Changeset 9681

Timestamp:

04/02/2015 12:51:51 AM (11 years ago)

Author:

johnjamesjacoby

Message:

XProfile: Move field save() sanitization into filters for consistency between save method & saving via the admin UI. See #6340.

Location:

trunk/src/bp-xprofile

Files:

• bp-xprofile-admin.php (modified) (3 diffs)
• bp-xprofile-filters.php (modified) (1 diff)

trunk/src/bp-xprofile/bp-xprofile-admin.php

@@ -327 +327 @@
         if ( isset( $_POST['saveField'] ) ) {
                 if ( BP_XProfile_Field::admin_validate() ) {
-                        $field->name        = wp_filter_kses( $_POST['title'] );
-                        $field->description = !empty( $_POST['description'] ) ? wp_filter_kses( $_POST['description'] ) : '';
-                        $field->is_required = wp_filter_kses( $_POST['required'] );
-                        $field->type        = wp_filter_kses( $_POST['fieldtype'] );
-
-                        if ( !empty( $_POST["sort_order_{$field->type}"] ) ) {
-                                $field->order_by = wp_filter_kses( $_POST["sort_order_{$field->type}"] );
+                        $field->is_required = $_POST['required'];
+                        $field->type        = $_POST['fieldtype'];
+                        $field->name        = $_POST['title'];
+
+                        if ( ! empty( $_POST['description'] ) ) {
+                                $field->description = $_POST['description'];
+                        } else {
+                                $field->description = '';
+                        }
+
+                        if ( ! empty( $_POST["sort_order_{$field->type}"] ) ) {
+                                $field->order_by = $_POST["sort_order_{$field->type}"];
                         }
 
                         $field->field_order = $wpdb->get_var( $wpdb->prepare( "SELECT field_order FROM {$bp->profile->table_name_fields} WHERE id = %d", $field_id ) );
-
-                        if ( !$field->field_order ) {
+                        if ( empty( $field->field_order ) || is_wp_error( $field->field_order ) ) {
                                 $field->field_order = (int) $wpdb->get_var( $wpdb->prepare( "SELECT max(field_order) FROM {$bp->profile->table_name_fields} WHERE group_id = %d", $group_id ) );
                                 $field->field_order++;
                         }
 
-                        // For new profile fields, set the $field_id. For existing profile fields,
-                        // this will overwrite $field_id with the same value.
+                        // For new profile fields, set the $field_id. For existing profile
+                        // fields, this will overwrite $field_id with the same value.
                         $field_id = $field->save();
 
-                        if ( !$field_id ) {
+                        if ( empty( $field_id ) ) {
                                 $message = __( 'There was an error saving the field. Please try again.', 'buddypress' );
-                                $type = 'error';
-
-                                unset( $_GET['mode'] );
-
-                                xprofile_admin( $message, $type );
+                                $type    = 'error';
                         } else {
                                 $message = __( 'The field was saved successfully.', 'buddypress' );
-                                $type = 'success';
-
+                                $type    = 'success';
+
+                                // @todo remove these old options
                                 if ( 1 == $field_id ) {
                                         bp_update_option( 'bp-xprofile-fullname-field-name', $field->name );
                                 }
 
-                                if ( !empty( $_POST['default-visibility'] ) ) {
+                                if ( ! empty( $_POST['default-visibility'] ) ) {
                                         bp_xprofile_update_field_meta( $field_id, 'default_visibility', $_POST['default-visibility'] );
                                 }
 
-                                if ( !empty( $_POST['allow-custom-visibility'] ) ) {
+                                if ( ! empty( $_POST['allow-custom-visibility'] ) ) {
                                         bp_xprofile_update_field_meta( $field_id, 'allow_custom_visibility', $_POST['allow-custom-visibility'] );
                                 }
-
-                                unset( $_GET['mode'] );
 
                                 /**
@@ -382 +381 @@
 
                                 $groups = bp_xprofile_get_groups();
-                                xprofile_admin( $message, $type );
-                        }
+                        }
+
+                        unset( $_GET['mode'] );
+
+                        xprofile_admin( $message, $type );
+
                 } else {
                         $field->render_admin_form( $message );
@@ -818 +821 @@
                         foreach ( (array) $posted_field_ids as $field_id ) {
 
-                                // Certain types of fields (checkboxes, multiselects) may come through empty. Save them as an empty array so that they don't get overwritten by the default on the next edit.
+                                // Certain types of fields (checkboxes, multiselects) may come
+                                // through empty. Save them as an empty array so that they don't
+                                // get overwritten by the default on the next edit.
                                 $value = isset( $_POST['field_' . $field_id] ) ? $_POST['field_' . $field_id] : '';
 

trunk/src/bp-xprofile/bp-xprofile-filters.php

@@ -56 +56 @@
 add_filter( 'xprofile_filtered_data_value_before_save', 'trim', 2 );
 
-// Save filters
+// Save field groups
 add_filter( 'xprofile_group_name_before_save',        'wp_filter_kses' );
 add_filter( 'xprofile_group_description_before_save', 'wp_filter_kses' );
+
+// Save fields
+add_filter( 'xprofile_field_name_before_save',         'wp_filter_kses' );
+add_filter( 'xprofile_field_type_before_save',         'wp_filter_kses' );
+add_filter( 'xprofile_field_description_before_save',  'wp_filter_kses' );
+add_filter( 'xprofile_field_order_by_before_save',     'wp_filter_kses' );
+add_filter( 'xprofile_field_is_required_before_save',  'absint' );
+add_filter( 'xprofile_field_field_order_before_save',  'absint' );
+add_filter( 'xprofile_field_option_order_before_save', 'absint' );
+add_filter( 'xprofile_field_can_delete_before_save',   'absint' );
 
 /**