Ticket #24248: 24248.3.diff

src/wp-includes/post.php

@@ -3039 +3039 @@
                 'context' => '',
         );
 
-        $postarr = wp_parse_args($postarr, $defaults);
+        if ( ! empty( $postarr['guid'] ) ) {
+                $guid = esc_url_raw( $postarr['guid'] );
+        }
 
+        $postarr = wp_parse_args( $postarr, $defaults );
+
         unset( $postarr[ 'filter' ] );
 
         $postarr = sanitize_post($postarr, 'db');
@@ -3048 +3052 @@
         // Are we updating or creating?
         $post_ID = 0;
         $update = false;
-        $guid = $postarr['guid'];
 
         if ( ! empty( $postarr['ID'] ) ) {
                 $update = true;
@@ -3063 +3066 @@
                         return 0;
                 }
 
-                $guid = get_post_field( 'guid', $post_ID );
-                $previous_status = get_post_field('post_status', $post_ID );
+                $guid = get_post_field( 'guid', $post_ID, 'raw' );
+                $previous_status = get_post_field( 'post_status', $post_ID, 'raw' );
         } else {
                 $previous_status = 'new';
         }
@@ -3149 +3152 @@
         } else {
                 // On updates, we need to check to see if it's using the old, fixed sanitization context.
                 $check_name = sanitize_title( $post_name, '', 'old-save' );
-                if ( $update && strtolower( urlencode( $post_name ) ) == $check_name && get_post_field( 'post_name', $post_ID ) == $check_name ) {
+                if ( $update && strtolower( urlencode( $post_name ) ) == $check_name && get_post_field( 'post_name', $post_ID, 'raw' ) == $check_name ) {
                         $post_name = $check_name;
                 } else { // new post, or slug has changed.
-                        $post_name = sanitize_title($post_name);
+                        $post_name = sanitize_title( $post_name );
                 }
         }
 
@@ -3410 +3413 @@
                 }
         }
 
-        $current_guid = get_post_field( 'guid', $post_ID );
+        $current_guid = get_post_field( 'guid', $post_ID, 'raw' );
 
         // Set GUID.
         if ( ! $update && '' == $current_guid ) {

tests/phpunit/tests/post.php

@@ -1258 +1258 @@
                 $this->assertEquals( 0, get_post( $page_id )->post_parent );
         }
 
+        /**
+         * Tests 'guid' not properly escaped
+         * @ticket 24248
+         */
+        function test_wp_guid_escaped_properly() {
+                $guid = 'http://example.org/?p=77&test=blah';
+                //Insert new post with guid
+                $id = wp_insert_post( array(
+                        'post_author' => $this->author_id,
+                        'post_status' => 'new',
+                        'post_content' => rand_str(),
+                        'post_title' => rand_str(),
+                        'guid' => $guid,
+                ) );
+                $post = get_post( $id );
+
+                $this->assertEquals( $guid, $post->guid );
+
+                //Update post
+                $id = wp_update_post( array(
+                        'ID' => $id,
+                        'post_status' => 'publish',
+                        'post_content' => rand_str(),
+                        'post_title' => rand_str(),
+                ) );
+                $post = get_post( $id );
+
+                $this->assertEquals( $guid, $post->guid );
+        }
 }