Changeset 9711 for trunk/src/bp-xprofile/bp-xprofile-functions.php

Timestamp:

04/07/2015 12:54:07 AM (11 years ago)

Author:

boonebgorges

Message:

Improve parameter sanitization in xprofile_insert_field().

The overzealous empty() checks meant that it was impossible to set certain
values on existing fields to falsey values.

Fixes #6354.

File:

• trunk/src/bp-xprofile/bp-xprofile-functions.php (modified) (3 diffs)

trunk/src/bp-xprofile/bp-xprofile-functions.php

@@ -231 +231 @@
                 'is_default_option' => false,
                 'option_order' => null,
+                'field_order' => null,
         ) );
 
@@ -238 +239 @@
         }
 
-        // Check this is a valid field type
+        // Check this is a non-empty, valid field type.
         if ( ! in_array( $r['type'], (array) buddypress()->profile->field_types ) ) {
                 return false;
@@ -251 +252 @@
 
         $field->group_id = $r['field_group_id'];
-
-        if ( ! empty( $r['parent_id'] ) ) {
-                $field->parent_id = $r['parent_id'];
-        }
-
-        if ( ! empty( $r['type'] ) ) {
-                $field->type = $r['type'];
-        }
-
+        $field->type     = $r['type'];
+
+        // The 'name' field cannot be empty.
         if ( ! empty( $r['name'] ) ) {
                 $field->name = $r['name'];
         }
 
-        if ( ! empty( $r['description'] ) ) {
-                $field->description = $r['description'];
-        }
-
-        if ( ! empty( $r['is_required'] ) ) {
-                $field->is_required = $r['is_required'];
-        }
-
-        if ( ! empty( $r['can_delete'] ) ) {
-                $field->can_delete = $r['can_delete'];
-        }
-
-        if ( ! empty( $r['field_order'] ) ) {
-                $field->field_order = $r['field_order'];
-        }
-
-        if ( ! empty( $r['order_by'] ) ) {
-                $field->order_by = $r['order_by'];
-        }
-
+        $field->description       = $r['description'];
+        $field->order_by          = $r['order_by'];
+        $field->parent_id         = (int) $r['parent_id'];
+        $field->field_order       = (int) $r['field_order'];
+        $field->option_order      = (int) $r['option_order'];
+        $field->is_required       = (bool) $r['is_required'];
+        $field->can_delete        = (bool) $r['can_delete'];
         $field->is_default_option = (bool) $r['is_default_option'];
-
-        if ( ! empty( $r['option_order'] ) ) {
-                $field->option_order = $r['option_order'];
-        }
 
         return $field->save();