![(please configure the [header_logo] section in trac.ini)](/chrome/site/your_project_logo.png){kind=logo}
Changeset 23563
- Timestamp:
- 03/01/2013 05:00:25 PM (14 years ago)
- Location:
- trunk/wp-admin
- Files:
-
- 28 edited
-
admin.php (modified) (2 diffs)
-
edit-comments.php (modified) (3 diffs)
-
edit-form-advanced.php (modified) (1 diff)
-
edit-form-comment.php (modified) (1 diff)
-
edit-tags.php (modified) (2 diffs)
-
edit.php (modified) (1 diff)
-
includes/ajax-actions.php (modified) (11 diffs)
-
includes/bookmark.php (modified) (3 diffs)
-
includes/class-wp-comments-list-table.php (modified) (1 diff)
-
includes/class-wp-ms-sites-list-table.php (modified) (1 diff)
-
includes/class-wp-ms-themes-list-table.php (modified) (1 diff)
-
includes/class-wp-ms-users-list-table.php (modified) (2 diffs)
-
includes/class-wp-plugin-install-list-table.php (modified) (2 diffs)
-
includes/class-wp-plugins-list-table.php (modified) (2 diffs)
-
includes/class-wp-terms-list-table.php (modified) (2 diffs)
-
includes/class-wp-theme-install-list-table.php (modified) (2 diffs)
-
includes/class-wp-themes-list-table.php (modified) (2 diffs)
-
includes/class-wp-upgrader.php (modified) (1 diff)
-
includes/class-wp-users-list-table.php (modified) (1 diff)
-
includes/dashboard.php (modified) (1 diff)
-
includes/deprecated.php (modified) (2 diffs)
-
includes/file.php (modified) (3 diffs)
-
includes/image-edit.php (modified) (2 diffs)
-
includes/media.php (modified) (4 diffs)
-
includes/misc.php (modified) (1 diff)
-
includes/plugin-install.php (modified) (5 diffs)
-
includes/post.php (modified) (7 diffs)
-
includes/taxonomy.php (modified) (1 diff)
Legend:
- Unmodified
- Added
- Removed
-
trunk/wp-admin/admin.php
r23554 r23563 44 44 } elseif ( get_option('db_version') != $wp_db_version && empty($_POST) ) { 45 45 if ( !is_multisite() ) { 46 wp_redirect( admin_url('upgrade.php?_wp_http_referer=' . urlencode(stripslashes($_SERVER['REQUEST_URI']))));46 wp_redirect( admin_url( 'upgrade.php?_wp_http_referer=' . urlencode( wp_unslash( $_SERVER['REQUEST_URI'] ) ) ) ); 47 47 exit; 48 48 } elseif ( apply_filters( 'do_mu_upgrade', true ) ) { … … 83 83 84 84 if ( isset($_GET['page']) ) { 85 $plugin_page = stripslashes($_GET['page']);85 $plugin_page = wp_unslash( $_GET['page'] ); 86 86 $plugin_page = plugin_basename($plugin_page); 87 87 } -
trunk/wp-admin/edit-comments.php
r23554 r23563 21 21 22 22 if ( 'delete_all' == $doaction && !empty( $_REQUEST['pagegen_timestamp'] ) ) { 23 $comment_status = $ wpdb->escape( $_REQUEST['comment_status'] );24 $delete_time = $ wpdb->escape( $_REQUEST['pagegen_timestamp'] );25 $comment_ids = $wpdb->get_col( "SELECT comment_ID FROM $wpdb->comments WHERE comment_approved = '$comment_status' AND '$delete_time' > comment_date_gmt");23 $comment_status = $_REQUEST['comment_status']; 24 $delete_time = $_REQUEST['pagegen_timestamp']; 25 $comment_ids = $wpdb->get_col( $wpdb->prepare( "SELECT comment_ID FROM $wpdb->comments WHERE comment_approved = %s AND %s > comment_date_gmt", $comment_status, $delete_time ) ); 26 26 $doaction = 'delete'; 27 27 } elseif ( isset( $_REQUEST['delete_comments'] ) ) { … … 96 96 exit; 97 97 } elseif ( ! empty( $_GET['_wp_http_referer'] ) ) { 98 wp_redirect( remove_query_arg( array( '_wp_http_referer', '_wpnonce' ), stripslashes( $_SERVER['REQUEST_URI'] ) ) );98 wp_redirect( remove_query_arg( array( '_wp_http_referer', '_wpnonce' ), wp_unslash( $_SERVER['REQUEST_URI'] ) ) ); 99 99 exit; 100 100 } … … 154 154 155 155 if ( isset($_REQUEST['s']) && $_REQUEST['s'] ) 156 printf( '<span class="subtitle">' . sprintf( __( 'Search results for “%s”' ), wp_html_excerpt( esc_html( stripslashes( $_REQUEST['s'] ) ), 50 ) ) . '</span>' ); ?>156 printf( '<span class="subtitle">' . sprintf( __( 'Search results for “%s”' ), wp_html_excerpt( esc_html( wp_unslash( $_REQUEST['s'] ) ), 50 ) ) . '</span>' ); ?> 157 157 </h2> 158 158 -
