Make WordPress Core


Ignore:
Timestamp:
02/14/2013 10:51:06 PM (12 years ago)
Author:
ryan
Message:

Change all core API to expect unslashed rather than slashed arguments.

The exceptions to this are update_post_meta() and add_post_meta() which are often used by plugins in POST handlers and will continue accepting slashed data for now.

Introduce wp_upate_post_meta() and wp_add_post_meta() as unslashed alternatives to update_post_meta() and add_post_meta(). These functions could become methods in WP_Post so don't use them too heavily yet.

Remove all escape() calls from wp_xmlrpc_server. Now that core expects unslashed data this is no longer needed.

Remove addslashes(), addslashes_gpc(), add_magic_quotes() calls on data being prepared for handoff to core functions that until now expected slashed data. Adding slashes in no longer necessary.

Introduce wp_unslash() and use to it remove slashes from GPCS data before using it in core API. Almost every instance of stripslashes() in core should now be wp_unslash(). In the future (a release or three) when GPCS is no longer slashed, wp_unslash() will stop stripping slashes and simply return what is passed. At this point wp_unslash() calls can be removed from core.

Introduce wp_slash() for slashing GPCS data. This will also turn into a noop once GPCS is no longer slashed. wp_slash() should almost never be used. It is mainly of use in unit tests.

Plugins should use wp_unslash() on data being passed to core API.

Plugins should no longer slash data being passed to core. So when you get_post() and then wp_insert_post() the post data from get_post() no longer needs addslashes(). Most plugins were not bothering with this. They will magically start doing the right thing. Unfortunately, those few souls who did it properly will now have to avoid calling addslashes() for 3.6 and newer.

Use wp_kses_post() and wp_kses_data(), which expect unslashed data, instead of wp_filter_post_kses() and wp_filter_kses(), which expect slashed data. Filters are no longer passed slashed data.

Remove many no longer necessary calls to $wpdb->escape() and esc_sql().

In wp_get_referer() and wp_get_original_referer(), return unslashed data.

Remove old stripslashes() calls from WP_Widget::update() handlers. These haven't been necessary since WP_Widget.

Switch several queries over to prepare().

Expect something to break.

Props alexkingorg
see #21767

File:
1 edited

Legend:

Unmodified
Added
Removed
  • trunk/wp-includes/post.php

    r23415 r23416  
    17431743 *
    17441744 * @param int $post_id Post ID.
    1745  * @param string $meta_key Metadata name.
    1746  * @param mixed $meta_value Metadata value.
     1745 * @param string $meta_key Metadata name (expected slashed).
     1746 * @param mixed $meta_value Metadata value (expected slashed).
    17471747 * @param bool $unique Optional, default is false. Whether the same key should not be added.
    17481748 * @return bool False for failure. True for success.
    17491749 */
    1750 function add_post_meta($post_id, $meta_key, $meta_value, $unique = false) {
     1750function add_post_meta( $post_id, $meta_key, $meta_value, $unique = false ) {
     1751    //_deprecated_function( __FUNCTION__, '3.6', 'wp_add_post_meta() (expects unslashed data)' );
     1752
     1753    // expected slashed
     1754    $meta_key = stripslashes( $meta_key );
     1755    $meta_value = stripslashes_deep( $meta_value );
     1756
     1757    return wp_add_post_meta( $post_id, $meta_key, $meta_value, $unique );
     1758}
     1759
     1760/**
     1761 * Add meta data field to a post.
     1762 *
     1763 * Post meta data is called "Custom Fields" on the Administration Screen.
     1764 *
     1765 * @since 3.6.0
     1766 * @link http://codex.wordpress.org/Function_Reference/wp_add_post_meta
     1767 *
     1768 * @param int $post_id Post ID.
     1769 * @param string $meta_key Metadata name (clean, slashes already stripped).
     1770 * @param mixed $meta_value Metadata value (clean, slashes already stripped).
     1771 * @param bool $unique Optional, default is false. Whether the same key should not be added.
     1772 * @return bool False for failure. True for success.
     1773 */
     1774function wp_add_post_meta( $post_id, $meta_key, $meta_value, $unique = false ) {
    17511775    // make sure meta is added to the post, not a revision
    1752     if ( $the_post = wp_is_post_revision($post_id) )
     1776    if ( $the_post = wp_is_post_revision( $post_id ) )
    17531777        $post_id = $the_post;
    17541778
    1755     return add_metadata('post', $post_id, $meta_key, $meta_value, $unique);
     1779    return add_metadata( 'post', $post_id, $meta_key, $meta_value, $unique );
    17561780}
    17571781
     
