Changeset 23554 for trunk/wp-includes/comment.php

Timestamp:

03/01/2013 04:28:40 PM (12 years ago)

Author:

ryan

Message:

Revert 23416, 23419, 23445 except for wp_reset_vars() changes. We are going a different direction with the slashing cleanup, so resetting to a clean slate. see #21767

File:

• trunk/wp-includes/comment.php (modified) (7 diffs)

trunk/wp-includes/comment.php

@@ -634 +634 @@
 function sanitize_comment_cookies() {
     if ( isset($_COOKIE['comment_author_'.COOKIEHASH]) ) {
-        $comment_author = wp_unslash( $_COOKIE['comment_author_'.COOKIEHASH] );
-        $comment_author = apply_filters('pre_comment_author_name', $comment_author);
+        $comment_author = apply_filters('pre_comment_author_name', $_COOKIE['comment_author_'.COOKIEHASH]);
+        $comment_author = stripslashes($comment_author);
         $comment_author = esc_attr($comment_author);
         $_COOKIE['comment_author_'.COOKIEHASH] = $comment_author;
@@ -641 +641 @@
 
     if ( isset($_COOKIE['comment_author_email_'.COOKIEHASH]) ) {
-        $comment_author_email = wp_unslash( $_COOKIE['comment_author_email_'.COOKIEHASH] );
-        $comment_author_email = apply_filters('pre_comment_author_email', $comment_author_email);
+        $comment_author_email = apply_filters('pre_comment_author_email', $_COOKIE['comment_author_email_'.COOKIEHASH]);
+        $comment_author_email = stripslashes($comment_author_email);
         $comment_author_email = esc_attr($comment_author_email);
         $_COOKIE['comment_author_email_'.COOKIEHASH] = $comment_author_email;
@@ -648 +648 @@
 
     if ( isset($_COOKIE['comment_author_url_'.COOKIEHASH]) ) {
-        $comment_author_url = wp_unslash( $_COOKIE['comment_author_url_'.COOKIEHASH] );
-        $comment_author_url = apply_filters('pre_comment_author_url', $comment_author_url);
+        $comment_author_url = apply_filters('pre_comment_author_url', $_COOKIE['comment_author_url_'.COOKIEHASH]);
+        $comment_author_url = stripslashes($comment_author_url);
         $_COOKIE['comment_author_url_'.COOKIEHASH] = $comment_author_url;
     }
@@ -671 +671 @@
 
     // Simple duplicate check
-    $dupe = $wpdb->prepare( "SELECT comment_ID FROM $wpdb->comments WHERE comment_post_ID = %d AND comment_parent = %s AND comment_approved != 'trash' AND ( comment_author = %s ", $comment_post_ID, $comment_parent, $comment_author );
+    // expected_slashed ($comment_post_ID, $comment_author, $comment_author_email, $comment_content)
+    $dupe = "SELECT comment_ID FROM $wpdb->comments WHERE comment_post_ID = '$comment_post_ID' AND comment_parent = '$comment_parent' AND comment_approved != 'trash' AND ( comment_author = '$comment_author' ";
     if ( $comment_author_email )
-        $dupe .= $wpdb->prepare( "OR comment_author_email = %s ", $comment_author_email );
-    $dupe .= $wpdb->prepare( ") AND comment_content = %s LIMIT 1", $comment_content );
+        $dupe .= "OR comment_author_email = '$comment_author_email' ";
+    $dupe .= ") AND comment_content = '$comment_content' LIMIT 1";
     if ( $wpdb->get_var($dupe) ) {
         do_action( 'comment_duplicate_trigger', $commentdata );
@@ -1262 +1263 @@
 function wp_insert_comment($commentdata) {
     global $wpdb;
-    extract($commentdata, EXTR_SKIP);
+    extract(stripslashes_deep($commentdata), EXTR_SKIP);
 
     if ( ! isset($comment_author_IP) )
@@ -1491 +1492 @@
     $comment = get_comment($commentarr['comment_ID'], ARRAY_A);
 
+    // Escape data pulled from DB.
+    $comment = esc_sql($comment);
+
     $old_status = $comment['comment_approved'];
 
@@ -1499 +1503 @@
 
     // Now extract the merged array.
-    extract($commentarr, EXTR_SKIP);
+    extract(stripslashes_deep($commentarr), EXTR_SKIP);
 
     $comment_content = apply_filters('comment_save_pre', $comment_content);