Changeset 8085 for sites/trunk/wordcamp.org/public_html/wp-content/plugins/wcpt/wcpt-meetup/class-meetup-application.php

Timestamp:

01/16/2019 03:36:24 PM (6 years ago)

Author:

vedjain

Message:

WCPT: Applies code standard changes to wcpt plugin.

Most of the changes are small, but these are some important ones:

1. Added nonce check in multiple places. This will ensure that request is always coming from the intended page.

2. Escaped output HTML in many places. These are not necessarily XSS vulnerabilities, and in most places they were hardcoded. But its a good practice to always escape regardless of source.

Summary:

• wcpt-event/class-event-admin.php
  • Added nonce check in metabox_save.
  • Escaped output in dislpay_meta_boxes

• wcpt-event/class-event-application.php
  • Change definition of submit_application to pass $POST arguments

• wcpt-loader.php
  • Indent whole file by 1 indent.

• wcpt-meetup/class-meetup-admin.php
  • Added nonce check in maybe_update_meetup_data

• wcpt-wordcamp/wordcamp-admin.php
  • Escaping in user_profile_wordcamp, column_data
  • Escaping using kses in post_row_actions
  • Use post_data_raw instead of $_POST in enforce_post_status

File:

• sites/trunk/wordcamp.org/public_html/wp-content/plugins/wcpt/wcpt-meetup/class-meetup-application.php (modified) (4 diffs)

sites/trunk/wordcamp.org/public_html/wp-content/plugins/wcpt/wcpt-meetup/class-meetup-application.php

@@ -81 +81 @@
      * Enqueue scripts and stylesheets.
      */
-    function enqueue_assets() {
+    public function enqueue_assets() {
         global $post;
 
@@ -162 +162 @@
      */
     public function get_default_application_values() {
-        // WordCamp uses an ID with questions. Not sure how are they used. Ask @corey
+        // WordCamp uses an ID with questions. Not sure how are they used. Ask @corey.
         $values = array(
             'q_name'                => '',
@@ -232 +232 @@
         add_post_meta( $post_id, 'Meetup Location', $data['q_mtp_loc'] );
         add_post_meta(
-            $post_id, '_status_change', array(
+            $post_id,
+            '_status_change',
+            array(
                 'timestamp' => time(),
                 'user_id'   => $wordcamp_user_id,
@@ -279 +281 @@
      */
     public static function get_application_report_url() {
-        return "https://central.wordcamp.org/reports/meetup-applications/";
+        return 'https://central.wordcamp.org/reports/meetup-applications/';
     }