Ticket #38073: 38073.4.diff

src/wp-admin/comment.php

@@ -16 +16 @@
  * @global string $action
  */
 global $action;
-wp_reset_vars( array( 'action' ) );
 
+if ( ! empty( $_REQUEST['action'] ) ) {
+        $action = sanitize_text_field( $_REQUEST['action'] );
+}
 if ( isset( $_POST['deletecomment'] ) ) {
         $action = 'deletecomment';
 }

src/wp-admin/customize.php

@@ -84 +84 @@
         }
 }
 
+if ( ! empty( $_REQUEST['url'] ) ) {
+        $url = sanitize_text_field( $_REQUEST['url'] );
+}
+
+if ( ! empty( $_REQUEST['return'] ) ) {
+        $return = sanitize_text_field( $_REQUEST['return'] );
+}
+
+if ( ! empty( $_REQUEST['autofocus'] ) ) {
+        $autofocus = sanitize_text_field( $_REQUEST['autofocus'] );
+}
 
-wp_reset_vars( array( 'url', 'return', 'autofocus' ) );
 if ( ! empty( $url ) ) {
         $wp_customize->set_preview_url( wp_unslash( $url ) );
 }

src/wp-admin/edit-tag-form.php

@@ -44 +44 @@
         do_action( 'edit_tag_form_pre', $tag );
 }
 
-/**
- * Use with caution, see https://codex.wordpress.org/Function_Reference/wp_reset_vars
- */
-wp_reset_vars( array( 'wp_http_referer' ) );
+if ( ! empty( $_REQUEST['wp_http_referer'] ) ) {
+        $wp_http_referer = sanitize_text_field( $_REQUEST['wp_http_referer'] );
+}
+
 
 $wp_http_referer = remove_query_arg( array( 'action', 'message', 'tag_ID' ), $wp_http_referer );
 

src/wp-admin/includes/class-wp-links-list-table.php

@@ -51 +51 @@
         public function prepare_items() {
                 global $cat_id, $s, $orderby, $order;
 
-                wp_reset_vars( array( 'action', 'cat_id', 'link_id', 'orderby', 'order', 's' ) );
+                if ( ! empty( $_REQUEST['action'] ) ) {
+                        $action = sanitize_text_field( $_REQUEST['action'] );
+                }
+
+                if ( ! empty( $_REQUEST['cat_id'] ) ) {
+                        $cat_id = sanitize_text_field( $_REQUEST['cat_id'] );
+                }
+
+                if ( ! empty( $_REQUEST['link_id'] ) ) {
+                        $link_id = sanitize_text_field( $_REQUEST['link_id'] );
+                }
+
+                if ( ! empty( $_REQUEST['orderby'] ) ) {
+                        $orderby = sanitize_text_field( $_REQUEST['orderby'] );
+                }
+
+                if ( ! empty( $_REQUEST['order'] ) ) {
+                        $order = sanitize_text_field( $_REQUEST['order'] );
+                }
+
+                if ( ! empty( $_REQUEST['s'] ) ) {
+                        $s = sanitize_text_field( $_REQUEST['s'] );
+                }
 
                 $args = array(
                         'hide_invisible' => 0,

src/wp-admin/includes/class-wp-ms-themes-list-table.php

@@ -88 +88 @@
         public function prepare_items() {
                 global $status, $totals, $page, $orderby, $order, $s;
 
-                wp_reset_vars( array( 'orderby', 'order', 's' ) );
+                if ( ! empty( $_REQUEST['orderby'] ) ) {
+                        $orderby = sanitize_text_field( $_REQUEST['orderby'] );
+                }
+
+                if ( ! empty( $_REQUEST['order'] ) ) {
+                        $order = sanitize_text_field( $_REQUEST['order'] );
+                }
+
+                if ( ! empty( $_REQUEST['s'] ) ) {
+                        $s = sanitize_text_field( $_REQUEST['s'] );
+                }
 
