Skip to:
Content

BuddyPress.org

Opened 13 years ago

Closed 13 years ago

Last modified 13 years ago

#4993 closed defect (bug) (fixed)

Improve friends component class methods sanitization

Reported by: johnjamesjacoby Owned by: boonebgorges
Priority: highest Milestone: 1.7.2
Component: Friends Version: 1.2
Severity: critical Keywords: has-patch
Cc:

Description

See #4898, #4992.

Some methods in the BP_Friends_Friendship class could be sanitized better, usually with wp_parse_id_list()

Patch attached

Attachments (1)

4993.patch​ (2.1 KB ) - added by johnjamesjacoby 13 years ago.

Download all attachments as: .zip

Change History (4)

@johnjamesjacoby
13 years ago

#1 @boonebgorges
13 years ago

Wow, there are some weird, obscure methods in this class. search_users() and search_users_count() don't have anything to do with friendships. This must be the fossilized remains of the earliest BP?

#2 @boonebgorges
13 years ago

  • Owner set to boonebgorges
  • Resolution → fixed
  • Status new → closed

In 7026:

Improved sanitization for Friends component database methods

  • All integer lists for IN clauses are run through wp_parse_id_list()
  • Search terms now escaped in the correct order

Also adds unit tests for touched methods

Fixes #4993

Props johnjamesjacoby

#3 @boonebgorges
13 years ago

In 7027:

Improved sanitization for Friends component database methods

  • All integer lists for IN clauses are run through wp_parse_id_list()
  • Search terms now escaped in the correct order

Fixes #4993 for the 1.7 branch

Props johnjamesjacoby

Note: See TracTickets for help on using tickets.