Make WordPress Core

Ticket #35869: 35869.0.diff

File 35869.0.diff, 2.3 KB (added by westonruter, 8 years ago)
  • src/wp-includes/customize/class-wp-customize-nav-menu-item-setting.php

    diff --git src/wp-includes/customize/class-wp-customize-nav-menu-item-setting.php src/wp-includes/customize/class-wp-customize-nav-menu-item-setting.php
    index b89b56c..5317c94 100644
    class WP_Customize_Nav_Menu_Item_Setting extends WP_Customize_Setting { 
    639639                $menu_item_value['original_title'] = sanitize_text_field( $menu_item_value['original_title'] );
    640640
    641641                // Apply the same filters as when calling wp_insert_post().
    642                 $menu_item_value['title'] = apply_filters( 'title_save_pre', $menu_item_value['title'] );
    643                 $menu_item_value['attr_title'] = apply_filters( 'excerpt_save_pre', $menu_item_value['attr_title'] );
    644                 $menu_item_value['description'] = apply_filters( 'content_save_pre', $menu_item_value['description'] );
     642                $menu_item_value['title'] = wp_unslash( apply_filters( 'title_save_pre', wp_slash( $menu_item_value['title'] ) ) );
     643                $menu_item_value['attr_title'] = wp_unslash( apply_filters( 'excerpt_save_pre', wp_slash( $menu_item_value['attr_title'] ) ) );
     644                $menu_item_value['description'] = wp_unslash( apply_filters( 'content_save_pre', wp_slash( $menu_item_value['description'] ) ) );
    645645
    646646                $menu_item_value['url'] = esc_url_raw( $menu_item_value['url'] );
    647647                if ( 'publish' !== $menu_item_value['status'] ) {
    class WP_Customize_Nav_Menu_Item_Setting extends WP_Customize_Setting { 
    776776                        $r = wp_update_nav_menu_item(
    777777                                $value['nav_menu_term_id'],
    778778                                $is_placeholder ? 0 : $this->post_id,
    779                                 $menu_item_data
     779                                wp_slash( $menu_item_data )
    780780                        );
    781781
    782782                        if ( is_wp_error( $r ) ) {
  • src/wp-includes/nav-menu.php

    diff --git src/wp-includes/nav-menu.php src/wp-includes/nav-menu.php
    index 9ab6786..3b878f7 100644
    function wp_update_nav_menu_object( $menu_id = 0, $menu_data = array() ) { 
    344344/**
    345345 * Save the properties of a menu item or create a new one.
    346346 *
     347 * The menu-item-title, menu-item-description, and menu-item-attr-title are expected
     348 * to be pre-slashed since they are passed directly into <code>wp_insert_post()</code>.
     349 *
    347350 * @since 3.0.0
    348351 *
    349352 * @param int   $menu_id         The ID of the menu. Required. If "0", makes the menu item a draft orphan.