Ticket #10729: 10729.2.patch

wp-admin/page.php

@@ -112 +112 @@
                 $last_user_name = $last_user ? $last_user->display_name : __('Somebody');
                 $message = sprintf( __( 'Warning: %s is currently editing this page' ), esc_html( $last_user_name ) );
                 $message = str_replace( "'", "\'", "<div class='error'><p>$message</p></div>" );
-                add_action('admin_notices', create_function( '', "echo '$message';" ) );
+                add_action('admin_notices', create_function( "\$message = '$message'", 'echo $message;' ) );
         } else {
                 wp_set_post_lock( $post->ID );
                 wp_enqueue_script('autosave');

wp-admin/post.php

@@ -147 +147 @@
                 $last_user_name = $last_user ? $last_user->display_name : __('Somebody');
                 $message = sprintf( __( 'Warning: %s is currently editing this post' ), esc_html( $last_user_name ) );
                 $message = str_replace( "'", "\'", "<div class='error'><p>$message</p></div>" );
-                add_action('admin_notices', create_function( '', "echo '$message';" ) );
+                add_action('admin_notices', create_function( "\$html = '$message'", 'echo $html;' ) );
         } else {
                 wp_set_post_lock( $post->ID );
                 wp_enqueue_script('autosave');

wp-includes/pomo/po.php

@@ -146 +146 @@
          * @param string $with prepend lines with this string
          */
         function prepend_each_line($string, $with) {
+                // FIXME codeinjection is possible here, this needs to be changed
                 $php_with = var_export($with, true);
                 $lines = explode("\n", $string);
                 // do not prepend the string on the last empty line, artefact by explode
                 if ("\n" == substr($string, -1)) unset($lines[count($lines) - 1]);
-                $res = implode("\n", array_map(create_function('$x', "return $php_with.\$x;"), $lines));
+                // FIXME codeinjection is done actually here
+                $res = implode("\n", array_map(create_function('$x, $pre = ""', "return $php_with.\$x;"), $lines));
                 // give back the empty line, we ignored above
                 if ("\n" == substr($string, -1)) $res .= "\n";
                 return $res;

wp-includes/formatting.php

@@ -2620 +2620 @@
 function links_add_base_url( $content, $base, $attrs = array('src', 'href') ) {
         $attrs = implode('|', (array)$attrs);
         return preg_replace_callback("!($attrs)=(['\"])(.+?)\\2!i",
-                        create_function('$m', 'return _links_add_base($m, "' . $base . '");'),
+                        create_function('$m, $base = ". $base ."', 'return _links_add_base($m, $base);'),
                         $content);
 }
 
@@ -2661 +2661 @@
 function links_add_target( $content, $target = '_blank', $tags = array('a') ) {
         $tags = implode('|', (array)$tags);
         return preg_replace_callback("!<($tags)(.+?)>!i",
-                        create_function('$m', 'return _links_add_target($m, "' . $target . '");'),
+                        create_function('$m, $target="' . $target . '"', 'return _links_add_target($m, $target);'),
                         $content);
 }
 /**

wp-includes/gettext.php

@@ -346 +346 @@
                         $func_body = "
                                 \$plural = ($expression);
                                 return (\$plural <= $nplurals)? \$plural : \$plural - 1;";
+                        // FIXME might be prone to code injection
                         $this->select_string_function = create_function('$n', $func_body);
                 }
                 return call_user_func($this->select_string_function, $n);

wp-includes/theme.php

@@ -886 +886 @@
         if ( validate_file($_GET['template']) )
                 return;
 
-        add_filter( 'template', create_function('', "return '{$_GET['template']}';") );
+        add_filter( 'template', create_function("\$template = '{$_GET['template']}'", "return $template;") );
 
         if ( isset($_GET['stylesheet']) ) {
                 $_GET['stylesheet'] = preg_replace('|[^a-z0-9_./-]|i', '', $_GET['stylesheet']);
                 if ( validate_file($_GET['stylesheet']) )
                         return;
-                add_filter( 'stylesheet', create_function('', "return '{$_GET['stylesheet']}';") );
+                add_filter( 'stylesheet', create_function("\$stylesheet = '{$_GET['stylesheet']}'", "return $stylesheet;") );
         }
 
         // Prevent theme mods to current theme being used on theme being previewed