Improvements to groups classes to 'include' and 'exclude' args and parameters

[johnjamesjacoby]

It's possible to pass malformed values into several of the include and exclude parameters in bp-groups-classes.php, causing unexpected results (including potential SQL injection.)

Affected methods:

• BP_Groups_Group::get()
• BP_Groups_Group::get_by_most_forum_topics()
• BP_Groups_Group::get_by_letter()
• BP_Groups_Group::get_random()
• BP_Groups_Member::get_invites()
• BP_Groups_Member::get_all_for_group()

[johnjamesjacoby]

escape() rather than prepare()

[johnjamesjacoby]

Some other methods and parameters are also affected:

• BP_Groups_Group::search_groups() - sort_by, order
• BP_Groups_Group:: get_group_extras() - group_ids
• BP_Groups_Group:: get_global_topic_count() - search_terms
• BP_Groups_Groups::get_random_groups() - total_groups

[johnjamesjacoby]

Third patch fixes the above methods, and introduces custom like_escape() methods to BP_Groups_Group and BP_Groups_Member to handle the sanitization of other search terms, filters, and untrusted strings.

[johnjamesjacoby]

Without the new like_escape() method, and with proper order of esc_sql() and like_escape()

[johnjamesjacoby]

Same as 4, but without the trim()'s

[johnjamesjacoby]

Just noticed the momentary dyslexia on the patch names. Lame.

[boonebgorges]

In 7014:

Audit of parameter sanitization in Groups and Core database classes

• Uses wp_parse_id_list() to sanitize parameters of integer arrays
• Implements a more consistent approach to LIKE clause sanitization

See #4989

Props johnjamesjacoby

[boonebgorges]

In 7015:

Audit of parameter sanitization in Groups and Core database classes

• Uses wp_parse_id_list() to sanitize parameters of integer arrays
• Implements a more consistent approach to LIKE clause sanitization

Props johnjamesjacoby

Introduces a number of unit tests for the Groups and Core database classes, to
accompany the security hardening.

See #4989

[johnjamesjacoby]

In 7016:

Remove calls to trim() introduced in r7014 to still allow searching for beginning or ending spaces. See #4989.

[johnjamesjacoby]

In 7017:

Remove calls to trim() introduced in r7015 to still allow searching for beginning or ending spaces. See #4989.

[johnjamesjacoby]

In 7020:

More array sanitization hardening using wp_parse_id_list() in bp-groups-classes.php. See #4989 (1.7 branch)

[johnjamesjacoby]

In 7021:

More array sanitization hardening using wp_parse_id_list() in bp-groups-classes.php. See #4989 (trunk)

[johnjamesjacoby]

In 7029:

Use wp_parse_id_list() in BP_XProfile_FieldData::get_value_byid(). See #4989 (1.7 branch)

[johnjamesjacoby]

In 7030:

Use wp_parse_id_list() in BP_XProfile_FieldData::get_value_byid(). See #4989 (trunk)

[boonebgorges]

Marking resolved. Thanks for your work, all.