trunk/wp-admin/edit-form-advanced.php
r23554 r23563 315 315 <input type="hidden" id="post_type" name="post_type" value="<?php echo esc_attr( $post_type ) ?>" /> 316 316 <input type="hidden" id="original_post_status" name="original_post_status" value="<?php echo esc_attr( $post->post_status) ?>" /> 317 <input type="hidden" id="referredby" name="referredby" value="<?php echo esc_url( stripslashes(wp_get_referer())); ?>" />317 <input type="hidden" id="referredby" name="referredby" value="<?php echo esc_url(wp_unslash(wp_get_referer())); ?>" /> 318 318 <?php if ( ! empty( $active_post_lock ) ) { ?> 319 319 <input type="hidden" id="active_post_lock" value="<?php echo esc_attr( implode( ':', $active_post_lock ) ); ?>" /> -
trunk/wp-admin/edit-form-comment.php
r23554 r23563 133 133 <input type="hidden" name="c" value="<?php echo esc_attr($comment->comment_ID) ?>" /> 134 134 <input type="hidden" name="p" value="<?php echo esc_attr($comment->comment_post_ID) ?>" /> 135 <input name="referredby" type="hidden" id="referredby" value="<?php echo esc_url( stripslashes(wp_get_referer())); ?>" />135 <input name="referredby" type="hidden" id="referredby" value="<?php echo esc_url(wp_unslash(wp_get_referer())); ?>" /> 136 136 <?php wp_original_referer_field(true, 'previous'); ?> 137 137 <input type="hidden" name="noredir" value="1" /> -
trunk/wp-admin/edit-tags.php
r23554 r23563 165 165 default: 166 166 if ( ! empty($_REQUEST['_wp_http_referer']) ) { 167 $location = remove_query_arg( array('_wp_http_referer', '_wpnonce'), stripslashes($_SERVER['REQUEST_URI']) );167 $location = remove_query_arg( array('_wp_http_referer', '_wpnonce'), wp_unslash($_SERVER['REQUEST_URI']) ); 168 168 169 169 if ( ! empty( $_REQUEST['paged'] ) ) … … 266 266 <h2><?php echo esc_html( $title ); 267 267 if ( !empty($_REQUEST['s']) ) 268 printf( '<span class="subtitle">' . __('Search results for “%s”') . '</span>', esc_html( stripslashes($_REQUEST['s']) ) ); ?>268 printf( '<span class="subtitle">' . __('Search results for “%s”') . '</span>', esc_html( wp_unslash($_REQUEST['s']) ) ); ?> 269 269 </h2> 270 270 -
trunk/wp-admin/edit.php
r23554 r23563 139 139 exit(); 140 140 } elseif ( ! empty($_REQUEST['_wp_http_referer']) ) { 141 wp_redirect( remove_query_arg( array('_wp_http_referer', '_wpnonce'), stripslashes($_SERVER['REQUEST_URI']) ) );141 wp_redirect( remove_query_arg( array('_wp_http_referer', '_wpnonce'), wp_unslash($_SERVER['REQUEST_URI']) ) ); 142 142 exit; 143 143 } -
trunk/wp-admin/includes/ajax-actions.php
r23554 r23563 60 60 } 61 61 62 $s = stripslashes( $_GET['q'] );62 $s = wp_unslash( $_GET['q'] ); 63 63 64 64 $comma = _x( ',', 'tag delimiter' ); … … 573 573 else if ( is_array( $cat_id ) ) 574 574 $cat_id = $cat_id['term_id']; 575 $cat_name = esc_html( stripslashes($cat_name));575 $cat_name = esc_html(wp_unslash($cat_name)); 576 576 $x->add( array( 577 577 'what' => 'link-category', … … 958 958 } else { // Update? 