Changeset 23554 for trunk/wp-admin/includes/ajax-actions.php

Timestamp:

03/01/2013 04:28:40 PM (11 years ago)

Author:

ryan

Message:

Revert 23416, 23419, 23445 except for wp_reset_vars() changes. We are going a different direction with the slashing cleanup, so resetting to a clean slate. see #21767

File:

• trunk/wp-admin/includes/ajax-actions.php (modified) (26 diffs)

trunk/wp-admin/includes/ajax-actions.php

@@ -60 +60 @@
     }
 
-    $s = wp_unslash( $_GET['q'] );
+    $s = stripslashes( $_GET['q'] );
 
     $comma = _x( ',', 'tag delimiter' );
@@ -280 +280 @@
 
 function _wp_ajax_add_hierarchical_term() {
-    $post_data = wp_unslash( $_POST );
-
-    $action = $post_data['action'];
+    $action = $_POST['action'];
     $taxonomy = get_taxonomy(substr($action, 4));
     check_ajax_referer( $action, '_ajax_nonce-add-' . $taxonomy->name );
     if ( !current_user_can( $taxonomy->cap->edit_terms ) )
         wp_die( -1 );
-    $names = explode(',', $post_data['new'.$taxonomy->name]);
-    $parent = isset($post_data['new'.$taxonomy->name.'_parent']) ? (int) $post_data['new'.$taxonomy->name.'_parent'] : 0;
+    $names = explode(',', $_POST['new'.$taxonomy->name]);
+    $parent = isset($_POST['new'.$taxonomy->name.'_parent']) ? (int) $_POST['new'.$taxonomy->name.'_parent'] : 0;
     if ( 0 > $parent )
         $parent = 0;
     if ( $taxonomy->name == 'category' )
-        $post_category = isset( $post_data['post_category'] ) ? (array) $post_data['post_category'] : array();
+        $post_category = isset($_POST['post_category']) ? (array) $_POST['post_category'] : array();
     else
-        $post_category = ( isset( $post_data['tax_input'] ) && isset( $post_data['tax_input'][$taxonomy->name] ) ) ? (array) $post_data['tax_input'][$taxonomy->name] : array();
+        $post_category = ( isset($_POST['tax_input']) && isset($_POST['tax_input'][$taxonomy->name]) ) ? (array) $_POST['tax_input'][$taxonomy->name] : array();
     $checked_categories = array_map( 'absint', (array) $post_category );
     $popular_ids = wp_popular_terms_checklist($taxonomy->name, 0, 10, false);
@@ -562 +560 @@
     if ( !current_user_can( 'manage_categories' ) )
         wp_die( -1 );
-    $names = explode( ',', wp_unslash( $_POST['newcat'] ) );
+    $names = explode(',', $_POST['newcat']);
     $x = new WP_Ajax_Response();
     foreach ( $names as $cat_name ) {
@@ -575 +573 @@
         else if ( is_array( $cat_id ) )
             $cat_id = $cat_id['term_id'];
-        $cat_name = esc_html( wp_unslash( $cat_name ) );
+        $cat_name = esc_html(stripslashes($cat_name));
         $x->add( array(
             'what' => 'link-category',
@@ -589 +587 @@
     global $wp_list_table;
 
-    $post_data = wp_unslash( $_POST );
-
     check_ajax_referer( 'add-tag', '_wpnonce_add-tag' );
-    $post_type = !empty($post_data['post_type']) ? $post_data['post_type'] : 'post';
-    $taxonomy = !empty($post_data['taxonomy']) ? $post_data['taxonomy'] : 'post_tag';
+    $post_type = !empty($_POST['post_type']) ? $_POST['post_type'] : 'post';
+    $taxonomy = !empty($_POST['taxonomy']) ? $_POST['taxonomy'] : 'post_tag';
     $tax = get_taxonomy($taxonomy);
 
@@ -601 +597 @@
     $x = new WP_Ajax_Response();
 
-    $tag = wp_insert_term( $post_data['tag-name'], $taxonomy, $post_data );
+    $tag = wp_insert_term($_POST['tag-name'], $taxonomy, $_POST );
 
     if ( !$tag || is_wp_error($tag) || (!$tag = get_term( $tag['term_id'], $taxonomy )) ) {
@@ -615 +611 @@
     }
 
