Make WordPress Core


Ignore:
Timestamp:
03/01/2013 04:28:40 PM (12 years ago)
Author:
ryan
Message:

Revert 23416, 23419, 23445 except for wp_reset_vars() changes. We are going a different direction with the slashing cleanup, so resetting to a clean slate. see #21767

File:
1 edited

Legend:

Unmodified
Added
Removed
  • trunk/wp-admin/edit-comments.php

    r23416 r23554  
    2121
    2222    if ( 'delete_all' == $doaction && !empty( $_REQUEST['pagegen_timestamp'] ) ) {
    23         $comment_status = $_REQUEST['comment_status'];
    24         $delete_time = $_REQUEST['pagegen_timestamp'];
    25         $comment_ids = $wpdb->get_col( $wpdb->prepare( "SELECT comment_ID FROM $wpdb->comments WHERE comment_approved = %s AND %s > comment_date_gmt", $comment_status, $delete_time ) );
     23        $comment_status = $wpdb->escape( $_REQUEST['comment_status'] );
     24        $delete_time = $wpdb->escape( $_REQUEST['pagegen_timestamp'] );
     25        $comment_ids = $wpdb->get_col( "SELECT comment_ID FROM $wpdb->comments WHERE comment_approved = '$comment_status' AND '$delete_time' > comment_date_gmt" );
    2626        $doaction = 'delete';
    2727    } elseif ( isset( $_REQUEST['delete_comments'] ) ) {
     
    9696    exit;
    9797} elseif ( ! empty( $_GET['_wp_http_referer'] ) ) {
    98      wp_redirect( remove_query_arg( array( '_wp_http_referer', '_wpnonce' ), wp_unslash( $_SERVER['REQUEST_URI'] ) ) );
     98     wp_redirect( remove_query_arg( array( '_wp_http_referer', '_wpnonce' ), stripslashes( $_SERVER['REQUEST_URI'] ) ) );
    9999     exit;
    100100}
     
    154154
    155155if ( isset($_REQUEST['s']) && $_REQUEST['s'] )
    156     printf( '<span class="subtitle">' . sprintf( __( 'Search results for &#8220;%s&#8221;' ), wp_html_excerpt( esc_html( wp_unslash( $_REQUEST['s'] ) ), 50 ) ) . '</span>' ); ?>
     156    printf( '<span class="subtitle">' . sprintf( __( 'Search results for &#8220;%s&#8221;' ), wp_html_excerpt( esc_html( stripslashes( $_REQUEST['s'] ) ), 50 ) ) . '</span>' ); ?>
    157157</h2>
    158158
Note: See TracChangeset for help on using the changeset viewer.