Changeset 20661

Timestamp:

04/30/2012 09:56:32 PM (13 years ago)

Author:

ryan

Message:

setup-config.php cleanups

• Don't allow an empty prefix
• Make slashing consistent and sane

Props SergeyBiryukov
Fixes #13839

File:

• trunk/wp-admin/setup-config.php (modified) (5 diffs)

trunk/wp-admin/setup-config.php

@@ -161 +161 @@
 
     case 2:
-    $dbname  = trim($_POST['dbname']);
-    $uname   = trim($_POST['uname']);
-    $passwrd = trim($_POST['pwd']);
-    $dbhost  = trim($_POST['dbhost']);
-    $prefix  = trim($_POST['prefix']);
-    if ( empty($prefix) )
-        $prefix = 'wp_';
-
-    // Validate $prefix: it can only contain letters, numbers and underscores
+    foreach ( array( 'dbname', 'uname', 'pwd', 'dbhost', 'prefix' ) as $key )
+        $$key = trim( stripslashes( $_POST[ $key ] ) );
+
+    $tryagain_link = '</p><p class="step"><a href="setup-config.php?step=1" onclick="javascript:history.go(-1);return false;" class="button">' . __( 'Try Again' ) . '</a>';
+
+    if ( empty( $prefix ) )
+        wp_die( __( '<strong>ERROR</strong>: "Table Prefix" must not be empty.' . $tryagain_link ) );
+
+    // Validate $prefix: it can only contain letters, numbers and underscores.
     if ( preg_match( '|[^a-z0-9_]|i', $prefix ) )
-        wp_die( __( '<strong>ERROR</strong>: "Table Prefix" can only contain numbers, letters, and underscores.' ) );
+        wp_die( __( '<strong>ERROR</strong>: "Table Prefix" can only contain numbers, letters, and underscores.' . $tryagain_link ) );
 
     // Test the db connection.
@@ -179 +179 @@
     define('DB_NAME', $dbname);
     define('DB_USER', $uname);
-    define('DB_PASSWORD', $passwrd);
+    define('DB_PASSWORD', $pwd);
     define('DB_HOST', $dbhost);
     /**#@-*/
@@ -185 +185 @@
     // We'll fail here if the values are no good.
     require_wp_db();
-    if ( ! empty( $wpdb->error ) ) {
-        $back = '<p class="step"><a href="setup-config.php?step=1" onclick="javascript:history.go(-1);return false;" class="button">' . __( 'Try Again' ) . '</a></p>';
-        wp_die( $wpdb->error->get_error_message() . $back );
-    }
+    if ( ! empty( $wpdb->error ) )
+        wp_die( $wpdb->error->get_error_message() . $tryagain_link );
 
     // Fetch or generate keys and salts.
@@ -222 +220 @@
     foreach ( $config_file as &$line ) {
         if ( '$table_prefix  =' == substr( $line, 0, 16 ) ) {
-            $line = '$table_prefix  = \'' . $prefix . "';\r\n";
+            $line = '$table_prefix  = \'' . addcslashes( $prefix, "\\'" ) . "';\r\n";
             continue;
         }
@@ -237 +235 @@
             case 'DB_PASSWORD' :
             case 'DB_HOST'     :
-                $line = "define('" . $constant . "'," . $padding . "'" . constant( $constant ) . "');\r\n";
+                $line = "define('" . $constant . "'," . $padding . "'" . addcslashes( constant( $constant ), "\\'" ) . "');\r\n";
                 break;
             case 'AUTH_KEY'         :