Ticket #2869: 2869.meta.diff

wordcamp.org/public_html/wp-content/plugins/wc-post-types/wc-post-types.php

@@ -1822 +1822 @@
                         return;
                 }
 
-                if ( isset( $_POST['wcpt-meta-sponsor-info'] ) && wp_verify_nonce( $_POST['wcpt-meta-sponsor-info'], 'edit-sponsor-info' ) ) {
+                if ( wp_verify_nonce( filter_input( INPUT_POST,  'wcpt-meta-sponsor-info' ), 'edit-sponsor-info' ) ) {
                         $text_values = array(
                                 'company_name', 'first_name', 'last_name', 'email_address', 'phone_number', 'vat_number', 'twitter_handle',
                                 'street_address1', 'street_address2', 'city', 'state', 'zip_code', 'country'
                         );
 
                         foreach ( $text_values as $id ) {
-                                $values[ $id ] = sanitize_text_field( $_POST["_wcpt_sponsor_$id"] );
+                                $values[ $id ] = sanitize_text_field( filter_input( INPUT_POST, '_wcpt_sponsor_' . $id ) );
                         }
 
-                        $values['website'] = esc_url_raw( $_POST['_wcpt_sponsor_website'] );
+                        $values['website'] = esc_url_raw( filter_input( INPUT_POST, '_wcpt_sponsor_website' ) );
                         // TODO: maybe only allows links to home page, depending on outcome of http://make.wordpress.org/community/2013/12/31/irs-rules-for-corporate-sponsorship-of-wordcamp/
 
                         $values['first_name'] = ucfirst( $values['first_name'] );