Index: src/bp-activity/bp-activity-functions.php =================================================================== --- src/bp-activity/bp-activity-functions.php +++ src/bp-activity/bp-activity-functions.php @@ -176,7 +176,7 @@ } // Get activity object. - $activity = new BP_Activity_Activity( (int) $activity_id ); + $activity = new BP_Activity_Activity( $activity_id ); // Try to find mentions. $usernames = bp_activity_find_mentions( strip_tags( $activity->content ) ); @@ -2633,7 +2633,7 @@ } // Check to see if the parent activity is hidden, and if so, hide this comment publicly. - $is_hidden = ( (int) $activity->hide_sitewide ) ? 1 : 0; + $is_hidden = $activity->hide_sitewide ? 1 : 0; /** * Filters the content of a new comment. Index: src/bp-activity/bp-activity-screens.php =================================================================== --- src/bp-activity/bp-activity-screens.php +++ src/bp-activity/bp-activity-screens.php @@ -335,7 +335,7 @@ } else { $url = sprintf( site_url( 'wp-login.php?redirect_to=%s' ), - urlencode( esc_url_raw( bp_activity_get_permalink( (int) bp_current_action() ) ) ) + urlencode( esc_url_raw( bp_activity_get_permalink( bp_current_action() ) ) ) ); } Index: src/bp-activity/bp-activity-template.php =================================================================== --- src/bp-activity/bp-activity-template.php +++ src/bp-activity/bp-activity-template.php @@ -1652,7 +1652,7 @@ // Users are allowed to delete their own activity. This is actually // quite powerful, because doing so also deletes all comments to that // activity item. We should revisit this eventually. - if ( isset( $activity->user_id ) && ( (int) $activity->user_id === bp_loggedin_user_id() ) ) { + if ( isset( $activity->user_id ) && ( $activity->user_id === bp_loggedin_user_id() ) ) { $can_delete = true; } @@ -1707,7 +1707,7 @@ } // Get the ID of the parent activity content. - $parent_id = (int) $activities_template->activity->item_id; + $parent_id = $activities_template->activity->item_id; // Bail if no parent content. if ( empty( $activities_template->activity_parents[ $parent_id ] ) ) { @@ -1771,7 +1771,7 @@ } // Get the ID of the parent activity content. - $parent_id = (int) $activities_template->activity->item_id; + $parent_id = $activities_template->activity->item_id; // Bail if no parent item. if ( empty( $activities_template->activity_parents[ $parent_id ] ) ) { Index: src/bp-activity/classes/class-bp-activity-activity.php =================================================================== --- src/bp-activity/classes/class-bp-activity-activity.php +++ src/bp-activity/classes/class-bp-activity-activity.php @@ -107,7 +107,7 @@ * @since 1.1.0 * @var int */ - var $hide_sitewide = false; + var $hide_sitewide = 0; /** * Node boundary start for activity or activity comment. @@ -142,7 +142,7 @@ */ public function __construct( $id = false ) { if ( !empty( $id ) ) { - $this->id = $id; + $this->id = (int) $id; $this->populate(); } } @@ -175,10 +175,10 @@ $this->action = $row->action; $this->content = $row->content; $this->date_recorded = $row->date_recorded; - $this->hide_sitewide = $row->hide_sitewide; + $this->hide_sitewide = (int) $row->hide_sitewide; $this->mptt_left = (int) $row->mptt_left; $this->mptt_right = (int) $row->mptt_right; - $this->is_spam = $row->is_spam; + $this->is_spam = (int) $row->is_spam; } // Generate dynamic 'action' when possible. @@ -708,7 +708,20 @@ // Now fetch data from the cache. foreach ( $activity_ids as $activity_id ) { - $activities[] = wp_cache_get( $activity_id, 'bp_activity' ); + // Integer casting. + $activity = wp_cache_get( $activity_id, 'bp_activity' ); + if ( ! empty( $activity ) ) { + $activity->id = (int) $activity->id; + $activity->user_id = (int) $activity->user_id; + $activity->item_id = (int) $activity->item_id; + $activity->secondary_item_id = (int) $activity->secondary_item_id; + $activity->hide_sitewide = (int) $activity->hide_sitewide; + $activity->mptt_left = (int) $activity->mptt_left; + $activity->mptt_right = (int) $activity->mptt_right; + $activity->is_spam = (int) $activity->is_spam; + } + + $activities[] = $activity; } // Then fetch user data. @@ -1071,7 +1084,9 @@ if ( ! empty( $where_args ) ) { $where_sql = 'WHERE ' . join( ' AND ', $where_args ); - return $wpdb->get_var( "SELECT id FROM {$bp->activity->table_name} {$where_sql}" ); + $query = $wpdb->get_var( "SELECT id FROM {$bp->activity->table_name} {$where_sql}" ); + + return is_numeric( $query ) ? (int) $query : false; } return false; @@ -1763,7 +1778,9 @@ $bp = buddypress(); - return $wpdb->get_var( $wpdb->prepare( "SELECT id FROM {$bp->activity->table_name} WHERE content = %s", $content ) ); + $query = $wpdb->get_var( $wpdb->prepare( "SELECT id FROM {$bp->activity->table_name} WHERE content = %s", $content ) ); + + return is_numeric( $query ) ? (int) $query : false; } /** Index: src/bp-blogs/bp-blogs-activity.php =================================================================== --- src/bp-blogs/bp-blogs-activity.php +++ src/bp-blogs/bp-blogs-activity.php @@ -830,7 +830,7 @@ remove_action( 'transition_comment_status', 'bp_activity_transition_post_type_comment_status', 10, 3 ); remove_action( 'bp_activity_post_type_comment', 'bp_blogs_comment_sync_activity_comment', 10, 4 ); - if ( 1 === (int) $activity->is_spam && 'spam' !