Changeset 11344

Timestamp:

05/15/2009 09:27:39 PM (16 years ago)

Author:

ryan

Message:

Escape posts passed as objects. Props Denis-de-Bernardy. fixes #9727

File:

• trunk/wp-includes/post.php (modified) (1 diff)

trunk/wp-includes/post.php

@@ -1612 +1612 @@
  * @since 1.0.0
  *
- * @param array|object $postarr Post data.
+ * @param array|object $postarr Post data. Arrays are expected to be escaped, objects are not.
  * @return int 0 on failure, Post ID on success.
  */
 function wp_update_post($postarr = array()) {
-    if ( is_object($postarr) )
+    if ( is_object($postarr) ) {
+        // non-escaped post was passed
         $postarr = get_object_vars($postarr);
+        $postarr = add_magic_quotes($postarr);
+    }
 
     // First, get all of the original fields