Changeset 23554 for trunk/wp-includes/ms-functions.php

Timestamp:

03/01/2013 04:28:40 PM (12 years ago)

Author:

ryan

Message:

Revert 23416, 23419, 23445 except for wp_reset_vars() changes. We are going a different direction with the slashing cleanup, so resetting to a clean slate. see #21767

File:

• trunk/wp-includes/ms-functions.php (modified) (10 diffs)

trunk/wp-includes/ms-functions.php

@@ -280 +280 @@
  */
 function create_empty_blog( $domain, $path, $weblog_title, $site_id = 1 ) {
+    $domain         = addslashes( $domain );
+    $weblog_title   = addslashes( $weblog_title );
+
     if ( empty($path) )
         $path = '/';
@@ -580 +583 @@
     $blogname = apply_filters( 'newblogname', $blogname );
 
-    $blog_title = $blog_title;
+    $blog_title = stripslashes(  $blog_title );
 
     if ( empty( $blog_title ) )
@@ -633 +636 @@
 
     $key = substr( md5( time() . rand() . $domain ), 0, 16 );
-    $meta = serialize( $meta );
+    $meta = serialize($meta);
+    $domain = $wpdb->escape($domain);
+    $path = $wpdb->escape($path);
+    $title = $wpdb->escape($title);
 
     $wpdb->insert( $wpdb->signups, array(
@@ -646 +652 @@
     ) );
 
-    wpmu_signup_blog_notification( $domain, $path, $title, $user, $user_email, $key, $meta );
+    wpmu_signup_blog_notification($domain, $path, $title, $user, $user_email, $key, $meta);
 }
 
@@ -835 +841 @@
 
     $meta = maybe_unserialize($signup->meta);
-    $user_login = $signup->user_login;
-    $user_email = $signup->user_email;
+    $user_login = $wpdb->escape($signup->user_login);
+    $user_email = $wpdb->escape($signup->user_email);
     $password = wp_generate_password( 12, false );
 
@@ -1152 +1158 @@
         update_option( 'upload_path', get_blog_option( $current_site->blog_id, 'upload_path' ) );
 
-    update_option( 'blogname', $blog_title );
+    update_option( 'blogname', stripslashes( $blog_title ) );
     update_option( 'admin_email', '' );
 
@@ -1209 +1215 @@
         return false;
 
-    $welcome_email = get_site_option( 'welcome_email' );
+    $welcome_email = stripslashes( get_site_option( 'welcome_email' ) );
     if ( $welcome_email == false )
-        $welcome_email = __( 'Dear User,
+        $welcome_email = stripslashes( __( 'Dear User,
 
 Your new SITE_NAME site has been successfully set up at:
@@ -1223 +1229 @@
 We hope you enjoy your new site. Thanks!
 
---The Team @ SITE_NAME' );
+--The Team @ SITE_NAME' ) );
 
     $url = get_blogaddress_by_id($blog_id);
@@ -1247 +1253 @@
         $current_site->site_name = 'WordPress';
 
-    $subject = apply_filters( 'update_welcome_subject', sprintf(__('New %1$s Site: %2$s'), $current_site->site_name, $title ) );
+    $subject = apply_filters( 'update_welcome_subject', sprintf(__('New %1$s Site: %2$s'), $current_site->site_name, stripslashes( $title ) ) );
     wp_mail($user->user_email, $subject, $message, $message_headers);
     return true;
@@ -1476 +1482 @@
     global $wpdb;
     $user = get_userdata( (int) $user_id );
-    $wpdb->insert( $wpdb->registration_log, array('email' => $user->user_email, 'IP' => preg_replace( '/[^0-9., ]/', '', wp_unslash( $_SERVER['REMOTE_ADDR'] ) ), 'blog_id' => $blog_id, 'date_registered' => current_time('mysql')) );
+    $wpdb->insert( $wpdb->registration_log, array('email' => $user->user_email, 'IP' => preg_replace( '/[^0-9., ]/', '',$_SERVER['REMOTE_ADDR'] ), 'blog_id' => $blog_id, 'date_registered' => current_time('mysql')) );
 }