== $post_comment_status ) { + if ( 1 === $activity->is_spam && 'spam' !== $post_comment_status ) { wp_spam_comment( $post_comment_id ); } elseif ( ! $activity->is_spam ) { if ( 'spam' === $post_comment_status ) { Index: src/bp-blogs/classes/class-bp-blogs-blog.php =================================================================== --- src/bp-blogs/classes/class-bp-blogs-blog.php +++ src/bp-blogs/classes/class-bp-blogs-blog.php @@ -48,7 +48,7 @@ */ public function __construct( $id = null ) { if ( !empty( $id ) ) { - $this->id = $id; + $this->id = (int) $id; $this->populate(); } } @@ -63,8 +63,8 @@ $blog = $wpdb->get_row( $wpdb->prepare( "SELECT * FROM {$bp->blogs->table_name} WHERE id = %d", $this->id ) ); - $this->user_id = $blog->user_id; - $this->blog_id = $blog->blog_id; + $this->user_id = (int) $blog->user_id; + $this->blog_id = (int) $blog->blog_id; } /** @@ -243,6 +243,12 @@ $paged_blogs = BP_Blogs_Blog::get_blog_extras( $paged_blogs, $blog_ids, $type ); + // Integer casting. + foreach ( (array) $paged_blogs as $key => $data ) { + $paged_blogs[ $key ]->blog_id = (int) $paged_blogs[ $key ]->blog_id; + $paged_blogs[ $key ]->admin_user_id = (int) $paged_blogs[ $key ]->admin_user_id; + } + if ( $update_meta_cache ) { bp_blogs_update_meta_cache( $blog_ids ); } @@ -338,8 +344,8 @@ $user_blogs = array(); foreach ( (array) $blogs as $blog ) { $user_blogs[$blog->blog_id] = new stdClass; - $user_blogs[$blog->blog_id]->id = $blog->id; - $user_blogs[$blog->blog_id]->blog_id = $blog->blog_id; + $user_blogs[$blog->blog_id]->id = (int) $blog->id; + $user_blogs[$blog->blog_id]->blog_id = (int) $blog->blog_id; $user_blogs[$blog->blog_id]->siteurl = ( is_ssl() ) ? 'https://' . $blog->domain . $blog->path : 'http://' . $blog->domain . $blog->path; $user_blogs[$blog->blog_id]->name = $blog->name; } @@ -364,7 +370,7 @@ if ( !$user_id ) $user_id = bp_displayed_user_id(); - return $wpdb->get_col( $wpdb->prepare( "SELECT blog_id FROM {$bp->blogs->table_name} WHERE user_id = %d", $user_id ) ); + return array_map( 'intval', $wpdb->get_col( $wpdb->prepare( "SELECT blog_id FROM {$bp->blogs->table_name} WHERE user_id = %d", $user_id ) ) ); } /** @@ -379,7 +385,9 @@ $bp = buddypress(); - return $wpdb->get_var( $wpdb->prepare( "SELECT id FROM {$bp->blogs->table_name} WHERE blog_id = %d", $blog_id ) ); + $query = $wpdb->get_var( $wpdb->prepare( "SELECT id FROM {$bp->blogs->table_name} WHERE blog_id = %d", $blog_id ) ); + + return is_numeric( $query ) ? (int) $query : $query; } /** @@ -444,7 +452,12 @@ $paged_blogs = $wpdb->get_results( "SELECT DISTINCT bm.blog_id FROM {$bp->blogs->table_name_blogmeta} bm LEFT JOIN {$wpdb->base_prefix}blogs wb ON bm.blog_id = wb.blog_id WHERE ( ( bm.meta_key = 'name' OR bm.meta_key = 'description' ) AND {$search_terms_sql} ) {$hidden_sql} AND wb.mature = 0 AND wb.spam = 0 AND wb.archived = '0' AND wb.deleted = 0 ORDER BY meta_value ASC{$pag_sql}" ); $total_blogs = $wpdb->get_var( "SELECT COUNT(DISTINCT bm.blog_id) FROM {$bp->blogs->table_name_blogmeta} bm LEFT JOIN {$wpdb->base_prefix}blogs wb ON bm.blog_id = wb.blog_id WHERE ( ( bm.meta_key = 'name' OR bm.meta_key = 'description' ) AND {$search_terms_sql} ) {$hidden_sql} AND wb.mature = 0 AND wb.spam = 0 AND wb.archived = '0' AND wb.deleted = 0 ORDER BY meta_value ASC" ); - return array( 'blogs' => $paged_blogs, 'total' => $total_blogs ); + // Integer casting. + foreach ( (array) $paged_blogs as $key => $data ) { + $paged_blogs[ $key ]->blog_id = (int) $paged_blogs[ $key ]->blog_id; + } + + return array( 'blogs' => $paged_blogs, 'total' => (int) $total_blogs ); } /** @@ -472,7 +485,12 @@ $paged_blogs = $wpdb->get_results( "SELECT DISTINCT b.blog_id FROM {$bp->blogs->table_name} b LEFT JOIN {$wpdb->base_prefix}blogs wb ON b.blog_id = wb.blog_id WHERE wb.mature = 0 AND wb.spam = 0 AND wb.archived = '0' AND wb.deleted = 0 {$hidden_sql} {$pag_sql}" ); $total_blogs = $wpdb->get_var( "SELECT COUNT(DISTINCT b.blog_id) FROM {$bp->blogs->table_name} b LEFT JOIN {$wpdb->base_prefix}blogs wb ON b.blog_id = wb.blog_id WHERE wb.mature = 0 AND wb.spam = 0 AND wb.archived = '0' AND wb.deleted = 0 {$hidden_sql}" ); - return array( 'blogs' => $paged_blogs, 'total' => $total_blogs ); + // Integer casting. + foreach ( (array) $paged_blogs as $key => $data ) { + $paged_blogs[ $key ]->blog_id = (int) $paged_blogs[ $key ]->blog_id; + } + + return array( 'blogs' => $paged_blogs, 'total' => (int) $total_blogs ); } /** @@ -509,7 +527,12 @@ $paged_blogs = $wpdb->get_results( "SELECT DISTINCT bm.blog_id FROM {$bp->blogs->table_name_blogmeta} bm LEFT JOIN {$wpdb->base_prefix}blogs wb ON bm.blog_id = wb.blog_id WHERE bm.meta_key = 'name' AND {$letter_sql} {$hidden_sql} AND wb.mature = 0 AND wb.spam = 0 AND wb.archived = '0' AND wb.deleted = 0 ORDER BY bm.meta_value ASC{$pag_sql}" ); $total_blogs = $wpdb->get_var( "SELECT COUNT(DISTINCT bm.blog_id) FROM {$bp->blogs->table_name_blogmeta} bm LEFT JOIN {$wpdb->base_prefix}blogs wb ON bm.blog_id = wb.blog_id WHERE bm.meta_key = 'name' AND {$letter_sql} {$hidden_sql} AND wb.mature = 0 AND wb.spam = 0 AND wb.archived = '0' AND wb.deleted = 0 ORDER BY bm.meta_value ASC" ); - return array( 'blogs' => $paged_blogs, 'total' => $total_blogs ); + // Integer casting. + foreach ( (array) $paged_blogs as $key => $data ) { + $paged_blogs[ $key ]->blog_id = (int) $paged_blogs[ $key ]->blog_id; + } + + return array( 'blogs' => $paged_blogs, 'total' => (int) $total_blogs ); } /** Index: src/bp-core/classes/class-bp-core-user.php =================================================================== --- src/bp-core/classes/class-bp-core-user.php +++ src/bp-core/classes/class-bp-core-user.php @@ -823,6 +823,8 @@ $retval = array(); foreach ( $user_ids as $user_id ) { $retval[ $user_id ] = wp_cache_get( $user_id, 'bp_last_activity' ); + $retval[ $user_id ]['user_id'] = (int) $retval[ $user_id ]['user_id']; + $retval[ $user_id ]['activity_id'] = (int) $retval[ $user_id ]['activity_id']; } return $retval; Index: src/bp-core/classes/class-bp-user-query.php =================================================================== --- src/bp-core/classes/class-bp-user-query.php +++ src/bp-core/classes/class-bp-user-query.php @@ -591,11 +591,14 @@ // Match up to the user ids from the main query. foreach ( $this->user_ids as $key => $uid ) { if ( isset( $r[ $uid ] ) ) { + $r[ $uid ]->ID = (int) $uid; + $r[ $uid ]->user_status = (int) $r[ $uid ]->user_status; + $this->results[ $uid ] = $r[ $uid ]; // The BP template functions expect an 'id' // (as opposed to 'ID') property. - $this->results[ $uid ]->id = $uid; + $this->results[ $uid ]->id = (int) $uid; // Remove user ID from original user_ids property. } else { Index: src/bp-friends/classes/class-bp-friends-friendship.php =================================================================== --- src/bp-friends/classes/class-bp-friends-friendship.php +++ src/bp-friends/classes/class-bp-friends-friendship.php @@ -241,7 +241,7 @@ } } - return $fids; + return array_map( 'intval', $fids ); } /** @@ -251,14 +251,16 @@ * * @param int $user_id The ID of the first user. * @param int $friend_id The ID of the second user. - * @return int|bool The ID of the friendship object if found, otherwise false. + * @return int|null The ID of the friendship object if found, otherwise null. */ public static function get_friendship_id( $user_id, $friend_id ) { global $wpdb; $bp = buddypress(); - return $wpdb->get_var( $wpdb->prepare( "SELECT id FROM {$bp->friends->table_name} WHERE ( initiator_user_id = %d AND friend_user_id = %d ) OR ( initiator_user_id = %d AND friend_user_id = %d ) AND is_confirmed = 1", $user_id, $friend_id, $friend_id, $user_id ) ); + $query = $wpdb->get_var( $wpdb->prepare( "SELECT id FROM {$bp->friends->table_name} WHERE ( initiator_user_id = %d AND friend_user_id = %d ) OR ( initiator_user_id = %d AND friend_user_id = %d ) AND is_confirmed = 1", $user_id, $friend_id, $friend_id, $user_id ) ); + + return is_numeric( $query ) ? (int) $query : $query; } /** @@ -283,6 +285,11 @@ wp_cache_set( $user_id, $friend_requests, 'bp_friends_requests' ); } + // Integer casting. + if ( ! empty( $friend_requests ) ) { + $friend_requests = array_map( 'intval', $friend_requests ); + } + return $friend_requests; } @@ -381,7 +388,7 @@ if ( empty( $filtered_friend_ids ) ) return false; - return array( 'friends' => $filtered_friend_ids, 'total' => (int) $total_friend_ids ); + return array( 'friends' => array_map( 'intval', $filtered_friend_ids ), 'total' => (int) $total_friend_ids ); } /** Index: src/bp-groups/bp-groups-functions.php =================================================================== --- src/bp-groups/bp-groups-functions.php +++ src/bp-groups/bp-groups-functions.php @@ -114,7 +114,7 @@ // Pass an existing group ID. if ( ! empty( $group_id ) ) { - $group = groups_get_group( array( 'group_id' => (int) $group_id ) ); + $group = groups_get_group( array( 'group_id' => $group_id ) ); $name = ! empty( $name ) ? $name : $group->name; $slug = ! empty( $slug ) ? $slug : $group->slug; $description = ! empty( $description ) ? $description : $group->description; @@ -415,10 +415,10 @@ * @since 1.6.0 * * @param string $group_slug The group's slug. - * @return int The ID. + * @return int|null The group ID on success; null on failure. */ function groups_get_id( $group_slug ) { - return (int)BP_Groups_Group::group_exists( $group_slug ); + return BP_Groups_Group::group_exists( $group_slug ); } /** User Actions **************************************************************/ @@ -879,7 +879,7 @@ * * @param int $user_id ID of the user. * @param int $group_id ID of the group. - * @return bool + * @return int 1 on success; 0 on failure. */ function groups_is_user_admin( $user_id, $group_id ) { return BP_Groups_Member::check_is_admin( $user_id, $group_id ); @@ -892,7 +892,7 @@ * * @param int $user_id ID of the user. * @param int $group_id ID of the group. - * @return bool + * @return int 1 on success; 0 on failure. */ function groups_is_user_mod( $user_id, $group_id ) { return BP_Groups_Member::check_is_mod( $user_id, $group_id ); @@ -905,7 +905,7 @@ * * @param int $user_id ID of the user. * @param int $group_id ID of the group. - * @return bool + * @return int 1 on success; 0 on failure. */ function groups_is_user_member( $user_id, $group_id ) { return BP_Groups_Member::check_is_member( $user_id, $group_id ); @@ -919,7 +919,8 @@ * @param int $user_id ID of the user. * @param int $group_id ID of the group. * - * @return bool + * @return int|null int 1 if user is banned; int 0 if user is not banned; + * null if user is not part of the group or if group doesn't exist. */ function groups_is_user_banned( $user_id, $group_id ) { return BP_Groups_Member::check_is_banned( $user_id, $group_id ); @@ -932,7 +933,7 @@ * * @param int $user_id ID of the user. * @param int $group_id ID of the group. - * @return bool + * @return int|null int of group ID if user is the creator; null on failure. */ function groups_is_user_creator( $user_id, $group_id ) { return BP_Groups_Member::check_is_creator( $user_id, $group_id ); @@ -1336,7 +1337,7 @@ * @param int $group_id ID of potential group. * @param string $type Optional. Use 'sent' to check for sent invites, * 'all' to check for all. Default: 'sent'. - * @return bool True if an invitation is found, otherwise false. + * @return int|null The ID of the invitation if found; null if not found. */ function groups_check_user_has_invite( $user_id, $group_id, $type = 'sent' ) { return BP_Groups_Member::check_has_invite( $user_id, $group_id, $type ); @@ -1684,7 +1685,7 @@ * * @param int $user_id ID of the user. * @param int $group_id ID of the group. - * @return int|null ID of the membership if found, otherwise false. + * @return int|null ID of the membership if found, otherwise null. */ function groups_check_for_membership_request( $user_id, $group_id ) { return BP_Groups_Member::check_for_membership_request( $user_id, $group_id ); Index: src/bp-groups/classes/class-bp-groups-group.php =================================================================== --- src/bp-groups/classes/class-bp-groups-group.php +++ src/bp-groups/classes/class-bp-groups-group.php @@ -175,7 +175,7 @@ ) ); if ( !empty( $id ) ) { - $this->id = $id; + $this->id = (int) $id; $this->populate(); } } @@ -208,13 +208,13 @@ } // Group found so setup the object variables. - $this->id = $group->id; - $this->creator_id = $group->creator_id; + $this->id = (int) $group->id; + $this->creator_id = (int) $group->creator_id; $this->name = stripslashes( $group->name ); $this->slug = $group->slug; $this->description = stripslashes( $group->description ); $this->status = $group->status; - $this->enable_forum = $group->enable_forum; + $this->enable_forum = (int) $group->enable_forum; $this->date_created = $group->date_created; // Are we getting extra group data? @@ -231,6 +231,10 @@ // Add admins and moderators to their respective arrays. foreach ( (array) $admin_mods as $user ) { + $user->user_id = (int) $user->user_id; + $user->is_admin = (int) $user->is_admin; + $user->is_mod = (int) $user->is_mod; + if ( !empty( $user->is_admin ) ) { $this->admins[] = $user; } else { @@ -241,7 +245,7 @@ // Set up some specific group vars from meta. Excluded // from the bp_groups cache because it's cached independently. $this->last_activity = groups_get_groupmeta( $this->id, 'last_activity' ); - $this->total_member_count = groups_get_groupmeta( $this->id, 'total_member_count' ); + $this->total_member_count = (int) groups_get_groupmeta( $this->id, 'total_member_count' ); // Set user-specific data. $user_id = bp_loggedin_user_id(); @@ -435,7 +439,7 @@ * @param string $slug Slug to check. * @param string|bool $table_name Optional. Name of the table to check * against. Default: $bp->groups->table_name. - * @return string|null ID of the group, if one is found, else null. + * @return int Group ID if found; null if not. */ public static function group_exists( $slug, $table_name = false ) { global $wpdb; @@ -446,7 +450,9 @@ if ( empty( $slug ) ) return false; - return $wpdb->get_var( $wpdb->prepare( "SELECT id FROM {$table_name} WHERE slug = %s", strtolower( $slug ) ) ); + $query = $wpdb->get_var( $wpdb->prepare( "SELECT id FROM {$table_name} WHERE slug = %s", strtolower( $slug ) ) ); + + return is_numeric( $query ) ? (int) $query : $query; } /** Index: src/bp-groups/classes/class-bp-groups-member.php =================================================================== --- src/bp-groups/classes/class-bp-groups-member.php +++ src/bp-groups/classes/class-bp-groups-member.php @@ -185,18 +185,18 @@ $member = $wpdb->get_row($sql); if ( !empty( $member ) ) { - $this->id = $member->id; - $this->group_id = $member->group_id; - $this->user_id = $member->user_id; - $this->inviter_id = $member->inviter_id; - $this->is_admin = $member->is_admin; - $this->is_mod = $member->is_mod; - $this->is_banned = $member->is_banned; + $this->id = (int) $member->id; + $this->group_id = (int) $member->group_id; + $this->user_id = (int) $member->user_id; + $this->inviter_id = (int) $member->inviter_id; + $this->is_admin = (int) $member->is_admin; + $this->is_mod = (int) $member->is_mod; + $this->is_banned = (int) $member->is_banned; $this->user_title = $member->user_title; $this->date_modified = $member->date_modified; - $this->is_confirmed = $member->is_confirmed; + $this->is_confirmed = (int) $member->is_confirmed; $this->comments = $member->comments; - $this->invite_sent = $member->invite_sent; + $this->invite_sent = (int) $member->invite_sent; $this->user = new BP_Core_User( $this->user_id ); } @@ -786,7 +786,7 @@ * @param int $group_id ID of the group. * @param string $type If 'sent', results are limited to those invitations * that have actually been sent (non-draft). Default: 'sent'. - * @return int|null The ID of the invitation if found, otherwise null. + * @return int|null The ID of the invitation if found; null if not found. */ public static function check_has_invite( $user_id, $group_id, $type = 'sent' ) { global $wpdb; @@ -800,7 +800,9 @@ if ( 'sent' == $type ) $sql .= " AND invite_sent = 1"; - return $wpdb->get_var( $wpdb->prepare( $sql, $user_id, $group_id ) ); + $query = $wpdb->get_var( $wpdb->prepare( $sql, $user_id, $group_id ) ); + + return is_numeric( $query ) ? (int) $query : $query; } /** @@ -861,7 +863,7 @@ * * @param int $user_id ID of the user. * @param int $group_id ID of the group. - * @return mixed + * @return int 1 on success; 0 on failure. */ public static function check_is_admin( $user_id, $group_id ) { global $wpdb; @@ -881,7 +883,7 @@ * * @param int $user_id ID of the user. * @param int $group_id ID of the group. - * @return mixed + * @return int 1 on success; 0 on failure. */ public static function check_is_mod( $user_id, $group_id ) { global $wpdb; @@ -901,7 +903,7 @@ * * @param int $user_id ID of the user. * @param int $group_id ID of the group. - * @return mixed + * @return int 1 on success; 0 on failure. */ public static function check_is_member( $user_id, $group_id ) { global $wpdb; @@ -921,7 +923,8 @@ * * @param int $user_id ID of the user. * @param int $group_id ID of the group. - * @return mixed + * @return int|null int 1 if user is banned; int 0 if user is not banned; + * null if user is not part of the group or if group doesn't exist. */ public static function check_is_banned( $user_id, $group_id ) { global $wpdb; @@ -931,7 +934,9 @@ $bp = buddypress(); - return $wpdb->get_var( $wpdb->prepare( "SELECT is_banned FROM {$bp->groups->table_name_members} WHERE user_id = %d AND group_id = %d", $user_id, $group_id ) ); + $query = $wpdb->get_var( $wpdb->prepare( "SELECT is_banned FROM {$bp->groups->table_name_members} WHERE user_id = %d AND group_id = %d", $user_id, $group_id ) ); + + return is_numeric( $query ) ? (int) $query : $query; } /** @@ -941,8 +946,7 @@ * * @param int $user_id ID of the