← All changes | includes/features/bbpc_attachments/code/class.php +10 -5 2.4.3 → 2.5.1 View file →

		@@ -84,18 +84,23 @@
84	84	}
85	85
86	86	public function delete_attachments() {
87	87	if ( isset( $_GET['d4pbbaction'] ) ) {
88		- $nonce = wp_verify_nonce( $_GET['_wpnonce'], 'd4p-bbpress-attachments' );
	88	+ $nonce = isset( $_GET['_wpnonce'] ) && wp_verify_nonce( sanitize_text_field( wp_unslash( $_GET['_wpnonce'] ) ), 'd4p-bbpress-attachments' );
	89	+ $post = isset( $_GET['bbp_id'] ) ? get_post( intval( $_GET['bbp_id'] ) ) : null;
89	90
90		- if ( $nonce ) {
	91	+ if ( $nonce && $post && isset( $_GET['att_id'] ) ) {
91	92	global $user_ID;
92	93
93		- $action = $_GET['d4pbbaction'];
	94	+ $action = sanitize_key( wp_unslash( $_GET['d4pbbaction'] ) );
94	95	$att_id = intval( $_GET['att_id'] );
95		- $bbp_id = intval( $_GET['bbp_id'] );
	96	+ $bbp_id = (int) $post->ID;
96	97
97		- $post = get_post( $bbp_id );
	98	+ // Only act on an attachment of this topic/reply, never any media ID.
	99	+ if ( 'attachment' !== get_post_type( $att_id ) || (int) wp_get_post_parent_id( $att_id ) !== $bbp_id ) {
	100	+ return;
	101	+ }
	102	+
98	103	$author_ID = $post->post_author;
99	104
100	105	$file = get_attached_file( $att_id );
101	106	$file = pathinfo( $file, PATHINFO_BASENAME );