                 $themes = array(
                         /**

src/wp-admin/includes/class-wp-plugin-install-list-table.php

@@ -89 +89 @@
 
                 global $tabs, $tab, $paged, $type, $term;
 
-                wp_reset_vars( array( 'tab' ) );
+                if ( ! empty( $_REQUEST['tab'] ) ) {
+                        $tab = sanitize_text_field( $_REQUEST['tab'] );
+                }
 
                 $paged = $this->get_pagenum();
 

src/wp-admin/includes/class-wp-plugins-list-table.php

@@ -77 +77 @@
         public function prepare_items() {
                 global $status, $plugins, $totals, $page, $orderby, $order, $s;
 
-                wp_reset_vars( array( 'orderby', 'order' ) );
+                if ( ! empty( $_REQUEST['orderby'] ) ) {
+                        $orderby = sanitize_text_field( $_REQUEST['orderby'] );
+                }
+
+                if ( ! empty( $_REQUEST['order'] ) ) {
+                        $order = sanitize_text_field( $_REQUEST['order'] );
+                }
 
                 /**
                  * Filters the full array of plugins to list in the Plugins list table.

src/wp-admin/includes/class-wp-theme-install-list-table.php

@@ -37 +37 @@
                 include( ABSPATH . 'wp-admin/includes/theme-install.php' );
 
                 global $tabs, $tab, $paged, $type, $theme_field_defaults;
-                wp_reset_vars( array( 'tab' ) );
+
+                if ( ! empty( $_REQUEST['tab'] ) ) {
+                        $tab = sanitize_text_field( $_REQUEST['tab'] );
+                }
 
                 $search_terms  = array();
                 $search_string = '';

src/wp-admin/includes/deprecated.php

@@ -1514 +1514 @@
         </script>
         <?php
 }
+
+/**
+ * Resets global variables based on $_GET and $_POST
+ *
+ * This function resets global variables based on the names passed
+ * in the $vars array to the value of $_POST[$var] or $_GET[$var] or ''
+ * if neither is defined.
+ *
+ * @since 2.0.0
+ * @deprecated 5.3.0
+ *
+ * @param array $vars An array of globals to reset.
+ */
+function wp_reset_vars( $vars ) {
+
+        _deprecated_function( __FUNCTION__, '5.3.0' );
+
+        foreach ( $vars as $var ) {
+                if ( empty( $_POST[ $var ] ) ) {
+                        if ( empty( $_GET[ $var ] ) ) {
+                                $GLOBALS[ $var ] = '';
+                        } else {
+                                $GLOBALS[ $var ] = $_GET[ $var ];
+                        }
+                } else {
+                        $GLOBALS[ $var ] = $_POST[ $var ];
+                }
+        }
+}

src/wp-admin/includes/misc.php

@@ -481 +481 @@
         }
 }
 
-
-/**
- * Resets global variables based on $_GET and $_POST
- *
- * This function resets global variables based on the names passed
- * in the $vars array to the value of $_POST[$var] or $_GET[$var] or ''
- * if neither is defined.
- *
- * @since 2.0.0
- *
- * @param array $vars An array of globals to reset.
- */
-function wp_reset_vars( $vars ) {
-        foreach ( $vars as $var ) {
-                if ( empty( $_POST[ $var ] ) ) {
-                        if ( empty( $_GET[ $var ] ) ) {
-                                $GLOBALS[ $var ] = '';
-                        } else {
-                                $GLOBALS[ $var ] = $_GET[ $var ];
-                        }
-                } else {
-                        $GLOBALS[ $var ] = $_POST[ $var ];
-                }
-        }
-}
-
 /**
  * Displays the given administration message.
  *

src/wp-admin/link-add.php

@@ -16 +16 @@
 $title       = __( 'Add New Link' );
 $parent_file = 'link-manager.php';
 