user. * @param int $group_id ID of the group. - * @return int|null ID of the group if the user is the creator, - * otherwise false. + * @return int|null int of group ID if user is the creator; null on failure. */ public static function check_is_creator( $user_id, $group_id ) { global $wpdb; @@ -952,7 +956,9 @@ $bp = buddypress(); - return $wpdb->get_var( $wpdb->prepare( "SELECT id FROM {$bp->groups->table_name} WHERE creator_id = %d AND id = %d", $user_id, $group_id ) ); + $query = $wpdb->get_var( $wpdb->prepare( "SELECT id FROM {$bp->groups->table_name} WHERE creator_id = %d AND id = %d", $user_id, $group_id ) ); + + return is_numeric( $query ) ? (int) $query : $query; } /** @@ -962,7 +968,7 @@ * * @param int $user_id ID of the user. * @param int $group_id ID of the group. - * @return int|null ID of the membership if found, otherwise false. + * @return int Database ID of the membership if found; int 0 on failure. */ public static function check_for_membership_request( $user_id, $group_id ) { global $wpdb; @@ -991,9 +997,9 @@ // If the user is logged in and viewing their random groups, we can show hidden and private groups. if ( bp_is_my_profile() ) { - return $wpdb->get_col( $wpdb->prepare( "SELECT DISTINCT group_id FROM {$bp->groups->table_name_members} WHERE user_id = %d AND is_confirmed = 1 AND is_banned = 0 ORDER BY rand() LIMIT %d", $user_id, $total_groups ) ); + return array_map( 'intval', $wpdb->get_col( $wpdb->prepare( "SELECT DISTINCT group_id FROM {$bp->groups->table_name_members} WHERE user_id = %d AND is_confirmed = 1 AND is_banned = 0 ORDER BY rand() LIMIT %d", $user_id, $total_groups ) ) ); } else { - return $wpdb->get_col( $wpdb->prepare( "SELECT DISTINCT m.group_id FROM {$bp->groups->table_name_members} m, {$bp->groups->table_name} g WHERE m.group_id = g.id AND g.status != 'hidden' AND m.user_id = %d AND m.is_confirmed = 1 AND m.is_banned = 0 ORDER BY rand() LIMIT %d", $user_id, $total_groups ) ); + return array_map( 'intval', $wpdb->get_col( $wpdb->prepare( "SELECT DISTINCT m.group_id FROM {$bp->groups->table_name_members} m, {$bp->groups->table_name} g WHERE m.group_id = g.id AND g.status != 'hidden' AND m.user_id = %d AND m.is_confirmed = 1 AND m.is_banned = 0 ORDER BY rand() LIMIT %d", $user_id, $total_groups ) ) ); } } @@ -1010,7 +1016,7 @@ $bp = buddypress(); - return $wpdb->get_col( $wpdb->prepare( "SELECT user_id FROM {$bp->groups->table_name_members} WHERE group_id = %d AND is_confirmed = 1 AND is_banned = 0", $group_id ) ); + return array_map( 'intval', $wpdb->get_col( $wpdb->prepare( "SELECT user_id FROM {$bp->groups->table_name_members} WHERE group_id = %d AND is_confirmed = 1 AND is_banned = 0", $group_id ) ) ); } /** @@ -1033,6 +1039,11 @@ wp_cache_set( $group_id, $group_admins, 'bp_group_admins' ); } + // Integer casting. + foreach ( (array) $group_admins as $key => $data ) { + $group_admins[ $key ]->user_id = (int) $group_admins[ $key ]->user_id; + } + return $group_admins; } @@ -1049,7 +1060,14 @@ $bp = buddypress(); - return $wpdb->get_results( $wpdb->prepare( "SELECT user_id, date_modified FROM {$bp->groups->table_name_members} WHERE group_id = %d AND is_mod = 1 AND is_banned = 0", $group_id ) ); + $group_mods = $wpdb->get_results( $wpdb->prepare( "SELECT user_id, date_modified FROM {$bp->groups->table_name_members} WHERE group_id = %d AND is_mod = 1 AND is_banned = 0", $group_id ) ); + + // Integer casting. + foreach ( (array) $group_mods as $key => $data ) { + $group_mods[ $key ]->user_id = (int) $group_mods[ $key ]->user_id; + } + + return $group_mods; } /** @@ -1065,7 +1083,7 @@ $bp = buddypress(); - return $wpdb->get_col( $wpdb->prepare( "SELECT user_id FROM {$bp->groups->table_name_members} WHERE group_id = %d AND is_confirmed = 0 AND inviter_id = 0", $group_id ) ); + return array_map( 'intval', $wpdb->get_col( $wpdb->prepare( "SELECT user_id FROM {$bp->groups->table_name_members} WHERE group_id = %d AND is_confirmed = 0 AND inviter_id = 0", $group_id ) ) ); } /** Index: src/bp-messages/classes/class-bp-messages-message.php =================================================================== --- src/bp-messages/classes/class-bp-messages-message.php +++ src/bp-messages/classes/class-bp-messages-message.php @@ -88,9 +88,9 @@ $bp = buddypress(); if ( $message = $wpdb->get_row( $wpdb->prepare( "SELECT * FROM {$bp->messages->table_name_messages} WHERE id = %d", $id ) ) ) { - $this->id = $message->id; - $this->thread_id = $message->thread_id; - $this->sender_id = $message->sender_id; + $this->id = (int) $message->id; + $this->thread_id = (int) $message->thread_id; + $this->sender_id = (int) $message->sender_id; $this->subject = $message->subject; $this->message = $message->message; $this->date_sent = $message->date_sent; @@ -220,7 +220,9 @@ $bp = buddypress(); - return $wpdb->get_var( $wpdb->prepare( "SELECT id FROM {$bp->messages->table_name_messages} WHERE sender_id = %d AND thread_id = %d ORDER BY date_sent DESC LIMIT 1", bp_loggedin_user_id(), $thread_id ) ); + $query = $wpdb->get_var( $wpdb->prepare( "SELECT id FROM {$bp->messages->table_name_messages} WHERE sender_id = %d AND thread_id = %d ORDER BY date_sent DESC LIMIT 1", bp_loggedin_user_id(), $thread_id ) ); + + return is_numeric( $query ) ? (int) $query : $query; } /** @@ -236,7 +238,9 @@ $bp = buddypress(); - return $wpdb->get_var( $wpdb->prepare( "SELECT id FROM {$bp->messages->table_name_messages} WHERE sender_id = %d AND id = %d", $user_id, $message_id ) ); + $query = $wpdb->get_var( $wpdb->prepare( "SELECT id FROM {$bp->messages->table_name_messages} WHERE sender_id = %d AND id = %d", $user_id, $message_id ) ); + + return is_numeric( $query ) ? (int) $query : $query; } /** @@ -250,6 +254,8 @@ $bp = buddypress(); - return $wpdb->get_var( $wpdb->prepare( "SELECT sender_id FROM {$bp->messages->table_name_messages} WHERE id = %d", $message_id ) ); + $query = $wpdb->get_var( $wpdb->prepare( "SELECT sender_id FROM {$bp->messages->table_name_messages} WHERE id = %d", $message_id ) ); + + return is_numeric( $query ) ? (int) $query : $query; } } Index: src/bp-messages/classes/class-bp-messages-notice.php =================================================================== --- src/bp-messages/classes/class-bp-messages-notice.php +++ src/bp-messages/classes/class-bp-messages-notice.php @@ -62,7 +62,7 @@ */ public function __construct( $id = null ) { if ( $id ) { - $this->id = $id; + $this->id = (int) $id; $this->populate(); } } @@ -85,7 +85,7 @@ $this->subject = $notice->subject; $this->message = $notice->message; $this->date_sent = $notice->date_sent; - $this->is_active = $notice->is_active; + $this->is_active = (int) $notice->is_active; } } @@ -232,6 +232,12 @@ $notices = $wpdb->get_results( "SELECT * FROM {$bp->messages->table_name_notices} ORDER BY date_sent DESC {$limit_sql}" ); + // Integer casting. + foreach ( (array) $notices as $key => $data ) { + $notices[ $key ]->id = (int) $notices[ $key ]->id; + $notices[ $key ]->is_active = (int) $notices[ $key ]->is_active; + } + return $notices; } Index: src/bp-messages/classes/class-bp-messages-thread.php =================================================================== --- src/bp-messages/classes/class-bp-messages-thread.php +++ src/bp-messages/classes/class-bp-messages-thread.php @@ -254,6 +254,11 @@ wp_cache_set( 'thread_recipients_' . $thread_id, $recipients, 'bp_messages' ); } + // Cast all items from the messages DB table as integers. + foreach ( (array) $recipients as $key => $data ) { + $recipients[ $key ] = (object) array_map( 'intval', (array) $data ); + } + /** * Filters the recipients of a message thread. * @@ -291,6 +296,13 @@ wp_cache_set( $thread_id, (array) $messages, 'bp_messages_threads' ); } + // Integer casting. + foreach ( $messages as $key => $data ) { + $messages[ $key ]->id = (int) $messages[ $key ]->id; + $messages[ $key ]->thread_id = (int) $messages[ $key ]->thread_id; + $messages[ $key ]->sender_id = (int) $messages[ $key ]->sender_id; + } + return $messages; } Index: src/bp-notifications/classes/class-bp-notifications-notification.php =================================================================== --- src/bp-notifications/classes/class-bp-notifications-notification.php +++ src/bp-notifications/classes/class-bp-notifications-notification.php @@ -97,7 +97,7 @@ */ public function __construct( $id = 0 ) { if ( ! empty( $id ) ) { - $this->id = $id; + $this->id = (int) $id; $this->populate(); } } @@ -188,13 +188,13 @@ // Setup the notification data. if ( ! empty( $notification ) && ! is_wp_error( $notification ) ) { - $this->item_id = $notification->item_id; - $this->secondary_item_id = $notification->secondary_item_id; - $this->user_id = $notification->user_id; + $this->item_id = (int) $notification->item_id; + $this->secondary_item_id = (int) $notification->secondary_item_id; + $this->user_id = (int) $notification->user_id; $this->component_name = $notification->component_name; $this->component_action = $notification->component_action; $this->date_notified = $notification->date_notified; - $this->is_new = $notification->is_new; + $this->is_new = (int) $notification->is_new; } } @@ -681,7 +681,19 @@ // Concatenate query parts. $sql = "{$select_sql} {$from_sql} {$join_sql} {$where_sql} {$order_sql} {$pag_sql}"; - return $wpdb->get_results( $sql ); + // Query! + $results = $wpdb->get_results( $sql ); + + // Integer casting. + foreach( (array) $results as $key => $data ) { + $results[ $key ]->id = (int) $results[ $key ]->id; + $results[ $key ]->user_id = (int) $results[ $key ]->user_id; + $results[ $key ]->item_id = (int) $results[ $key ]->item_id; + $results[ $key ]->secondary_item_id = (int) $results[ $key ]->secondary_item_id; + $results[ $key ]->is_new = (int) $results[ $key ]->is_new; + } + + return $results; } /** @@ -732,7 +744,7 @@ $sql = "{$select_sql} {$from_sql} {$join_sql} {$where_sql}"; // Return the queried results. - return $wpdb->get_var( $sql ); + return (int) $wpdb->get_var( $sql ); } /** Index: src/bp-xprofile/classes/class-bp-xprofile-field.php =================================================================== --- src/bp-xprofile/classes/class-bp-xprofile-field.php +++ src/bp-xprofile/classes/class-bp-xprofile-field.php @@ -260,10 +260,21 @@ $args = (array) $args; } + $int_fields = array( + 'id', 'is_required', 'group_id', 'parent_id', 'is_default_option', + 'field_order', 'option_order', 'can_delete' + ); + foreach ( $args as $k => $v ) { if ( 'name' === $k || 'description' === $k ) { $v = stripslashes( $v ); } + + // Cast numeric strings as integers. + if ( true === in_array( $k, $int_fields ) ) { + $v = (int) $v; + } + $this->{$k} = $v; } @@ -892,7 +903,7 @@ * @global object $wpdb * * @param string $field_name Name of the field to query the ID for. - * @return boolean + * @return int|null Field ID on success; null on failure. */ public static function get_id_from_name( $field_name = '' ) { global $wpdb; @@ -905,7 +916,9 @@ $sql = $wpdb->prepare( "SELECT id FROM {$bp->profile->table_name_fields} WHERE name = %s AND parent_id = 0", $field_name ); - return $wpdb->get_var( $sql ); + $query = $wpdb->get_var( $sql ); + + return is_numeric( $query ) ? (int) $query : $query; } /** Index: src/bp-xprofile/classes/class-bp-xprofile-group.php =================================================================== --- src/bp-xprofile/classes/class-bp-xprofile-group.php +++ src/bp-xprofile/classes/class-bp-xprofile-group.php @@ -466,7 +466,6 @@ // Merge the field array back in with the group array. foreach( (array) $groups as $group ) { - // Indexes may have been shifted after previous deletions, so we get a // fresh one each time through the loop. $index = array_search( $group, $groups ); @@ -555,6 +554,13 @@ } } + // Integer casting. + foreach ( (array) $groups as $key => $data ) { + $groups[ $key ]->id = (int) $groups[ $key ]->id; + $groups[ $key ]->group_order = (int) $groups[ $key ]->group_order; + $groups[ $key ]->can_delete = (int) $groups[ $key ]->can_delete; + } + // Reset indexes & return. return array_values( $groups ); } Index: src/bp-xprofile/classes/class-bp-xprofile-profiledata.php =================================================================== --- src/bp-xprofile/classes/class-bp-xprofile-profiledata.php +++ src/bp-xprofile/classes/class-bp-xprofile-profiledata.php @@ -88,16 +88,16 @@ } if ( $profiledata ) { - $this->id = $profiledata->id; - $this->user_id = $profiledata->user_id; - $this->field_id = $profiledata->field_id; + $this->id = (int) $profiledata->id; + $this->user_id = (int) $profiledata->user_id; + $this->field_id = (int) $profiledata->field_id; $this->value = stripslashes( $profiledata->value ); $this->last_updated = $profiledata->last_updated; } else { // When no row is found, we'll need to set these properties manually. - $this->field_id = $field_id; - $this->user_id = $user_id; + $this->field_id = (int) $field_id; + $this->user_id = (int) $user_id; } } @@ -317,6 +317,18 @@ $data[] = wp_cache_get( $cache_key, 'bp_xprofile_data' ); } + // Integer casting. + foreach ( (array) $data as $key => $d ) { + if ( isset( $data[ $key ]->id ) ) { + $data[ $key ]->id = (int) $data[ $key ]->id; + } + if ( isset( $data[ $key ]->user_id ) ) { + $data[ $key ]->user_id = (int) $data[ $key ]->user_id; + } + + $data[ $key ]->field_id = (int) $data[ $key ]->field_id; + } + return $data; } @@ -390,7 +402,7 @@ } } - return $fielddata_id; + return (int) $fielddata_id; } /** @@ -465,6 +477,18 @@ $data[] = wp_cache_get( $cache_key, 'bp_xprofile_data' ); } + // Integer casting. + foreach ( (array) $data as $key => $d ) { + if ( isset( $data[ $key ]->id ) ) { + $data[ $key ]->id = (int) $data[ $key ]->id; + } + if ( isset( $data[ $key ]->user_id ) ) { + $data[ $key ]->user_id = (int) $data[ $key ]->user_id; + } + + $data[ $key ]->field_id = (int) $data[ $key ]->field_id; + } + // If a single ID was passed, just return the value. if ( $is_single ) { return $data[0]->value;