-    $wp_list_table = _get_list_table( 'WP_Terms_List_Table', array( 'screen' => $post_data['screen'] ) );
+    $wp_list_table = _get_list_table( 'WP_Terms_List_Table', array( 'screen' => $_POST['screen'] ) );
 
     $level = 0;
@@ -733 +729 @@
     if ( $user->exists() ) {
         $user_ID = $user->ID;
-        $comment_author       = $user->display_name;
-        $comment_author_email = $user->user_email;
-        $comment_author_url   = $user->user_url;
-        $comment_content      = trim( wp_unslash( $_POST['content'] ) );
+        $comment_author       = $wpdb->escape($user->display_name);
+        $comment_author_email = $wpdb->escape($user->user_email);
+        $comment_author_url   = $wpdb->escape($user->user_url);
+        $comment_content      = trim($_POST['content']);
         if ( current_user_can( 'unfiltered_html' ) ) {
             if ( wp_create_nonce( 'unfiltered-html-comment' ) != $_POST['_wp_unfiltered_html_comment'] ) {
@@ -962 +958 @@
     } else { // Update?
         $mid = (int) key( $_POST['meta'] );
-        $key = wp_unslash( $_POST['meta'][$mid]['key'] );
-        $value = wp_unslash( $_POST['meta'][$mid]['value'] );
+        $key = stripslashes( $_POST['meta'][$mid]['key'] );
+        $value = stripslashes( $_POST['meta'][$mid]['value'] );
         if ( '' == trim($key) )
             wp_die( __( 'Please provide a custom field name.' ) );
@@ -1232 +1228 @@
 
     if ( isset( $_POST['search'] ) )
-        $args['s'] = wp_unslash( $_POST['search'] );
+        $args['s'] = stripslashes( $_POST['search'] );
     $args['pagenum'] = ! empty( $_POST['page'] ) ? absint( $_POST['page'] ) : 1;
 
@@ -1333 +1329 @@
 
     $post = get_post( $post_ID, ARRAY_A );
+    $post = add_magic_quotes($post); //since it is from db
 
     $data['content'] = $post['post_content'];
@@ -1381 +1378 @@
     check_ajax_referer( 'taxinlineeditnonce', '_inline_edit' );
 
-    $post_data = wp_unslash( $_POST );
-
-    $taxonomy = sanitize_key( $post_data['taxonomy'] );
+    $taxonomy = sanitize_key( $_POST['taxonomy'] );
     $tax = get_taxonomy( $taxonomy );
     if ( ! $tax )
@@ -1393 +1388 @@
     $wp_list_table = _get_list_table( 'WP_Terms_List_Table', array( 'screen' => 'edit-' . $taxonomy ) );
 
-    if ( ! isset($post_data['tax_ID']) || ! ( $id = (int) $post_data['tax_ID'] ) )
+    if ( ! isset($_POST['tax_ID']) || ! ( $id = (int) $_POST['tax_ID'] ) )
         wp_die( -1 );
 
     $tag = get_term( $id, $taxonomy );
-    $post_data['description'] = $tag->description;
-
-    $updated = wp_update_term($id, $taxonomy, $post_data );
+    $_POST['description'] = $tag->description;
+
+    $updated = wp_update_term($id, $taxonomy, $_POST);
     if ( $updated && !is_wp_error($updated) ) {
         $tag = get_term( $updated['term_id'], $taxonomy );
@@ -1431 +1426 @@
     unset( $post_types['attachment'] );
 
-    $s = wp_unslash( $_POST['ps'] );
+    $s = stripslashes( $_POST['ps'] );
     $searchand = $search = '';
     $args = array(
@@ -1602 +1597 @@
     }
 
-    $post_data = isset( $_REQUEST['post_data'] ) ? wp_unslash( $_REQUEST['post_data'] ) : array();
+    $post_data = isset( $_REQUEST['post_data'] ) ? $_REQUEST['post_data'] : array();
 