959 959 $mid = (int) key( $_POST['meta'] ); 960 $key = stripslashes( $_POST['meta'][$mid]['key'] );961 $value = stripslashes( $_POST['meta'][$mid]['value'] );960 $key = wp_unslash( $_POST['meta'][$mid]['key'] ); 961 $value = wp_unslash( $_POST['meta'][$mid]['value'] ); 962 962 if ( '' == trim($key) ) 963 963 wp_die( __( 'Please provide a custom field name.' ) ); … … 1228 1228 1229 1229 if ( isset( $_POST['search'] ) ) 1230 $args['s'] = stripslashes( $_POST['search'] );1230 $args['s'] = wp_unslash( $_POST['search'] ); 1231 1231 $args['pagenum'] = ! empty( $_POST['page'] ) ? absint( $_POST['page'] ) : 1; 1232 1232 … … 1329 1329 1330 1330 $post = get_post( $post_ID, ARRAY_A ); 1331 $post = add_magic_quotes($post); //since it is from db1331 $post = wp_slash($post); //since it is from db 1332 1332 1333 1333 $data['content'] = $post['post_content']; … … 1426 1426 unset( $post_types['attachment'] ); 1427 1427 1428 $s = stripslashes( $_POST['ps'] );1428 $s = wp_unslash( $_POST['ps'] ); 1429 1429 $searchand = $search = ''; 1430 1430 $args = array( … … 1891 1891 if ( isset( $changes['alt'] ) ) { 1892 1892 $alt = get_post_meta( $id, '_wp_attachment_image_alt', true ); 1893 $new_alt = stripslashes( $changes['alt'] );1893 $new_alt = wp_unslash( $changes['alt'] ); 1894 1894 if ( $alt != $new_alt ) { 1895 1895 $new_alt = wp_strip_all_tags( $new_alt, true ); … … 1991 1991 check_ajax_referer( 'media-send-to-editor', 'nonce' ); 1992 1992 1993 $attachment = stripslashes_deep( $_POST['attachment'] );1993 $attachment = wp_unslash( $_POST['attachment'] ); 1994 1994 1995 1995 $id = intval( $attachment['id'] ); … … 2046 2046 check_ajax_referer( 'media-send-to-editor', 'nonce' ); 2047 2047 2048 if ( ! $src = stripslashes( $_POST['src'] ) )2048 if ( ! $src = wp_unslash( $_POST['src'] ) ) 2049 2049 wp_send_json_error(); 2050 2050 … … 2055 2055 wp_send_json_error(); 2056 2056 2057 if ( ! $title = trim( stripslashes( $_POST['title'] ) ) )2057 if ( ! $title = trim( wp_unslash( $_POST['title'] ) ) ) 2058 2058 $title = wp_basename( $src ); 2059 2059 … … 2115 2115 2116 2116 if ( ! empty($_POST['data']) ) { 2117 $data = stripslashes_deep( (array) $_POST['data'] );2117 $data = wp_unslash( (array) $_POST['data'] ); 2118 2118 $response = apply_filters( 'heartbeat_nopriv_received', $response, $data, $screen_id ); 2119 2119 } -
trunk/wp-admin/includes/bookmark.php
r23554 r23563 56 56 $link = new stdClass; 57 57 if ( isset( $_GET['linkurl'] ) ) 58 $link->link_url = esc_url( $_GET['linkurl']);58 $link->link_url = esc_url( wp_unslash( $_GET['linkurl'] ) ); 59 59 else 60 60 $link->link_url = ''; 61 61 62 62 if ( isset( $_GET['name'] ) ) 63 $link->link_name = esc_attr( $_GET['name']);63 $link->link_name = esc_attr( wp_unslash( $_GET['name'] ) ); 64 64 else 65 65 $link->link_name = ''; … … 138 138 $linkdata = sanitize_bookmark( $linkdata, 'db' ); 139 139 140 extract( stripslashes_deep( $linkdata ), EXTR_SKIP );140 extract( wp_unslash( $linkdata ), EXTR_SKIP ); 141 141 142 142 $update = false; … … 252 252 253 253 // Escape data pulled from DB. 254 $link = add_magic_quotes( $link );254 $link = wp_slash( $link ); 255 255 256 256 // Passed link category list overwrites existing category list if not empty. -
trunk/wp-admin/includes/class-wp-comments-list-table.php
r23554 r23563 171 171 // I toyed with this, but decided against it. Leaving it in here in case anyone thinks it is a good idea. ~ Mark 172 172 if ( !empty( $_REQUEST['s'] ) ) 173 $link = add_query_arg( 's', esc_attr( stripslashes( $_REQUEST['s'] ) ), $link );173 $link = add_query_arg( 's', esc_attr( wp_unslash( $_REQUEST['s'] ) ), $link ); 174 174 */ 175 175 $status_links[$status] = "<a href='$link'$class>" . sprintf( -
trunk/wp-admin/includes/class-wp-ms-sites-list-table.php
r23554 r23563 30 30 $pagenum = $this->get_pagenum(); 31 31 32 $s = isset( $_REQUEST['s'] ) ? stripslashes( trim( $_REQUEST[ 's' ] ) ) : '';32 $s = isset( $_REQUEST['s'] ) ? wp_unslash( trim( $_REQUEST[ 's' ] ) ) : ''; 33 33 $wild = ''; 34 34 if ( false !== strpos($s, '*') ) { -
