Changeset 9678

Timestamp:

04/02/2015 12:15:18 AM (10 years ago)

Author:

johnjamesjacoby

Message:

XProfile: Move field-group name & description save() sanitization into filters for consistency between save method & saving via the admin UI. See #6340.

Location:

trunk/src/bp-xprofile

Files:

• bp-xprofile-admin.php (modified) (1 diff)
• bp-xprofile-filters.php (modified) (1 diff)
• classes/class-bp-xprofile-group.php (modified) (1 diff)

trunk/src/bp-xprofile/bp-xprofile-admin.php

@@ -230 +230 @@
     global $message, $type;
 
+    // Get the field group
     $group = new BP_XProfile_Group( $group_id );
 
+    // Updating
     if ( isset( $_POST['save_group'] ) ) {
-        if ( BP_XProfile_Group::admin_validate( $_POST ) ) {
-            $group->name        = wp_filter_kses( $_POST['group_name'] );
-            $group->description = !empty( $_POST['group_description'] ) ? wp_filter_kses( $_POST['group_description'] ) : '';
-
-            if ( !$group->save() ) {
+
+        // Validate $_POSTed data
+        if ( BP_XProfile_Group::admin_validate() ) {
+
+            // Set the group name
+            $group->name = $_POST['group_name'];
+
+            // Set the group description
+            if ( ! empty( $_POST['group_description'] ) ) {
+                $group->description = $_POST['group_description'];
+            } else {
+                $group->description = '';
+            }
+
+            // Attempt to save the field group
+            if ( false === $group->save() ) {
                 $message = __( 'There was an error saving the group. Please try again.', 'buddypress' );
                 $type    = 'error';
+
+            // Save successful
             } else {
                 $message = __( 'The group was saved successfully.', 'buddypress' );
                 $type    = 'success';
 
+                // @todo remove these old options
                 if ( 1 == $group_id ) {
                     bp_update_option( 'bp-xprofile-base-group-name', $group->name );

trunk/src/bp-xprofile/bp-xprofile-filters.php

@@ -56 +56 @@
 add_filter( 'xprofile_filtered_data_value_before_save', 'trim', 2 );
 
+// Save filters
+add_filter( 'xprofile_group_name_before_save',        'wp_filter_kses' );
+add_filter( 'xprofile_group_description_before_save', 'wp_filter_kses' );
+
 /**
  * xprofile_filter_kses ( $content )

trunk/src/bp-xprofile/classes/class-bp-xprofile-group.php

@@ -114 +114 @@
         global $wpdb;
 
+        // Filter the field group attributes
         $this->name        = apply_filters( 'xprofile_group_name_before_save',        $this->name,        $this->id );
         $this->description = apply_filters( 'xprofile_group_description_before_save', $this->description, $this->id );