    18101834 *
    18111835 * @param int $post_id Post ID.
    1812  * @param string $meta_key Metadata key.
    1813  * @param mixed $meta_value Metadata value.
     1836 * @param string $meta_key Metadata key (expected slashed).
     1837 * @param mixed $meta_value Metadata value (expected slashed).
    18141838 * @param mixed $prev_value Optional. Previous value to check before removing.
    18151839 * @return bool False on failure, true if success.
    18161840 */
    1817 function update_post_meta($post_id, $meta_key, $meta_value, $prev_value = '') {
     1841function update_post_meta( $post_id, $meta_key, $meta_value, $prev_value = '' ) {
     1842    //_deprecated_function( __FUNCTION__, '3.6', 'wp_update_post_meta() (expects unslashed data)' );
     1843
     1844    // expected slashed
     1845    $meta_key = stripslashes( $meta_key );
     1846    $meta_value = stripslashes_deep( $meta_value );
     1847
     1848    return wp_update_post_meta( $post_id, $meta_key, $meta_value, $prev_value );
     1849}
     1850
     1851/**
     1852 * Update post meta field based on post ID.
     1853 *
     1854 * Use the $prev_value parameter to differentiate between meta fields with the
     1855 * same key and post ID.
     1856 *
     1857 * If the meta field for the post does not exist, it will be added.
     1858 *
     1859 * @since 3.6.0
     1860 * @uses $wpdb
     1861 * @link http://codex.wordpress.org/Function_Reference/wp_update_post_meta
     1862 *
     1863 * @param int $post_id Post ID.
     1864 * @param string $meta_key Metadata key (clean, slashes already stripped).
     1865 * @param mixed $meta_value Metadata value (clean, slashes already stripped).
     1866 * @param mixed $prev_value Optional. Previous value to check before removing.
     1867 * @return bool False on failure, true if success.
     1868 */
     1869function wp_update_post_meta( $post_id, $meta_key, $meta_value, $prev_value = '' ) {
    18181870    // make sure meta is added to the post, not a revision
    1819     if ( $the_post = wp_is_post_revision($post_id) )
     1871    if ( $the_post = wp_is_post_revision( $post_id ) )
    18201872        $post_id = $the_post;
    18211873
    1822     return update_metadata('post', $post_id, $meta_key, $meta_value, $prev_value);
     1874    return update_metadata( 'post', $post_id, $meta_key, $meta_value, $prev_value );
    18231875}
    18241876
     
    24072459    do_action('wp_trash_post', $post_id);
    24082460
    2409     add_post_meta($post_id,'_wp_trash_meta_status', $post['post_status']);
    2410     add_post_meta($post_id,'_wp_trash_meta_time', time());
     2461    wp_add_post_meta($post_id,'_wp_trash_meta_status', $post['post_status']);
     2462    wp_add_post_meta($post_id,'_wp_trash_meta_time', time());
    24112463
    24122464    $post['post_status'] = 'trash';
     
    24842536    foreach ( $comments as $comment )
    24852537        $statuses[$comment->comment_ID] = $comment->comment_approved;
    2486     add_post_meta($post_id, '_wp_trash_meta_comments_status', $statuses);
     2538    wp_add_post_meta($post_id, '_wp_trash_meta_comments_status', $statuses);
    24872539
    24882540    // Set status for all comments to post-trashed
     
    28602912    $post_name = wp_unique_post_slug($post_name, $post_ID, $post_status, $post_type, $post_parent);
    28612913
    2862     // expected_slashed (everything!)
    28632914    $data = compact( array( 'post_author', 'post_date', 'post_date_gmt', 'post_content', 'post_content_filtered', 'post_title', 'post_excerpt', 'post_status', 'post_type', 'comment_status', 'ping_status', 'post_password', 'post_name', 'to_ping', 'pinged', 'post_modified', 'post_modified_gmt', 'post_parent', 'menu_order', 'guid' ) );
    28642915    $data = apply_filters('wp_insert_post_data', $data, $postarr);
    2865     $data = stripslashes_deep( $data );
    28662916    $where = array( 'ID' => $post_ID );
    28672917
     
    28762926    } else {
    28772927        if ( isset($post_mime_type) )
    2878             $data['post_mime_type'] = stripslashes( $post_mime_type ); // This isn't in the update
     2928            $data['post_mime_type'] = $post_mime_type; // This isn't in the update
    28792929        // If there is a suggested ID, use it if not already present
    28802930        if ( !empty($import_id) ) {
     
