Changeset 9682

Timestamp:

04/02/2015 12:53:02 AM (11 years ago)

Author:

johnjamesjacoby

Message:

XProfile: Validate default-visibility and allow-custom-visibility metadata before saving. See #6340.

File:

• trunk/src/bp-xprofile/bp-xprofile-admin.php (modified) (1 diff)

trunk/src/bp-xprofile/bp-xprofile-admin.php

@@ -363 +363 @@
                                 }
 
-                                if ( ! empty( $_POST['default-visibility'] ) ) {
+                                // Validate default visibility
+                                if ( ! empty( $_POST['default-visibility'] ) && in_array( $_POST['default-visibility'], wp_list_pluck( bp_xprofile_get_visibility_levels(), 'id' ) ) ) {
                                         bp_xprofile_update_field_meta( $field_id, 'default_visibility', $_POST['default-visibility'] );
                                 }
 
-                                if ( ! empty( $_POST['allow-custom-visibility'] ) ) {
+                                // Validate custom visibility
+                                if ( ! empty( $_POST['allow-custom-visibility'] ) && in_array( $_POST['allow-custom-visibility'], array( 'allowed', 'disallowed' ) ) ) {
                                         bp_xprofile_update_field_meta( $field_id, 'allow_custom_visibility', $_POST['allow-custom-visibility'] );
                                 }