UCP location/number preferences have no server-side whitelist or bound

[avandenberghe]

Summary

ucp_listener::ucp_prefs_get_data() reads the submitted UCP preferences straight from the request with no validation:

'rt_location'            => $this->request->variable('rt_location', $this->user->data['user_rt_location']),
'rt_viewforum_location'  => $this->request->variable('rt_viewforum_location', $this->user->data['user_rt_viewforum_location']),
'rt_number'              => $this->request->variable('rt_number', (int) $this->user->data['user_rt_number']),

ucp_prefs_set_data() then writes these straight into user_rt_location / user_rt_viewforum_location (VCHAR:10) and user_rt_number (UINT) with no whitelist against the real option set (RT_TOP/RT_BOTTOM/RT_SIDE, or RT_TOP/RT_BOTTOM for the viewforum variant) and no min/max clamp on the number.

A value that doesn't match a real location just fails the == comparisons used elsewhere (template display, location routing), so today this only silently hides the user's own Recent Topics block rather than causing a security issue — but it's an unvalidated, arbitrarily-long-up-to-10-char string and an unbounded integer being written straight from user input, which is more fragile than it needs to be.

Location

avathar/recenttopics/event/ucp_listener.php: ucp_prefs_get_data() (request reads, ~lines 121-126) and ucp_prefs_set_data() (writes, ~lines 253-261)

Fix

Whitelist rt_location / rt_viewforum_location against their valid option sets (falling back to the current/default value on a miss), and clamp rt_number to a sane min/max range before writing.