    29372987                return 0;
    29382988        }
    2939         update_post_meta($post_ID, '_wp_page_template',  $page_template);
     2989        wp_update_post_meta($post_ID, '_wp_page_template',  $page_template);
    29402990    }
    29412991
     
    29703020        // non-escaped post was passed
    29713021        $postarr = get_object_vars($postarr);
    2972         $postarr = add_magic_quotes($postarr);
    29733022    }
    29743023
    29753024    // First, get all of the original fields
    29763025    $post = get_post($postarr['ID'], ARRAY_A);
    2977 
    2978     // Escape data pulled from DB.
    2979     $post = add_magic_quotes($post);
    29803026
    29813027    // Passed post category list overwrites existing category list if not empty.
     
    33933439        foreach( (array) $trackback_urls as $tb_url) {
    33943440            $tb_url = trim($tb_url);
    3395             trackback($tb_url, stripslashes($post_title), $excerpt, $post_id);
     3441            trackback($tb_url, $post_title, $excerpt, $post_id);
    33963442        }
    33973443    }
     
    37363782        $join = " LEFT JOIN $wpdb->postmeta ON ( $wpdb->posts.ID = $wpdb->postmeta.post_id )";
    37373783
    3738         // meta_key and meta_value might be slashed
    3739         $meta_key = stripslashes($meta_key);
    3740         $meta_value = stripslashes($meta_value);
    37413784        if ( ! empty( $meta_key ) )
    37423785            $where .= $wpdb->prepare(" AND $wpdb->postmeta.meta_key = %s", $meta_key);
     
    39634006        $post_name = sanitize_title($post_name);
    39644007
    3965     // expected_slashed ($post_name)
    39664008    $post_name = wp_unique_post_slug($post_name, $post_ID, $post_status, $post_type, $post_parent);
    39674009
     
    40064048        $pinged = '';
    40074049
    4008     // expected_slashed (everything!)
    40094050    $data = compact( array( 'post_author', 'post_date', 'post_date_gmt', 'post_content', 'post_content_filtered', 'post_title', 'post_excerpt', 'post_status', 'post_type', 'comment_status', 'ping_status', 'post_password', 'post_name', 'to_ping', 'pinged', 'post_modified', 'post_modified_gmt', 'post_parent', 'menu_order', 'post_mime_type', 'guid' ) );
    4010     $data = stripslashes_deep( $data );
    40114051
    40124052    if ( $update ) {
     
    40534093
    40544094    if ( ! empty( $context ) )
    4055         add_post_meta( $post_ID, '_wp_attachment_context', $context, true );
     4095        wp_add_post_meta( $post_ID, '_wp_attachment_context', $context, true );
    40564096
    40574097    if ( $update) {
     
    44404480    // if we haven't added this old slug before, add it now
    44414481    if ( !empty( $post_before->post_name ) && !in_array($post_before->post_name, $old_slugs) )
    4442         add_post_meta($post_id, '_wp_old_slug', $post_before->post_name);
     4482        wp_add_post_meta($post_id, '_wp_old_slug', $post_before->post_name);
    44434483
    44444484    // if the new slug was used previously, delete it from the list
     
    48574897
    48584898    if ( get_option('default_pingback_flag') )
    4859         add_post_meta( $post_id, '_pingme', '1' );
    4860     add_post_meta( $post_id, '_encloseme', '1' );
     4899        wp_add_post_meta( $post_id, '_pingme', '1' );
     4900    wp_add_post_meta( $post_id, '_encloseme', '1' );
    48614901
    48624902    wp_schedule_single_event(time(), 'do_pings');
     
    50985138
    50995139    $post = _wp_post_revision_fields( $post, $autosave );
    5100     $post = add_magic_quotes($post); //since data is from db
    51015140
    51025141    $revision_id = wp_insert_post( $post );
     
    51765215
    51775216    $update['ID'] = $revision['post_parent'];
    5178 
    5179     $update = add_magic_quotes( $update ); //since data is from db
    51805217
    51815218    $post_id = wp_update_post( $update );
     
    54005437    if ( $post && $thumbnail_id && get_post( $thumbnail_id ) ) {
    54015438        if ( $thumbnail_html = wp_get_attachment_image( $thumbnail_id, 'thumbnail' ) )
    5402             return update_post_meta( $post->ID, '_thumbnail_id', $thumbnail_id );
     5439            return wp_update_post_meta( $post->ID, '_thumbnail_id', $thumbnail_id );
    54035440        else
    54045441            return delete_post_meta( $post->ID, '_thumbnail_id' );
Note: See TracChangeset for help on using the changeset viewer.