Changeset 8085 for sites/trunk/wordcamp.org/public_html/wp-content/plugins/wcpt/wcpt-event/class-event-application.php

Timestamp:

01/16/2019 03:36:24 PM (6 years ago)

Author:

vedjain

Message:

WCPT: Applies code standard changes to wcpt plugin.

Most of the changes are small, but these are some important ones:

1. Added nonce check in multiple places. This will ensure that request is always coming from the intended page.

2. Escaped output HTML in many places. These are not necessarily XSS vulnerabilities, and in most places they were hardcoded. But its a good practice to always escape regardless of source.

Summary:

• wcpt-event/class-event-admin.php
  • Added nonce check in metabox_save.
  • Escaped output in dislpay_meta_boxes

• wcpt-event/class-event-application.php
  • Change definition of submit_application to pass $POST arguments

• wcpt-loader.php
  • Indent whole file by 1 indent.

• wcpt-meetup/class-meetup-admin.php
  • Added nonce check in maybe_update_meetup_data

• wcpt-wordcamp/wordcamp-admin.php
  • Escaping in user_profile_wordcamp, column_data
  • Escaping using kses in post_row_actions
  • Use post_data_raw instead of $_POST in enforce_post_status

File:

• sites/trunk/wordcamp.org/public_html/wp-content/plugins/wcpt/wcpt-event/class-event-application.php (modified) (6 diffs)

sites/trunk/wordcamp.org/public_html/wp-content/plugins/wcpt/wcpt-event/class-event-application.php

@@ -53 +53 @@
 
     /**
-     * Render the output the of the [meetup-organizer-application] shortcode.
+     * Render the output the of the application forms shortcode.
      *
      * @todo Use force_login_to_view_form() and populate_form_based_on_user().
@@ -62 +62 @@
         ob_start();
 
+        // phpcs:ignore WordPress.Security.NonceVerification.Missing -- We do not verify nonce for frontend forms because WP Super Cache may cache an expired nonce token.
         if ( isset( $_POST['submit-application'] ) ) {
-            $this->submit_application();
+            $this->submit_application( $_POST );
         } else {
             $countries = wcorg_get_countries();
@@ -83 +84 @@
     /**
      * Submit application details. Calls `create_post` to actually create the event.
-     */
-    public function submit_application() {
-        $application_data = $this->validate_data( $_POST );
+     *
+     * @param array $post_data Form params.
+     */
+    public function submit_application( $post_data ) {
+        $application_data = $this->validate_data( $post_data );
 
         if ( $this->is_rate_limited() ) {
@@ -96 +99 @@
             $this->create_post( $application_data );
             $this->notify_applicant_application_received(
-                    $this->get_organizer_email(),
-                    $this->get_event_location()
+                $this->get_organizer_email(),
+                $this->get_event_location()
             );
 
@@ -223 +226 @@
         $message = sprintf(
             __(
-                "Thank you for applying to organize a %s in %s! We'll send you a follow-up e-mail once we've had a chance to review your application.",
+                "Thank you for applying to organize a %1\$s in %2\$s! We'll send you a follow-up e-mail once we've had a chance to review your application.",
                 'wpct'
             ),
-            $this->get_event_label(), sanitize_text_field( $event_city )
+            $this->get_event_label(),
+            sanitize_text_field( $event_city )
         );
 
@@ -238 +242 @@
 
         // Not translating because this will be sent to community events slack channel.
-        $message = sprintf( "A %s application for %s has been received.", $this->get_event_label(), $this->get_event_location() );
+        $message = sprintf( 'A %s application for %s has been received.', $this->get_event_label(), $this->get_event_location() );
 
         $public_report_url = $this->get_application_report_url();
         if ( isset( $public_report_url ) ) {
             // `<%s|here> is syntax for slack message to hyperlink text `here` with url provided in `%s`
-            $message = sprintf( "%s Public status can be followed on <%s|%s application report page>.", $message, $public_report_url, $this->get_event_label() );
+            $message = sprintf( '%s Public status can be followed on <%s|%s application report page>.', $message, $public_report_url, $this->get_event_label() );
         }
 
         $default_status = $this->get_default_status();
-        $queue_size = wp_count_posts( $post_type=$this->get_event_type() )->$default_status;
+        $queue_size = wp_count_posts( $this->get_event_type() )->$default_status;
         if ( isset( $queue_size ) ) {
             $singular = "is $queue_size application";
             $plural   = "are $queue_size applications";
             $message = sprintf(
-                    "%s\n _There %s in vetting queue._",
-                    $message,
-                    1 === $queue_size ? $singular : $plural );
-        }
-
-        $attachment = create_event_attachment( $message,  sprintf( "New %s application ", $this->get_event_label() ) );
+                "%s\n _There %s in vetting queue._",
+                $message,
+                1 === $queue_size ? $singular : $plural
+            );
+        }
+
+        $attachment = create_event_attachment( $message,  sprintf( 'New %s application ', $this->get_event_label() ) );
         return wcpt_slack_notify( COMMUNITY_TEAM_SLACK, $attachment );
     }