     // If the context is custom header or background, make sure the uploaded file is an image.
@@ -1636 +1631 @@
     if ( isset( $post_data['context'] ) && isset( $post_data['theme'] ) ) {
         if ( 'custom-background' === $post_data['context'] )
-            wp_update_post_meta( $attachment_id, '_wp_attachment_is_custom_background', $post_data['theme'] );
+            update_post_meta( $attachment_id, '_wp_attachment_is_custom_background', $post_data['theme'] );
 
         if ( 'custom-header' === $post_data['context'] )
-            wp_update_post_meta( $attachment_id, '_wp_attachment_is_custom_header', $post_data['theme'] );
+            update_post_meta( $attachment_id, '_wp_attachment_is_custom_header', $post_data['theme'] );
     }
 
@@ -1784 +1779 @@
 
     $new_lock = ( time() - apply_filters( 'wp_check_post_lock_window', AUTOSAVE_INTERVAL * 2 ) + 5 ) . ':' . $active_lock[1];
-    wp_update_post_meta( $post_id, '_edit_lock', $new_lock, implode( ':', $active_lock ) );
+    update_post_meta( $post_id, '_edit_lock', $new_lock, implode( ':', $active_lock ) );
     wp_die( 1 );
 }
@@ -1879 +1874 @@
         wp_send_json_error();
 
-    $changes = wp_unslash( $_REQUEST['changes'] );
+    $changes = $_REQUEST['changes'];
     $post    = get_post( $id, ARRAY_A );
 
@@ -1896 +1891 @@
     if ( isset( $changes['alt'] ) ) {
         $alt = get_post_meta( $id, '_wp_attachment_image_alt', true );
-        $new_alt = $changes['alt'];
+        $new_alt = stripslashes( $changes['alt'] );
         if ( $alt != $new_alt ) {
             $new_alt = wp_strip_all_tags( $new_alt, true );
-            wp_update_post_meta( $id, '_wp_attachment_image_alt', $new_alt );
+            update_post_meta( $id, '_wp_attachment_image_alt', addslashes( $new_alt ) );
         }
     }
@@ -1921 +1916 @@
     if ( empty( $_REQUEST['attachments'] ) || empty( $_REQUEST['attachments'][ $id ] ) )
         wp_send_json_error();
-    $attachment_data = wp_unslash( $_REQUEST['attachments'][ $id ] );
+    $attachment_data = $_REQUEST['attachments'][ $id ];
 
     check_ajax_referer( 'update-post_' . $id, 'nonce' );
@@ -1965 +1960 @@
     check_ajax_referer( 'update-post_' . $post_id, 'nonce' );
 
-    $attachments = wp_unslash( $_REQUEST['attachments'] );
+    $attachments = $_REQUEST['attachments'];
 
     if ( ! current_user_can( 'edit_post', $post_id ) )
@@ -1996 +1991 @@
     check_ajax_referer( 'media-send-to-editor', 'nonce' );
 
-    $attachment = wp_unslash( $_POST['attachment'] );
+    $attachment = stripslashes_deep( $_POST['attachment'] );
 
     $id = intval( $attachment['id'] );
@@ -2051 +2046 @@
     check_ajax_referer( 'media-send-to-editor', 'nonce' );
 
-    if ( ! $src = wp_unslash( $_POST['src'] ) )
+    if ( ! $src = stripslashes( $_POST['src'] ) )
         wp_send_json_error();
 
@@ -2060 +2055 @@
         wp_send_json_error();
 
-    if ( ! $title = trim( wp_unslash( $_POST['title'] ) ) )
+    if ( ! $title = trim( stripslashes( $_POST['title'] ) ) )
         $title = wp_basename( $src );
 
@@ -2089 +2084 @@
 
     if ( ! empty($_POST['data']) ) {
-        $data = wp_unslash( (array) $_POST['data'] );
+        $data = (array) $_POST['data'];
         // todo: how much to sanitize and preset and what to leave to be accessed from $data or $_POST..?
         $user = wp_get_current_user();
@@ -2120 +2115 @@
 
     if ( ! empty($_POST['data']) ) {
-        $data = wp_unslash( (array) $_POST['data'] );
+        $data = stripslashes_deep( (array) $_POST['data'] );
         $response = apply_filters( 'heartbeat_nopriv_received', $response, $data, $screen_id );
     }