Skip to:
Content

BuddyPress.org

Opened 5 years ago

Closed 5 years ago

#6707 closed defect (bug) (fixed)

Member - Settings - Email - radio buttons

Reported by: slaFFik Owned by:
Milestone: 2.3.5 Priority: normal
Severity: normal Version: 1.0
Component: Settings Keywords: has-patch
Cc:

Description

Seems, BuddyPress trusts radio-buttons values on save, which is not good.
Just change the value field of any checked radio button, and click save - in my case yes-or-no was saved successfully into DB.

In source code we have:

foreach ( (array) $_POST['notifications'] as $key => $value ) {
	bp_update_user_meta( (int) bp_displayed_user_id(), $key, $value );
}

So any js script or user can pass any string. I believe this is a bad approach, when application doesn't control the data that is saved.

Attachments (1)

6707.01.patch (472 bytes) - added by r-a-y 5 years ago.

Download all attachments as: .zip

Change History (8)

#1 @r-a-y
5 years ago

  • Keywords has-patch added
  • Milestone changed from Awaiting Review to 2.5
  • Version set to 1.0

Yeah, this isn't great. This code has been in place since v1.0!

On the other hand though, the majority of plugins do direct checks for 'yes' or 'no' values only; this value is never outputted.

6707.01.patch just sets the value of the notification setting before saving it into user meta.

Filtering bp_get_user_meta( $user_id, 'notification_XXX' ) might be overkill here, so I haven't done this in 01.patch. If we feel it is necessary, then we could do it.

@r-a-y
5 years ago

#2 @boonebgorges
5 years ago

In 10329:

Improve sanitization of email notification settings.

Props boonebgorges, johnjamesjacoby, imath, dcavins.
See #6707.

#3 @boonebgorges
5 years ago

In 10330:

Improve sanitization of email notification settings.

Port of [10329] to the 2.3 branch.

Props boonebgorges, johnjamesjacoby, imath, dcavins.
See #6707.

#4 @boonebgorges
5 years ago

In 10332:

Improve sanitization of email notification settings.

Port of [10329] to the 2.2 branch.

Props boonebgorges, johnjamesjacoby, imath, dcavins.
See #6707.

#5 @boonebgorges
5 years ago

In 10334:

Improve sanitization of email notification settings.

Port of [10329] to the 2.1 branch.

Props boonebgorges, johnjamesjacoby, imath, dcavins.
See #6707.

#6 @boonebgorges
5 years ago

In 10336:

Improve sanitization of email notification settings.

Port of [10329] to the 2.0 branch.

Props boonebgorges, johnjamesjacoby, imath, dcavins.
See #6707.

#7 @boonebgorges
5 years ago

  • Milestone changed from 2.5 to 2.3.5
  • Resolution set to fixed
  • Status changed from new to closed
Note: See TracTickets for help on using tickets.