Changeset 12412

Timestamp:

02/22/2023 12:54:20 AM (2 years ago)

Author:

Clorith

Message:

Support Forums: Check intent before updating user preferences.

The bbPress profile page may be triggered by various scenarios that do not have the full context of a profile edit included.

By introducing a hidden input field in the form areas which need a "yes or no" type response, indicated by checkboxes, we can ensure that these are not unintentionally cleared or set from profile modifications made without the options even being presented to the user.

Props zoonini.
Fixes #6509.

Location:

sites/trunk/wordpress.org/public_html/wp-content/plugins

Files:

• support-forums/inc/class-blocks.php (modified) (2 diffs)
• wporg-bbp-also-viewing/wporg-bbp-also-viewing.php (modified) (12 diffs)

sites/trunk/wordpress.org/public_html/wp-content/plugins/support-forums/inc/class-blocks.php

@@ -160 +160 @@
         printf(
             '<p>
+                <input type="hidden" name="can_update_block_editor_preference" value="true">
                 <input name="block_editor" id="block_editor" type="checkbox" value="disabled" %s />
                 <label for="block_editor">%s</label>
@@ -175 +176 @@
      */
     public function bbp_profile_update( $user_id ) {
+        // Catch profile updates that should not be able to include the "Disable Block Editor" preference, and return early.
+        if ( ! isset( $_REQUEST['can_update_block_editor_preference'] ) ) {
+            return;
+        }
+
         $disabled = ! empty( $_REQUEST['block_editor'] ) && 'disabled' === $_REQUEST['block_editor'];
 

sites/trunk/wordpress.org/public_html/wp-content/plugins/wporg-bbp-also-viewing/wporg-bbp-also-viewing.php

@@ -73 +73 @@
 /**
  * Whether Also Viewing is enabled for the current user.
- * 
+ *
  * @param int $user_id The user ID to check for.
- * 
+ *
  * @return bool
  */
@@ -88 +88 @@
 /**
  * Whether Also Viewing is able to be activated for the current user.
- * 
+ *
  * @param int $user_id The user ID to check for.
- * 
+ *
  * @return bool
  */
@@ -110 +110 @@
 /**
  * The current page "slug"/"path" for refering to the current request.
- * 
+ *
  * This uses the WordPress.org SEO plugin for the canonical url, or falls back to REQUEST_URI.
- * 
+ *
  * @return string The path for the current page, eg. 'view/no-replies'
  */
@@ -131 +131 @@
 /**
  * Sanitizes a given string/url/path to the format used for uniquely identifying pages.
- * 
+ *
  * @param string $page The strng/url/path
- * 
+ *
  * @return string The sanitized $page.
  */
@@ -194 +194 @@
     printf(
         '<p>
+        <input type="hidden" name="can_update_also_viewing_preference" value="true">
         <input name="also_viewing" id="also_viewing_toggle" type="checkbox" value="yes" %s>
         <label for="also_viewing_toggle">%s</label>
@@ -209 +210 @@
  */
 function bbp_profile_update( $user_id ) {
+    // Catch profile updates that should not be able to include the Also Viewing preference, and return early.
+    if ( ! isset( $_REQUEST['can_update_also_viewing_preference'] ) ) {
+        return;
+    }
+
     $enabled = ! empty( $_REQUEST['also_viewing'] ) && 'yes' === $_REQUEST['also_viewing'];
 
@@ -222 +228 @@
 /**
  * Get the list of users who are currently viewing a page.
- * 
+ *
  * @param string $page The page to get the userse for.
- * 
+ *
  * @return array Array of user names + if they're typing.
  */
@@ -268 +274 @@
 /**
  * Get the list of OTHER users who are currently viewing a page.
- * 
+ *
  * @param string $page The page to get the userse for.
- * 
+ *
  * @return array Array of user names + if they're typing.
  */
@@ -286 +292 @@
 /**
  * Mark a user as currently viewing/typing on the current page.
- * 
+ *
  * @param string $page    The page being viewed. Default current page.
  * @param bool   $typing  If the current user is typing. Default false.
  * @param int    $user_id The user ID who is viewing/typing.
- * 
+ *
  * @return bool
  */
@@ -333 +339 @@
 /**
  * Mark a user as no longer viewing a page.
- * 
+ *
  * @param string $page    The page to no longer view. Defaults to clearing all pages.
  * @param int    $user_id The user ID no longer viewing the page. Default current user.
@@ -430 +436 @@
 /**
  * The table name used for storing the state of users.
- * 
+ *
  * @return string
  */
@@ -441 +447 @@
 /**
  * Maybe create the database table used for this plugin.
- * 
+ *
  * This only runs once per site, ever.
  */