Ticket #38609: 38609.0.diff

src/wp-includes/rest-api/endpoints/class-wp-rest-attachments-controller.php

@@ -142 +142 @@
                         $attachment->post_title = preg_replace( '/\.[^.]+$/', '', basename( $file ) );
                 }
 
-                $id = wp_insert_post( $attachment, true );
+                $id = wp_insert_post( wp_slash( $attachment ), true );
 
                 if ( is_wp_error( $id ) ) {
                         if ( 'db_update_error' === $id->get_error_code() ) {
@@ -369 +369 @@
                         'description'     => __( 'The caption for the resource.' ),
                         'type'            => 'string',
                         'context'         => array( 'view', 'edit' ),
-                        'arg_options'     => array(
-                                'sanitize_callback' => 'wp_filter_post_kses',
-                        ),
                 );
 
                 $schema['properties']['description'] = array(
                         'description'     => __( 'The description for the resource.' ),
                         'type'            => 'string',
                         'context'         => array( 'view', 'edit' ),
-                        'arg_options'     => array(
-                                'sanitize_callback' => 'wp_filter_post_kses',
-                        ),
                 );
 
                 $schema['properties']['media_type'] = array(

src/wp-includes/rest-api/endpoints/class-wp-rest-posts-controller.php

@@ -483 +483 @@
                 }
 
                 $post->post_type = $this->post_type;
-                $post_id         = wp_insert_post( $post, true );
+                $post_id         = wp_insert_post( wp_slash( $post ), true );
 
                 if ( is_wp_error( $post_id ) ) {
 
@@ -619 +619 @@
                 }
 
                 // convert the post object to an array, otherwise wp_update_post will expect non-escaped input.
-                $post_id = wp_update_post( (array) $post, true );
+                $post_id = wp_update_post( wp_slash( (array) $post ), true );
 
                 if ( is_wp_error( $post_id ) ) {
                         if ( 'db_update_error' === $post_id->get_error_code() ) {
@@ -955 +955 @@
                 // Post title.
                 if ( ! empty( $schema['properties']['title'] ) && isset( $request['title'] ) ) {
                         if ( is_string( $request['title'] ) ) {
-                                $prepared_post->post_title = wp_filter_post_kses( $request['title'] );
+                                $prepared_post->post_title = $request['title'];
                         } elseif ( ! empty( $request['title']['raw'] ) ) {
-                                $prepared_post->post_title = wp_filter_post_kses( $request['title']['raw'] );
+                                $prepared_post->post_title = $request['title']['raw'];
                         }
                 }
 
                 // Post content.
                 if ( ! empty( $schema['properties']['content'] ) && isset( $request['content'] ) ) {
                         if ( is_string( $request['content'] ) ) {
-                                $prepared_post->post_content = wp_filter_post_kses( $request['content'] );
+                                $prepared_post->post_content = $request['content'];
                         } elseif ( isset( $request['content']['raw'] ) ) {
-                                $prepared_post->post_content = wp_filter_post_kses( $request['content']['raw'] );
+                                $prepared_post->post_content = $request['content']['raw'];
                         }
                 }
 
                 // Post excerpt.
                 if ( ! empty( $schema['properties']['excerpt'] ) && isset( $request['excerpt'] ) ) {
                         if ( is_string( $request['excerpt'] ) ) {
-                                $prepared_post->post_excerpt = wp_filter_post_kses( $request['excerpt'] );
+                                $prepared_post->post_excerpt = $request['excerpt'];
                         } elseif ( isset( $request['excerpt']['raw'] ) ) {
-                                $prepared_post->post_excerpt = wp_filter_post_kses( $request['excerpt']['raw'] );
+                                $prepared_post->post_excerpt = $request['excerpt']['raw'];
                         }
                 }
 

src/wp-includes/rest-api/endpoints/class-wp-rest-terms-controller.php

@@ -379 +379 @@
 
                 $prepared_term = $this->prepare_item_for_database( $request );
 
-                $term = wp_insert_term( $prepared_term->name, $this->taxonomy, $prepared_term );
+                $term = wp_insert_term( $prepared_term->name, $this->taxonomy, wp_slash( $prepared_term ) );
                 if ( is_wp_error( $term ) ) {
                         /*
                          * If we're going to inform the client that the term already exists,
@@ -490 +490 @@
 
                 // Only update the term if we haz something to update.
                 if ( ! empty( $prepared_term ) ) {
-                        $update = wp_update_term( $term->term_id, $term->taxonomy, (array) $prepared_term );
+                        $update = wp_update_term( $term->term_id, $term->taxonomy, wp_slash( (array) $prepared_term ) );
 
                         if ( is_wp_error( $update ) ) {
                                 return $update;
@@ -818 +818 @@
                                         'type'         => 'string',
                                         'context'      => array( 'view', 'edit' ),
                                         'arg_options'  => array(
-                                                'sanitize_callback' => 'wp_filter_post_kses',
+                                                'sanitize_callback' => 'wp_kses_post',
                                         ),
                                 ),
                                 'link'        => array(

src/wp-includes/rest-api/endpoints/class-wp-rest-users-controller.php

@@ -409 +409 @@
                         }
 
                         $user->ID = $user_id;
-                        $user_id  = wp_update_user( $user );
+                        $user_id  = wp_update_user( wp_slash( $user ) );
 
                         if ( is_wp_error( $user_id ) ) {
                                 return $user_id;
                         }
                 } else {
-                        $user_id = wp_insert_user( $user );
+                        $user_id = wp_insert_user( wp_slash( $user ) );
 
                         if ( is_wp_error( $user_id ) ) {
                                 return $user_id;
@@ -530 +530 @@
                 // Ensure we're operating on the same user we already checked.
                 $user->ID = $id;
 
-                $user_id = wp_update_user( $user );
+                $user_id = wp_update_user( wp_slash( $user ) );
 
                 if ( is_wp_error( $user_id ) ) {
                         return $user_id;
@@ -970 +970 @@
                                         'type'        => 'string',
                                         'context'     => array( 'embed', 'view', 'edit' ),
                                         'arg_options' => array(
-                                                'sanitize_callback' => 'wp_filter_post_kses',
+                                                'sanitize_callback' => 'wp_kses_post',
                                         ),
                                 ),
                                 'link'        => array(