asc/sportspress
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Sanitize and unslash all inputs

Browse Source
This commit is contained in:
Brian Miyaji
2021-11-14 13:49:51 +09:00
parent 8873e5adeb
commit a605d7ed1a
30 changed files with 98 additions and 98 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
modules/sportspress-user-registration.php
View File

@@ -105,8 +105,8 @@ if ( ! class_exists( 'SportsPress_User_Registration' ) ) :
*/
public static function register_form() {
if ( 'yes' === get_option( 'sportspress_registration_name_inputs', 'no' ) ) {
$first_name = ( ! empty( $_POST['first_name'] ) ) ? trim( sanitize_text_field( $_POST['first_name'] ) ) : '';
$last_name = ( ! empty( $_POST['last_name'] ) ) ? trim( sanitize_text_field( $_POST['last_name'] ) ) : '';
$first_name = ( ! empty( $_POST['first_name'] ) ) ? trim( sanitize_text_field( wp_unslash( $_POST['first_name'] ) ) ) : '';
$last_name = ( ! empty( $_POST['last_name'] ) ) ? trim( sanitize_text_field( wp_unslash( $_POST['last_name'] ) ) ) : '';
?>
<p>
<label for="first_name"><?php esc_attr_e( 'First Name', 'sportspress' ); ?><br />
@@ -149,22 +149,22 @@ if ( ! class_exists( 'SportsPress_User_Registration' ) ) :
// Save first and last name
if ( 'yes' === get_option( 'sportspress_registration_name_inputs', 'no' ) ) {
if ( ! empty( $_POST['first_name'] ) ) {
$meta = trim( sanitize_text_field( $_POST['first_name'] ) );
$meta = trim( sanitize_text_field( wp_unslash( $_POST['first_name'] ) ) );
$parts[] = $meta;
update_user_meta( $user_id, 'first_name', $meta );
}
if ( ! empty( $_POST['last_name'] ) ) {
$meta = trim( sanitize_text_field( $_POST['last_name'] ) );
$meta = trim( sanitize_text_field( wp_unslash( $_POST['last_name'] ) ) );
$parts[] = $meta;
update_user_meta( $user_id, 'last_name', $meta );
}
}
// Add team from team name
if ( isset( $_POST['sp_register_form_team'] ) && wp_verify_nonce( $_POST['sp_register_form_team'], 'submit_team_name' ) ) {
if ( isset( $_POST['sp_register_form_team'] ) && wp_verify_nonce( sanitize_key( $_POST['sp_register_form_team'] ), 'submit_team_name' ) ) {
if ( ! empty( $_POST['team_name'] ) ) {
$team_name = trim( sanitize_text_field( $_POST['team_name'] ) );
$team_name = trim( sanitize_text_field( wp_unslash( $_POST['team_name'] ) ) );
$post['post_type'] = 'sp_team';
$post['post_title'] = $team_name;
$post['post_author'] = $user_id;
@@ -174,9 +174,9 @@ if ( ! class_exists( 'SportsPress_User_Registration' ) ) :
}
// Save team
if ( isset( $_POST['sp_register_form_player'] ) && wp_verify_nonce( $_POST['sp_register_form_player'], 'submit_team' ) ) {
if ( isset( $_POST['sp_register_form_player'] ) && wp_verify_nonce( sanitize_key( $_POST['sp_register_form_player'] ), 'submit_team' ) ) {
if ( ! empty( $_POST['sp_team'] ) ) {
$team = trim( sanitize_text_field( $_POST['sp_team'] ) );
$team = trim( sanitize_text_field( wp_unslash( $_POST['sp_team'] ) ) );
if ( $team <= 0 ) {
$team = 0;
}
@@ -187,7 +187,7 @@ if ( ! class_exists( 'SportsPress_User_Registration' ) ) :
// Add player
if ( 'yes' === get_option( 'sportspress_registration_add_player', 'no' ) ) {
if ( ! sizeof( $parts ) && ! empty( $_POST['user_login'] ) ) {
$parts[] = trim( sanitize_text_field( $_POST['user_login'] ) );
$parts[] = trim( sanitize_text_field( wp_unslash( $_POST['user_login'] ) ) );
}
if ( sizeof( $parts ) ) {