Ticket #9602: 9602.patch

wp-includes/classes.php

@@ -214 +214 @@
 
                                         // Trim the query of everything up to the '?'.
                                         $query = preg_replace("!^.+\?!", '', $query);
-
                                         // Substitute the substring matches into the query.
-                                        eval("@\$query = \"" . addslashes($query) . "\";");
+                                        $query = addslashes(WP_MatchesMapRegex::exec($query, $matches));
 
                                         $this->matched_query = $query;
 
@@ -1592 +1591 @@
         }
 }
 
+/**
+ * WP_MatchesMapRegex
+ *  
+ * helper class to prevent the usage of eval to replace $matches[] in query strings.
+ */
+class WP_MatchesMapRegex {
+        /**
+         * store for matches
+         * 
+         * @access private
+         * @var array
+         */
+        var $_matches;
+        
+        /**
+         * store for mapping result
+         * 
+         * @access public
+         * @var string
+         */
+        var $output;
+        
+        /**
+         * subject to perform mapping on (query string containing $matches[] references
+         * 
+         * @access private
+         * @var string
+         */
+        var $_subject;
+        
+        /**
+         * regexp pattern to match $matches[] references 
+         * 
+         * @var string
+         */
+        var $_pattern = '(\$matches\[[1-9]+[0-9]*\])'; // magic number
+        
+        /**
+         * constructor
+         * 
+         * @param string $subject subject if regex
+         * @param array  $matches data to use in map
+         * @return self
+         */                                             
+        function WP_MatchesMapRegex($subject, $matches) {
+                $this->_subject = $subject;
+                $this->_matches = $matches;
+                $this->output = $this->_map();                          
+        }
+        
+        /**
+         * Substitute substring matches in subject.
+         * 
+         * static helper function to ease use
+         * 
+         * @access public
+         * @param string $subject subject
+         * @param array  $matches data used for subsitution
+         * @return string
+         */
+        function exec($subject, $matches) {
+                $oSelf =& new WP_MatchesMapRegex($subject, $matches);
+                return $oSelf->output;                                                                                                                          
+        }
+        
+        /**
+         * do the actual mapping 
+         * 
+         * @access private
+         * @return string
+         */
+        function _map() {
+                $callback = array(&$this, 'callback');
+                return preg_replace_callback($this->_pattern, $callback, $this->_subject);
+        }
+        
+        /**
+         * preg_replace_callback hook
+         * 
+         * @access public
+         * @param  array $matches preg_replace regexp matches
+         * @return string
+         */
+        function callback($matches) {
+                return $this->_matches[intval(substr($matches[0], 9, -1))];
+        }
+        
+}
+
 ?>

wp-includes/rewrite.php

@@ -299 +299 @@
                         $query = preg_replace("!^.+\?!", '', $query);
 
                         // Substitute the substring matches into the query.
-                        eval("\$query = \"" . addslashes($query) . "\";");
+                        $query = addslashes(WP_MatchesMapRegex::exec($query, $matches));
                         // Filter out non-public query vars
                         global $wp;
                         parse_str($query, $query_vars);