← All changes
|
src/FormBuilder/Routes/RegisterFormBuilderPageRoute.php
+9
-2
4.16.1
→
4.17.0
View file →
| @@ -62,8 +62,9 @@ | ||
| 62 | 62 | |
| 63 | 63 | /** |
| 64 | 64 | * Render page with scripts |
| 65 | 65 | * |
| 66 | + * @since 4.16.8 Read the query args without assuming they are set. | |
| 66 | 67 | * @since 3.22.0 Add locale support |
| 67 | 68 | * @since 3.1.0 set translations for scripts |
| 68 | 69 | * @since 3.0.0 |
| 69 | 70 | * |
| @@ -72,9 +73,15 @@ | ||
| 72 | 73 | public function renderPage() |
| 73 | 74 | { |
| 74 | 75 | $formBuilderViewModel = new FormBuilderViewModel(); |
| 75 | 76 | |
| 76 | - $donationFormId = abs($_GET['donationFormID']); | |
| 77 | + /* | |
| 78 | + * `abs()` raises a TypeError on an array or a non-numeric string, so the id cannot be read | |
| 79 | + * without checking its shape first. `absint()` is what the redirect guarding this route | |
| 80 | + * already uses, and anything it cannot make a number of falls to the check below. | |
| 81 | + */ | |
| 82 | + $donationFormIdParam = $_GET['donationFormID'] ?? null; | |
| 83 | + $donationFormId = is_scalar($donationFormIdParam) ? absint($donationFormIdParam) : 0; | |
| 77 | 84 | |
| 78 | 85 | // validate form exists before proceeding |
| 79 | 86 | // TODO: improve on this validation |
| 80 | 87 | if (!get_post($donationFormId)) { |
| @@ -80,9 +87,9 @@ | ||
| 80 | 87 | if (!get_post($donationFormId)) { |
| 81 | 88 | wp_die(__('Donation form does not exist.', 'give')); |
| 82 | 89 | } |
| 83 | 90 | |
| 84 | - $locale = give_clean($_GET['locale']) ?? ''; | |
| 91 | + $locale = give_clean($_GET['locale'] ?? ''); | |
| 85 | 92 | Language::switchToLocale($locale); |
| 86 | 93 | |
| 87 | 94 | wp_enqueue_style( |
| 88 | 95 | '@givewp/form-builder/registrars', |