Changeset 5568

Timestamp:

06/15/2017 12:33:44 PM (8 years ago)

Author:

coreymckrill

Message:

WordCamp Post Types: Avoid notices for missing $_POST keys

Use filter_input to ensure that $_POST keys exist before calling
their values. This function isn't used anywhere in Core because of
PHP compatibility issues, but it shouldn't cause an issue on
WordCamp.org.

Props davidmosterd
Fixes #2869

File:

• sites/trunk/wordcamp.org/public_html/wp-content/plugins/wc-post-types/wc-post-types.php (modified) (3 diffs)

sites/trunk/wordcamp.org/public_html/wp-content/plugins/wc-post-types/wc-post-types.php

@@ -1827 +1827 @@
         }
 
-        if ( isset( $_POST['wcpt-meta-sponsor-info'] ) && wp_verify_nonce( $_POST['wcpt-meta-sponsor-info'], 'edit-sponsor-info' ) ) {
+        if ( wp_verify_nonce( filter_input( INPUT_POST, 'wcpt-meta-sponsor-info' ), 'edit-sponsor-info' ) ) {
             $text_values = array(
                 'company_name', 'first_name', 'last_name', 'email_address', 'phone_number', 'vat_number', 'twitter_handle',
@@ -1834 +1834 @@
 
             foreach ( $text_values as $id ) {
-                $values[ $id ] = sanitize_text_field( $_POST["_wcpt_sponsor_$id"] );
+                $values[ $id ] = sanitize_text_field( filter_input( INPUT_POST, '_wcpt_sponsor_' . $id ) );
             }
 
-            $values['website'] = esc_url_raw( $_POST['_wcpt_sponsor_website'] );
+            $values['website'] = esc_url_raw( filter_input( INPUT_POST, '_wcpt_sponsor_website' ) );
             // TODO: maybe only allows links to home page, depending on outcome of http://make.wordpress.org/community/2013/12/31/irs-rules-for-corporate-sponsorship-of-wordcamp/
 
@@ -1844 +1844 @@
 
             foreach( $values as $id => $value ) {
+                $meta_key = '_wcpt_sponsor_' . $id;
+
                 if ( empty( $value ) ) {
-                    delete_post_meta( $post_id, "_wcpt_sponsor_$id" );
+                    delete_post_meta( $post_id, $meta_key );
                 } else {
-                    update_post_meta( $post_id, "_wcpt_sponsor_$id", $value );
+                    update_post_meta( $post_id, $meta_key, $value );
                 }
             }