Changeset 18018 for branches/3.1/wp-admin/includes/post.php

Timestamp:

05/24/2011 03:53:22 PM (14 years ago)

Author:

ryan

Message:

Sanitize guid on save and display. Sanitize mime type on save. Don't allow changing mime type via edit form handlers. Protect hidden meta.

Location:

branches/3.1

Files:

• . (modified) (1 prop)
• wp-admin/includes/post.php (modified) (7 diffs)

branches/3.1/wp-admin/includes/post.php

@@ -139 +139 @@
     $post = get_post( $post_ID );
     $post_data['post_type'] = $post->post_type;
+    $post_data['post_mime_type'] = $post->post_mime_type;
 
     $ptype = get_post_type_object($post_data['post_type']);
@@ -200 +201 @@
             if ( $meta->post_id != $post_ID )
                 continue;
+            if ( is_protected_meta( $key ) )
+                continue;
             update_meta( $key, $value['key'], $value['value'] );
         }
@@ -209 +212 @@
                 continue;
             if ( $meta->post_id != $post_ID )
+                continue;
+            if ( is_protected_meta( $key ) )
                 continue;
             delete_meta( $key );
@@ -528 +533 @@
     }
 
+    $_POST['post_mime_type'] = '';
+
     // Check for autosave collisions
     // Does this need to be updated? ~ Mark
@@ -633 +640 @@
     $post_ID = (int) $post_ID;
 
-    $protected = array( '_wp_attached_file', '_wp_attachment_metadata', '_wp_old_slug', '_wp_page_template' );
-
     $metakeyselect = isset($_POST['metakeyselect']) ? stripslashes( trim( $_POST['metakeyselect'] ) ) : '';
     $metakeyinput = isset($_POST['metakeyinput']) ? stripslashes( trim( $_POST['metakeyinput'] ) ) : '';
@@ -651 +656 @@
             $metakey = $metakeyinput; // default
 
-        if ( in_array($metakey, $protected) )
+        if ( is_protected_meta( $metakey ) )
             return false;
 
@@ -757 +762 @@
     global $wpdb;
 
-    $protected = array( '_wp_attached_file', '_wp_attachment_metadata', '_wp_old_slug', '_wp_page_template' );
-
     $meta_key = stripslashes($meta_key);
 
-    if ( in_array($meta_key, $protected) )
+    if ( is_protected_meta( $meta_key ) )
         return false;