Ticket #7197: no_magic_quotes_on_passwords.patch

wp-includes/functions.php

@@ -1325 +1325 @@
  * @param array $array Array to used to walk while sanitizing contents.
  * @return array Sanitized $array.
  */
-function add_magic_quotes( $array ) {
+function add_magic_quotes( $array, $donottouch=array() ) {
         global $wpdb;
-
         foreach ( (array) $array as $k => $v ) {
                 if ( is_array( $v ) ) {
                         $array[$k] = add_magic_quotes( $v );
-                } else {
+                } elseif ( !in_array($k, $donottouch) ) {
                         $array[$k] = $wpdb->escape( $v );
                 }
         }

wp-settings.php

@@ -582 +582 @@
 
 // Escape with wpdb.
 $_GET    = add_magic_quotes($_GET   );
-$_POST   = add_magic_quotes($_POST  );
+$_POST   = add_magic_quotes($_POST, $donottouch=array('pwd','pass1','pass2') );
 $_COOKIE = add_magic_quotes($_COOKIE);
 $_SERVER = add_magic_quotes($_SERVER);
 

wp-admin/includes/user.php

@@ -148 +148 @@
                         $errors->add( 'pass', __( '<strong>ERROR</strong>: Please enter your password twice.' ), array( 'form-field' => 'pass2' ) );
         }
 
-        /* Check for "\" in password */
-        if( strpos( " ".$pass1, "\\" ) )
-                $errors->add( 'pass', __( '<strong>ERROR</strong>: Passwords may not contain the character "\\".' ), array( 'form-field' => 'pass1' ) );
-
         /* checking the password has been typed twice the same */
         if ( $pass1 != $pass2 )
                 $errors->add( 'pass', __( '<strong>ERROR</strong>: Please enter the same password in the two password fields.' ), array( 'form-field' => 'pass1' ) );