Changeset 23554 for trunk/wp-admin/includes/user.php

Timestamp:

03/01/2013 04:28:40 PM (12 years ago)

Author:

ryan

Message:

Revert 23416, 23419, 23445 except for wp_reset_vars() changes. We are going a different direction with the slashing cleanup, so resetting to a clean slate. see #21767

File:

• trunk/wp-admin/includes/user.php (modified) (5 diffs)

trunk/wp-admin/includes/user.php

@@ -35 +35 @@
         $user->ID = (int) $user_id;
         $userdata = get_userdata( $user_id );
-        $user->user_login = $userdata->user_login;
+        $user->user_login = $wpdb->escape( $userdata->user_login );
     } else {
         $update = false;
     }
 
-    // get clean data before we get started.
-    $post_data = wp_unslash( $_POST );
-
-    if ( !$update && isset( $post_data['user_login'] ) )
-        $user->user_login = sanitize_user($post_data['user_login'], true);
+    if ( !$update && isset( $_POST['user_login'] ) )
+        $user->user_login = sanitize_user($_POST['user_login'], true);
 
     $pass1 = $pass2 = '';
-    if ( isset( $post_data['pass1'] ))
-        $pass1 = $post_data['pass1'];
-    if ( isset( $post_data['pass2'] ))
-        $pass2 = $post_data['pass2'];
-
-    if ( isset( $post_data['role'] ) && current_user_can( 'edit_users' ) ) {
-        $new_role = sanitize_text_field( $post_data['role'] );
+    if ( isset( $_POST['pass1'] ))
+        $pass1 = $_POST['pass1'];
+    if ( isset( $_POST['pass2'] ))
+        $pass2 = $_POST['pass2'];
+
+    if ( isset( $_POST['role'] ) && current_user_can( 'edit_users' ) ) {
+        $new_role = sanitize_text_field( $_POST['role'] );
         $potential_role = isset($wp_roles->role_objects[$new_role]) ? $wp_roles->role_objects[$new_role] : false;
         // Don't let anyone with 'edit_users' (admins) edit their own role to something without it.
@@ -66 +63 @@
     }
 
-    if ( isset( $post_data['email'] ))
-        $user->user_email = sanitize_text_field( $post_data['email'] );
-    if ( isset( $post_data['url'] ) ) {
-        if ( empty ( $post_data['url'] ) || $post_data['url'] == 'http://' ) {
+    if ( isset( $_POST['email'] ))
+        $user->user_email = sanitize_text_field( $_POST['email'] );
+    if ( isset( $_POST['url'] ) ) {
+        if ( empty ( $_POST['url'] ) || $_POST['url'] == 'http://' ) {
             $user->user_url = '';
         } else {
-            $user->user_url = esc_url_raw( $post_data['url'] );
+            $user->user_url = esc_url_raw( $_POST['url'] );
             $protocols = implode( '|', array_map( 'preg_quote', wp_allowed_protocols() ) );
             $user->user_url = preg_match('/^(' . $protocols . '):/is', $user->user_url) ? $user->user_url : 'http://'.$user->user_url;
         }
     }
-    if ( isset( $post_data['first_name'] ) )
-        $user->first_name = sanitize_text_field( $post_data['first_name'] );
-    if ( isset( $post_data['last_name'] ) )
-        $user->last_name = sanitize_text_field( $post_data['last_name'] );
-    if ( isset( $post_data['nickname'] ) )
-        $user->nickname = sanitize_text_field( $post_data['nickname'] );
-    if ( isset( $post_data['display_name'] ) )
-        $user->display_name = sanitize_text_field( $post_data['display_name'] );
-
-    if ( isset( $post_data['description'] ) )
-        $user->description = trim( $post_data['description'] );
+    if ( isset( $_POST['first_name'] ) )
+        $user->first_name = sanitize_text_field( $_POST['first_name'] );
+    if ( isset( $_POST['last_name'] ) )
+        $user->last_name = sanitize_text_field( $_POST['last_name'] );
+    if ( isset( $_POST['nickname'] ) )
+        $user->nickname = sanitize_text_field( $_POST['nickname'] );
+    if ( isset( $_POST['display_name'] ) )
+        $user->display_name = sanitize_text_field( $_POST['display_name'] );
+
+    if ( isset( $_POST['description'] ) )
+        $user->description = trim( $_POST['description'] );
 
     foreach ( _wp_get_user_contactmethods( $user ) as $method => $name ) {
-        if ( isset( $post_data[$method] ))
-            $user->$method = sanitize_text_field( $post_data[$method] );
+        if ( isset( $_POST[$method] ))
+            $user->$method = sanitize_text_field( $_POST[$method] );
     }
 
     if ( $update ) {
-        $user->rich_editing = isset( $post_data['rich_editing'] ) && 'false' == $post_data['rich_editing'] ? 'false' : 'true';
-        $user->admin_color = isset( $post_data['admin_color'] ) ? sanitize_text_field( $post_data['admin_color'] ) : 'fresh';
-        $user->show_admin_bar_front = isset( $post_data['admin_bar_front'] ) ? 'true' : 'false';
-    }
-
-    $user->comment_shortcuts = isset( $post_data['comment_shortcuts'] ) && 'true' == $post_data['comment_shortcuts'] ? 'true' : '';
+        $user->rich_editing = isset( $_POST['rich_editing'] ) && 'false' == $_POST['rich_editing'] ? 'false' : 'true';
+        $user->admin_color = isset( $_POST['admin_color'] ) ? sanitize_text_field( $_POST['admin_color'] ) : 'fresh';
+        $user->show_admin_bar_front = isset( $_POST['admin_bar_front'] ) ? 'true' : 'false';
+    }
+
+    $user->comment_shortcuts = isset( $_POST['comment_shortcuts'] ) && 'true' == $_POST['comment_shortcuts'] ? 'true' : '';
 
     $user->use_ssl = 0;
-    if ( !empty($post_data['use_ssl']) )
+    if ( !empty($_POST['use_ssl']) )
         $user->use_ssl = 1;
 
@@ -128 +125 @@
 
     /* Check for "\" in password */
-    if ( false !== strpos( $pass1, "\\" ) )
+    if ( false !== strpos( stripslashes($pass1), "\\" ) )
         $errors->add( 'pass', __( '<strong>ERROR</strong>: Passwords may not contain the character "\\".' ), array( 'form-field' => 'pass1' ) );
 
@@ -138 +135 @@
         $user->user_pass = $pass1;
 
-    if ( !$update && isset( $post_data['user_login'] ) && !validate_username( $post_data['user_login'] ) )
+    if ( !$update && isset( $_POST['user_login'] ) && !validate_username( $_POST['user_login'] ) )
         $errors->add( 'user_login', __( '<strong>ERROR</strong>: This username is invalid because it uses illegal characters. Please enter a valid username.' ));
 
@@ -163 +160 @@
     } else {
         $user_id = wp_insert_user( $user );
-        wp_new_user_notification( $user_id, isset($post_data['send_password']) ? $pass1 : '' );
+        wp_new_user_notification( $user_id, isset($_POST['send_password']) ? $pass1 : '' );
     }
     return $user_id;