-wp_reset_vars( array( 'action', 'cat_id', 'link_id' ) );
+if ( ! empty( $_REQUEST['action'] ) ) {
+        $action = sanitize_text_field( $_REQUEST['action'] );
+}
+
+if ( ! empty( $_REQUEST['cat_id'] ) ) {
+        $cat_id = sanitize_text_field( $_REQUEST['cat_id'] );
+}
+
+if ( ! empty( $_REQUEST['link_id'] ) ) {
+        $link_id = absint( $_REQUEST['link_id'] );
+}
 
 wp_enqueue_script( 'link' );
 wp_enqueue_script( 'xfn' );

src/wp-admin/link.php

@@ -12 +12 @@
 /** Load WordPress Administration Bootstrap */
 require_once( dirname( __FILE__ ) . '/admin.php' );
 
-wp_reset_vars( array( 'action', 'cat_id', 'link_id' ) );
+if ( ! empty( $_REQUEST['action'] ) ) {
+        $action = sanitize_text_field( $_REQUEST['action'] );
+}
+
+if ( ! empty( $_REQUEST['cat_id'] ) ) {
+        $cat_id = sanitize_text_field( $_REQUEST['cat_id'] );
+}
+
+if ( ! empty( $_REQUEST['link_id'] ) ) {
+        $link_id = absint( $_REQUEST['link_id'] );
+}
 
 if ( ! current_user_can( 'manage_links' ) ) {
         wp_link_manager_disabled_message();

src/wp-admin/media.php

@@ -12 +12 @@
 $parent_file  = 'upload.php';
 $submenu_file = 'upload.php';
 
-wp_reset_vars( array( 'action' ) );
+if ( ! empty( $_REQUEST['action'] ) ) {
+        $action = sanitize_text_field( $_REQUEST['action'] );
+}
 
 switch ( $action ) {
         case 'editattachment':

src/wp-admin/options-head.php

@@ -8 +8 @@
  * @subpackage Administration
  */
 
-wp_reset_vars( array( 'action' ) );
+if ( ! empty( $_REQUEST['action'] ) ) {
+        $action = sanitize_text_field( $_REQUEST['action'] );
+}
 
 if ( isset( $_GET['updated'] ) && isset( $_GET['page'] ) ) {
         // For back-compat with plugins that don't use the Settings API and just set updated=1 in the redirect.

src/wp-admin/options.php

@@ -22 +22 @@
 $this_file   = 'options.php';
 $parent_file = 'options-general.php';
 
-wp_reset_vars( array( 'action', 'option_page' ) );
+if ( ! empty( $_REQUEST['action'] ) ) {
+        $action = sanitize_text_field( $_REQUEST['action'] );
+}
+
+if ( ! empty( $_REQUEST['option_page'] ) ) {
+        $cat_id = sanitize_text_field( $_REQUEST['option_page'] );
+}
 
 $capability = 'manage_options';
 

src/wp-admin/post.php

@@ -14 +14 @@
 $parent_file  = 'edit.php';
 $submenu_file = 'edit.php';
 
-wp_reset_vars( array( 'action' ) );
+if ( ! empty( $_REQUEST['action'] ) ) {
+        $action = sanitize_text_field( $_REQUEST['action'] );
+}
 
 if ( isset( $_GET['post'] ) && isset( $_POST['post_ID'] ) && (int) $_GET['post'] !== (int) $_POST['post_ID'] ) {
         wp_die( __( 'A post ID mismatch has been detected.' ), __( 'Sorry, you are not allowed to edit this item.' ), 400 );

src/wp-admin/revision.php

@@ -21 +21 @@
  * @global int    $from     The revision to compare from.
  * @global int    $to       Optional, required if revision missing. The revision to compare to.
  */
-wp_reset_vars( array( 'revision', 'action', 'from', 'to' ) );
+if ( ! empty( $_REQUEST['revision'] ) ) {
+        $revision_id = absint( $_REQUEST['revision'] );
+}
 
-$revision_id = absint( $revision );
+if ( ! empty( $_REQUEST['action'] ) ) {
+        $action = sanitize_text_field( $_REQUEST['action'] );
+}
 
