Ticket #16600: patch.16600a.diff

wordpress/wp-includes/formatting.php

@@ -769 +769 @@
 }
 
 /**
+ * Sanitize "object" name, stripping out unsafe characters.
+ *
+ * Leaves only alphanumeric caracters, underscore and dash 
+ * (a.k.a. 'identifier'); Preserves case
+ *
+ * @since 3.1.0
+ *
+ * @param string $name The name to be sanitized.
+ * @return string The sanitized object name.
+ */
+function sanitize_objectname( $name ) {
+        $name = wp_strip_all_tags( $name );
+        $name = remove_accents( $name );
+        // Kill octets
+        $name = preg_replace( '|%([a-fA-F0-9][a-fA-F0-9])|', '', $name );
+        $name = preg_replace( '/&.+?;/', '', $name ); // Kill entities
+        // ensure only "alnum"
+        $name = preg_replace('|[^A-Za-z0-9_]|', '', $name );
+        
+        // Remove extra spaces and return
+        return trim( $name );
+}
+
+
+/**
  * Sanitize a string key.
  *
  * Keys are used as internal identifiers. Lowercase alphanumeric characters, dashes and underscores are allowed.

wordpress/wp-includes/post.php

@@ -808 +808 @@
 function get_post_type_object( $post_type ) {
         global $wp_post_types;
 
+        $post_type = sanitize_objectname($post_type);
         if ( empty($wp_post_types[$post_type]) )
                 return null;
 
@@ -912 +913 @@
         $args = wp_parse_args($args, $defaults);
         $args = (object) $args;
 
-        $post_type = sanitize_key($post_type);
+        $post_type = sanitize_objectname($post_type);
         $args->name = $post_type;
 
         if ( strlen( $post_type ) > 20 )
@@ -1224 +1225 @@
 function add_post_type_support( $post_type, $feature ) {
         global $_wp_post_type_features;
 
+        $post_type = sanitize_objectname($post_type);
         $features = (array) $feature;
         foreach ($features as $feature) {
                 if ( func_num_args() == 2 )
@@ -1243 +1245 @@
 function remove_post_type_support( $post_type, $feature ) {
         global $_wp_post_type_features;
 
+        $post_type=sanitize_objectname($post_type);
         if ( !isset($_wp_post_type_features[$post_type]) )
                 return;
 
@@ -1262 +1265 @@
 function post_type_supports( $post_type, $feature ) {
         global $_wp_post_type_features;
 
+        $post_type=sanitize_objectname($post_type);
         if ( !isset( $_wp_post_type_features[$post_type][$feature] ) )
                 return false;
 

wordpress/wp-includes/taxonomy.php

@@ -295 +295 @@
         if ( ! is_array($wp_taxonomies) )
                 $wp_taxonomies = array();
 
+        $taxonomy = sanitize_objectname($taxonomy);
+
         $defaults = array(      'hierarchical' => false,
                                                 'update_count_callback' => '',
                                                 'rewrite' => true,
@@ -352 +354 @@
         unset( $args['capabilities'] );
 
         $args['name'] = $taxonomy;
-        $args['object_type'] = (array) $object_type;
+
+        // Setup object types this applies to, sanitizing names
+        $ot = (array) $object_type;
+        $args['object_type'] = array_map('sanitize_objectname',$ot);
 
         $args['labels'] = get_taxonomy_labels( (object) $args );
         $args['label'] = $args['labels']->name;
@@ -429 +434 @@
 function register_taxonomy_for_object_type( $taxonomy, $object_type) {
         global $wp_taxonomies;
 
+        $taxonomy = sanitize_objectname($taxonomy);
         if ( !isset($wp_taxonomies[$taxonomy]) )
                 return false;
 
+        $object_type = sanitize_objectname($object_type);
         if ( ! get_post_type_object($object_type) )
                 return false;