Ticket #10126: 10126.patch

wp-includes/post.php

@@ -1977 +1977 @@
         } elseif ( in_array($post_type, $hierarchical_post_types) ) {
                 // Page slugs must be unique within their own trees.  Pages are in a
                 // separate namespace than posts so page slugs are allowed to overlap post slugs.
-                $check_sql = "SELECT post_name FROM $wpdb->posts WHERE post_name = %s AND post_type IN ( '" . implode("', '", esc_sql($hierarchical_post_types)) . "' ) AND ID != %d AND post_parent = %d LIMIT 1";
+                // FIXME $wpdb->prepare usage for $hierarchical_post_types as well
+                $check_sql = "SELECT post_name FROM $wpdb->posts WHERE post_name = %s AND post_type IN ( '" . implode("', '", array_map('esc_sql', $hierarchical_post_types)) . "' ) AND ID != %d AND post_parent = %d LIMIT 1";
                 $post_name_check = $wpdb->get_var($wpdb->prepare($check_sql, $slug, $post_ID, $post_parent));
 
                 if ( $post_name_check || in_array($slug, $feeds) ) {