Ticket #16101: sanitize-numeric-term-fields.patch

taxonomy.php

@@ -1387 +1387 @@
         $select = "SELECT term_id FROM $wpdb->terms as t WHERE ";
         $tax_select = "SELECT tt.term_id, tt.term_taxonomy_id FROM $wpdb->terms AS t INNER JOIN $wpdb->term_taxonomy as tt ON tt.term_id = t.term_id WHERE ";
 
-        if ( is_int($term) ) {
+        if ( is_numeric($term) ) {
                 if ( 0 == $term )
                         return 0;
                 $where = 't.term_id = %d';
@@ -1452 +1452 @@
  */
 function sanitize_term($term, $taxonomy, $context = 'display') {
 
-        if ( 'raw' == $context )
-                return $term;
+        $fields = array('term_id', 'name', 'description', 'slug', 'count', 'parent', 'term_group', 'term_taxonomy_id');
 
-        $fields = array('term_id', 'name', 'description', 'slug', 'count', 'parent', 'term_group');
-
         $do_object = false;
         if ( is_object($term) )
                 $do_object = true;
@@ -1508 +1505 @@
  * @return mixed sanitized field
  */
 function sanitize_term_field($field, $value, $term_id, $taxonomy, $context) {
-        if ( 'parent' == $field  || 'term_id' == $field || 'count' == $field || 'term_group' == $field ) {
-                $value = (int) $value;
-                if ( $value < 0 )
-                        $value = 0;
+        // Make sure all numeric fields are integers
+        if ( in_array($field, array( 'parent', 'term_id', 'count', 'term_group', 'term_taxonomy_id'))) {
+                $value = max((int) $value, 0);
         }
 
         if ( 'raw' == $context )