FILTER_SANITIZE_FULL_SPECIAL_CHARS instead of FILTER_SANITIZE_STRING

lloc · Aug 8, 2023 · 000840e · 000840e
1 parent 6edfa3f
commit 000840e
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 6 deletions.
diff --git a/includes/ContentImport/Importers/WithRequestPostAttributes.php b/includes/ContentImport/Importers/WithRequestPostAttributes.php
@@ -32,6 +32,6 @@ protected function read_post_type_from_request( $default = 'post' ) {
 			return $default;
 		}
 
-		return filter_var( $_REQUEST['post_type'], FILTER_SANITIZE_STRING ) ?: 'post';
+		return filter_var( $_REQUEST['post_type'], FILTER_SANITIZE_FULL_SPECIAL_CHARS ) ?: 'post';
 	}
 }
diff --git a/includes/MslsMetaBox.php b/includes/MslsMetaBox.php
@@ -361,11 +361,8 @@ public function set( $post_id ) {
 			return;
 		}
 
-		$capability = (
-		'page' == filter_input( INPUT_POST, 'post_type', FILTER_SANITIZE_STRING ) ?
-			'edit_page' :
-			'edit_post'
-		);
+		$post_type  = filter_input( INPUT_POST, 'post_type', FILTER_SANITIZE_FULL_SPECIAL_CHARS );
+		$capability = 'page' === $post_type ? 'edit_page' : 'edit_post';
 
 		if ( ! current_user_can( $capability, $post_id ) ) {
 			return;