missing escape in wp_update_post?

[Denis-de-Bernardy]

Noticed this while looking into #9539. wp_update_post() starts like this:

function wp_update_post($postarr = array()) {
	if ( is_object($postarr) )
		$postarr = get_object_vars($postarr);

	// First, get all of the original fields
	$post = wp_get_single_post($postarr['ID'], ARRAY_A);

	// Escape data pulled from DB.
	$post = add_magic_quotes($post);

Shouldn't it be:

function wp_update_post($postarr = array()) {
	if ( is_object($postarr) ) {
		// non-escaped post was passed
		$postarr = get_object_vars($postarr);
		$postarr = add_magic_quotes($postarr);
	}

	// First, get all of the original fields
	$post = wp_get_single_post($postarr['ID'], ARRAY_A);

	// Escape data pulled from DB.
	$post = add_magic_quotes($post);

[hakre]

documentation says:

 * @param array|object $postarr Post data.

i am still waiting on a developers feedback what this means when nothing is stated: raw or slashed.

ryan (?) once said lateöy all functions assume slashed if not otherwise noted. i doubted that but i can not find the ticket. a general statement would be really usefull.

[Denis-de-Bernardy]

in case it should...

[Denis-de-Bernardy]

see: ​http://core.trac.wordpress.org/ticket/9640#comment:21

[Denis-de-Bernardy]

see also: #9822

[ryan]

We generally assume slashed, yes, although in this case it looks like we have a loophole for things passed as an object. Changing it might break existing expectations. Perhaps update phpdoc to note that objects are not expected slashed.

[ryan]

I don't see a single place in trunk that passes an object, so I can't tell what current expectations are. Assuming an object to be not-escaped makes sense though.

[Denis-de-Bernardy]

added this to the end of my wp-config.php file to give it a try:

$post_id = 119;
$post = get_post($post_id);
dump($post->post_title); // string(41) "Comment on Quisque \' Eget Dolor by admin"
wp_update_post($post);
unset($post);
$post = get_post($post_id); // string(40) "Comment on Quisque ' Eget Dolor by admin"
dump($post->post_title);

[Denis-de-Bernardy]

there might be other similar functions that need some attention.

[ryan]

[11344]