Ticket #3095: 3095b.diff
| File 3095b.diff, 2.6 KB (added by , 18 years ago) |
|---|
-
wp-admin/options.php
10 10 if ( !current_user_can('manage_options') ) 11 11 wp_die(__('Cheatin’ uh?')); 12 12 13 function sanitize_option($option, $value) { 13 function sanitize_option($option, $value) { // Remember to call stripslashes! 14 14 15 15 switch ($option) { 16 16 case 'admin_email': 17 $value = stripslashes($value); 17 18 $value = sanitize_email($value); 18 19 break; 19 20 20 21 case 'default_post_edit_rows': 21 22 case 'mailserver_port': 22 23 case 'comment_max_links': 24 $value = stripslashes($value); 23 25 $value = abs((int) $value); 24 26 break; 25 27 26 28 case 'posts_per_page': 27 29 case 'posts_per_rss': 30 $value = stripslashes($value); 28 31 $value = (int) $value; 29 32 if ( empty($value) ) $value = 1; 30 33 if ( $value < -1 ) $value = abs($value); … … 32 35 33 36 case 'default_ping_status': 34 37 case 'default_comment_status': 38 $value = stripslashes($value); 35 39 // Options that if not there have 0 value but need to be something like "closed" 36 40 if ( $value == '0' || $value == '') 37 41 $value = 'closed'; … … 40 44 case 'blogdescription': 41 45 case 'blogname': 42 46 if (current_user_can('unfiltered_html') == false) 43 $value = wp_filter_post_kses( $value ); 47 $value = wp_filter_post_kses( $value ); // calls stripslashes then addslashes 48 $value = stripslashes($value); 44 49 break; 45 50 46 51 case 'blog_charset': 47 $value = preg_replace('/[^a-zA-Z0-9_-]/', '', $value); 52 $value = preg_replace('/[^a-zA-Z0-9_-]/', '', $value); // strips slashes 48 53 break; 49 54 50 55 case 'date_format': … … 55 60 case 'ping_sites': 56 61 case 'upload_path': 57 62 $value = strip_tags($value); 58 $value = wp_filter_kses($value); 63 $value = wp_filter_kses($value); // calls stripslashes then addslashes 64 $value = stripslashes($value); 59 65 break; 60 66 61 67 case 'gmt_offset': 62 $value = preg_replace('/[^0-9:.-]/', '', $value); 68 $value = preg_replace('/[^0-9:.-]/', '', $value); // strips slashes 63 69 break; 64 70 65 71 case 'siteurl': 66 72 case 'home': 73 $value = stripslashes($value); 67 74 $value = clean_url($value); 68 75 break; 76 default : 77 $value = stripslashes($value); 78 break; 69 79 } 70 80 71 81 return $value; … … 89 99 if ($options) { 90 100 foreach ($options as $option) { 91 101 $option = trim($option); 92 $value = trim( stripslashes($_POST[$option]));93 $value = sanitize_option($option, $value); 102 $value = trim($_POST[$option]); 103 $value = sanitize_option($option, $value); // This does stripslashes on those that need it 94 104 update_option($option, $value); 95 105 } 96 106 }