WordPress.org
Get WordPress

Make WordPress Core

Ticket #58511: updatedtrackback.patch

File updatedtrackback.patch, 1.0 KB (added by utsav72640, 15 months ago)

  • src/wp-trackback.php 

    diff --git a/src/wp-trackback.php b/src/wp-trackback.php
index 7512e33fb4..569870f220 100644
    a b $trackback_url = isset( $_POST['url'] ) ? $_POST['url'] : ''; 
    5454$charset       = isset( $_POST['charset'] ) ? $_POST['charset'] : '';
    5555
    5656// These three are stripslashed here so they can be properly escaped after mb_convert_encoding().
    57 $title     = isset( $_POST['title'] ) ? wp_unslash( $_POST['title'] ) : '';
    58 $excerpt   = isset( $_POST['excerpt'] ) ? wp_unslash( $_POST['excerpt'] ) : '';
    59 $blog_name = isset( $_POST['blog_name'] ) ? wp_unslash( $_POST['blog_name'] ) : '';
     57$title     = isset( $_POST['title'] ) ? sanitize_text_field( wp_unslash( $_POST['title'] ) ) : '';
     58$excerpt   = isset( $_POST['excerpt'] ) ? sanitize_textarea_field( wp_unslash( $_POST['excerpt'] ) ) : '';
     59$blog_name = isset( $_POST['blog_name'] ) ? sanitize_text_field( wp_unslash( $_POST['blog_name'] ) ) : '';
    6060
    6161if ( $charset ) {
    6262        $charset = str_replace( array( ',', ' ' ), '', strtoupper( trim( $charset ) ) );