) );
 
-        $this->pag_page     = isset( $_GET[ $r['page_arg'] ] ) ? intval( $_GET[ $r['page_arg'] ] ) : 1;
-        $this->pag_num      = isset( $_GET['num']            ) ? intval( $_GET['num']            ) : $r['per_page'];
-
+        $this->pag_arg      = sanitize_key( $r['page_arg'] );
+        $this->pag_page     = bp_sanitize_pagination_arg( $this->pag_arg, $r['page']     );
+        $this->pag_num      = bp_sanitize_pagination_arg( 'num',          $r['per_page'] );
         $this->user_id      = $r['user_id'];
         $this->box          = $r['box'];

trunk/tests/phpunit/testcases/messages/template.php

@@ -258 +258 @@
         $this->assertEqualSets( array( $t1 ), wp_list_pluck( $messages_template->threads, 'thread_id' ) );
     }
+
+    /**
+     * @group BP_Messages_Box_Template
+     */
+    public function test_bp_messages_template_should_give_precedence_to_mpage_URL_param() {
+        $request = $_REQUEST;
+        $_REQUEST['mpage'] = '5';
+
+        $at = new BP_Messages_Box_Template( array(
+            'page' => 8,
+        ) );
+
+        $this->assertEquals( 5, $at->pag_page );
+
+        $_REQUEST = $request;
+    }
+
+    /**
+     * @group BP_Messages_Box_Template
+     */
+    public function test_bp_messages_template_should_reset_0_pag_page_URL_param_to_default_pag_page_value() {
+        $request = $_REQUEST;
+        $_REQUEST['mpage'] = '0';
+
+        $at = new BP_Messages_Box_Template( array(
+            'page' => 8,
+        ) );
+
+        $this->assertEquals( 8, $at->pag_page );
+
+        $_REQUEST = $request;
+    }
+
+    /**
+     * @group BP_Messages_Box_Template
+     */
+    public function test_bp_messages_template_should_give_precedence_to_num_URL_param() {
+        $request = $_REQUEST;
+        $_REQUEST['num'] = '14';
+
+        $at = new BP_Messages_Box_Template( array(
+            'per_page' => 13,
+        ) );
+
+        $this->assertEquals( 14, $at->pag_num );
+
+        $_REQUEST = $request;
+    }
+
+    /**
+     * @group BP_Messages_Box_Template
+     */
+    public function test_bp_messages_template_should_reset_0_pag_num_URL_param_to_default_pag_num_value() {
+        $request = $_REQUEST;
+        $_REQUEST['num'] = '0';
+
+        $at = new BP_Messages_Box_Template( array(
+            'per_page' => 13,
+        ) );
+
+        $this->assertEquals( 13, $at->pag_num );
+
+        $_REQUEST = $request;
+    }
 }