Changeset 9711 for trunk/src/bp-xprofile/bp-xprofile-functions.php

Timestamp:

04/07/2015 12:54:07 AM (10 years ago)

Author:

boonebgorges

Message:

Improve parameter sanitization in xprofile_insert_field().

The overzealous empty() checks meant that it was impossible to set certain
values on existing fields to falsey values.

Fixes #6354.

File:

• trunk/src/bp-xprofile/bp-xprofile-functions.php (modified) (3 diffs)

trunk/src/bp-xprofile/bp-xprofile-functions.php

@@ -231 +231 @@
         'is_default_option' => false,
         'option_order' => null,
+        'field_order' => null,
     ) );
 
@@ -238 +239 @@
     }
 
-    // Check this is a valid field type
+    // Check this is a non-empty, valid field type.
     if ( ! in_array( $r['type'], (array) buddypress()->profile->field_types ) ) {
         return false;
@@ -251 +252 @@
 
     $field->group_id = $r['field_group_id'];
-
-    if ( ! empty( $r['parent_id'] ) ) {
-        $field->parent_id = $r['parent_id'];
-    }
-
-    if ( ! empty( $r['type'] ) ) {
-        $field->type = $r['type'];
-    }
-
+    $field->type     = $r['type'];
+
+    // The 'name' field cannot be empty.
     if ( ! empty( $r['name'] ) ) {
         $field->name = $r['name'];
     }
 
-    if ( ! empty( $r['description'] ) ) {
-        $field->description = $r['description'];
-    }
-
-    if ( ! empty( $r['is_required'] ) ) {
-        $field->is_required = $r['is_required'];
-    }
-
-    if ( ! empty( $r['can_delete'] ) ) {
-        $field->can_delete = $r['can_delete'];
-    }
-
-    if ( ! empty( $r['field_order'] ) ) {
-        $field->field_order = $r['field_order'];
-    }
-
-    if ( ! empty( $r['order_by'] ) ) {
-        $field->order_by = $r['order_by'];
-    }
-
+    $field->description       = $r['description'];
+    $field->order_by          = $r['order_by'];
+    $field->parent_id         = (int) $r['parent_id'];
+    $field->field_order       = (int) $r['field_order'];
+    $field->option_order      = (int) $r['option_order'];
+    $field->is_required       = (bool) $r['is_required'];
+    $field->can_delete        = (bool) $r['can_delete'];
     $field->is_default_option = (bool) $r['is_default_option'];
-
-    if ( ! empty( $r['option_order'] ) ) {
-        $field->option_order = $r['option_order'];
-    }
 
     return $field->save();