-$from = is_numeric( $from ) ? absint( $from ) : null;
-if ( ! $revision_id ) {
-        $revision_id = absint( $to );
+if ( ! empty( $_REQUEST['from'] ) ) {
+        $from = is_numeric( $_REQUEST['from'] ) ? absint( $_REQUEST['from'] ) : null;
 }
+
+if ( ! empty( $_REQUEST['to'] ) && ! $revision_id ) {
+        $revision_id = absint( $_REQUEST['to'] );
+}
+
 $redirect = 'edit.php';
 
 switch ( $action ) {

src/wp-admin/theme-editor.php

@@ -52 +52 @@
         '<p>' . __( '<a href="https://wordpress.org/support/">Support Forums</a>' ) . '</p>'
 );
 
-wp_reset_vars( array( 'action', 'error', 'file', 'theme' ) );
+if ( ! empty( $_REQUEST['action'] ) ) {
+        $action = sanitize_text_field( $_REQUEST );
+}
+
+if ( ! empty( $_REQUEST['error'] ) ) {
+        $error = true;
+}
+
+if ( ! empty( $_REQUEST['theme'] ) ) {
+        $theme = sanitize_text_field( $_REQUEST['theme'] );
+}
+
+if ( ! empty( $_REQUEST['file'] ) ) {
+        $file = sanitize_text_field( $_REQUEST['file'] );
+}
 
 if ( $theme ) {
         $stylesheet = $theme;
@@ -172 +186 @@
         }
 
         $file_description = get_file_description( $relative_file );
-        $file_show        = array_search( $file, array_filter( $allowed_files ) );
+        $file_show        = arraysearch( $file, array_filter( $allowed_files ) );
         $description      = esc_html( $file_description );
         if ( $file_description != $file_show ) {
                 $description .= ' <span>(' . esc_html( $file_show ) . ')</span>';

src/wp-admin/theme-install.php

@@ -10 +10 @@
 require_once( dirname( __FILE__ ) . '/admin.php' );
 require( ABSPATH . 'wp-admin/includes/theme-install.php' );
 
-wp_reset_vars( array( 'tab' ) );
+if ( ! empty( $_REQUEST['tab'] ) ) {
+        $tab = sanitize_text_field( $_REQUEST['tab'] );
+}
 
 if ( ! current_user_can( 'install_themes' ) ) {
         wp_die( __( 'Sorry, you are not allowed to install themes on this site.' ) );

src/wp-admin/themes.php

@@ -150 +150 @@
 } else {
         $themes = wp_prepare_themes_for_js( array( wp_get_theme() ) );
 }
-wp_reset_vars( array( 'theme', 'search' ) );
+
+if ( ! empty( $_REQUEST['theme'] ) ) {
+        $theme = sanitize_text_field( $_REQUEST['theme'] );
+}
+
+if ( ! empty( $_REQUEST['search'] ) ) {
+        $search = sanitize_text_field( $_REQUEST['search'] );
+}
 
 wp_localize_script(
         'theme',

src/wp-admin/user-edit.php

@@ -9 +9 @@
 /** WordPress Administration Bootstrap */
 require_once( dirname( __FILE__ ) . '/admin.php' );
 
-wp_reset_vars( array( 'action', 'user_id', 'wp_http_referer' ) );
+if ( ! empty( $_REQUEST['action'] ) ) {
+        $action = sanitize_text_field( $_REQUEST['action'] );
+}
+
+if ( ! empty( $_REQUEST['user_id'] ) ) {
+        $user_id = absint( $_REQUEST['user_id'] );
+}
+
+if ( ! empty( $_REQUEST['wp_http_referer'] ) ) {
+        $wp_http_referer = sanitize_text_field( $_REQUEST['wp_http_referer'] );
+}
 
-$user_id      = (int) $user_id;
 $current_user = wp_get_current_user();
 if ( ! defined( 'IS_PROFILE_PAGE' ) ) {
         define( 'IS_PROFILE_PAGE', ( $user_id == $current_user->ID ) );