jrfnl/wordpress-seo — pull request #2 by Faison (2014-01-21 03:08:56+00:00)
Title: Addressing the security TODOs assigned to me.

Hi @jrfnl,

I addressed nearly all of your todos!
* Removed unused global variables
* Removed use of `$_REQUEST` in favor of `$_GET`
* Added proper validations to the bulk editor ajax functions (though the javascript is only alerting "Failure" for invalid calls at the moment)
* Sanitized variables used in queries
* Used `$wpdb->prepare` where required
* Added code to only show posts/page/CPTs for which the current user is able to edit (this includes a check for `edit_others_posts` and if said post belongs to the current user)

There's only one thing that I can't get to work, and I've been racking my brain over it for the past 1.5 hours: I want to add a custom capability of `wpseo_bulk_edit` to the default user roles `administrator`, `editor`, `author`, and `contributor`. So I added the code to `wpseo_activate()`, along with code to remove the capabilities in `wpseo_deactivate`, and updated the calls to `add_submenu_page()` to use the capability `wpseo_bulk_edit`, but no luck.

So this pull request does not include the code that adds the capabilities, but the issue could be related to a Fatal error that occurs on activation in `/inc/class-wpseo-options.php` on line 2309. I can get that the error to show up if I delete the plugin from WordPress, reinstall it, go to the plugins list, and activate the plugin. The reason I feel it could be related is because I added an `add_action()` call, above the one in `/admin/class-admin.php` on line 54, to run the add capabilities function with a priority of 1 and it worked.

What do you think?

Thanks,
Faison