trunk/wp-admin/includes/class-wp-ms-themes-list-table.php
r23554 r23563 127 127 static $term; 128 128 if ( is_null( $term ) ) 129 $term = stripslashes( $_REQUEST['s'] );129 $term = wp_unslash( $_REQUEST['s'] ); 130 130 131 131 foreach ( array( 'Name', 'Description', 'Author', 'Author', 'AuthorURI' ) as $field ) { -
trunk/wp-admin/includes/class-wp-ms-users-list-table.php
r23554 r23563 174 174 case 'username': 175 175 $avatar = get_avatar( $user->user_email, 32 ); 176 $edit_link = esc_url( add_query_arg( 'wp_http_referer', urlencode( stripslashes( $_SERVER['REQUEST_URI'] ) ), get_edit_user_link( $user->ID ) ) );176 $edit_link = esc_url( add_query_arg( 'wp_http_referer', urlencode( wp_unslash( $_SERVER['REQUEST_URI'] ) ), get_edit_user_link( $user->ID ) ) ); 177 177 178 178 echo "<td $attributes>"; ?> 179 <?php echo $avatar; ?><strong><a href="<?php echo $edit_link; ?>" class="edit"><?php echo stripslashes( $user->user_login ); ?></a><?php179 <?php echo $avatar; ?><strong><a href="<?php echo $edit_link; ?>" class="edit"><?php echo $user->user_login; ?></a><?php 180 180 if ( in_array( $user->user_login, $super_admins ) ) 181 181 echo ' - ' . __( 'Super Admin' ); … … 187 187 188 188 if ( current_user_can( 'delete_user', $user->ID ) && ! in_array( $user->user_login, $super_admins ) ) { 189 $actions['delete'] = '<a href="' . $delete = esc_url( network_admin_url( add_query_arg( '_wp_http_referer', urlencode( stripslashes( $_SERVER['REQUEST_URI'] ) ), wp_nonce_url( 'users.php', 'deleteuser' ) . '&action=deleteuser&id=' . $user->ID ) ) ) . '" class="delete">' . __( 'Delete' ) . '</a>';189 $actions['delete'] = '<a href="' . $delete = esc_url( network_admin_url( add_query_arg( '_wp_http_referer', urlencode( wp_unslash( $_SERVER['REQUEST_URI'] ) ), wp_nonce_url( 'users.php', 'deleteuser' ) . '&action=deleteuser&id=' . $user->ID ) ) ) . '" class="delete">' . __( 'Delete' ) . '</a>'; 190 190 } 191 191 -
trunk/wp-admin/includes/class-wp-plugin-install-list-table.php
r23554 r23563 49 49 switch ( $tab ) { 50 50 case 'search': 51 $type = isset( $_REQUEST['type'] ) ? stripslashes( $_REQUEST['type'] ) : 'term';52 $term = isset( $_REQUEST['s'] ) ? stripslashes( $_REQUEST['s'] ) : '';51 $type = isset( $_REQUEST['type'] ) ? wp_unslash( $_REQUEST['type'] ) : 'term'; 52 $term = isset( $_REQUEST['s'] ) ? wp_unslash( $_REQUEST['s'] ) : ''; 53 53 54 54 switch ( $type ) { … … 74 74 75 75 case 'favorites': 76 $user = isset( $_GET['user'] ) ? stripslashes( $_GET['user'] ) : get_user_option( 'wporg_favorites' );76 $user = isset( $_GET['user'] ) ? wp_unslash( $_GET['user'] ) : get_user_option( 'wporg_favorites' ); 77 77 update_user_meta( get_current_user_id(), 'wporg_favorites', $user ); 78 78 if ( $user ) -
trunk/wp-admin/includes/class-wp-plugins-list-table.php
r23554 r23563 23 23 24 24 if ( isset($_REQUEST['s']) ) 25 $_SERVER['REQUEST_URI'] = add_query_arg('s', stripslashes($_REQUEST['s']) );25 $_SERVER['REQUEST_URI'] = add_query_arg('s', wp_unslash($_REQUEST['s']) ); 26 26 27 27 $page = $this->get_pagenum(); … … 141 141 static $term; 142 142 if ( is_null( $term ) ) 143 $term = stripslashes( $_REQUEST['s'] );143 $term = wp_unslash( $_REQUEST['s'] ); 144 144 145 145 foreach ( $plugin as $value ) -
trunk/wp-admin/includes/class-wp-terms-list-table.php
r23554 r23563 53 53 } 54 54 55 $search = !empty( $_REQUEST['s'] ) ? trim( stripslashes( $_REQUEST['s'] ) ) : '';55 $search = !empty( $_REQUEST['s'] ) ? trim( wp_unslash( $_REQUEST['s'] ) ) : ''; 56 56 57 57 $args = array( … … 62 62 63 63 if ( !empty( $_REQUEST['orderby'] ) ) 64 $args['orderby'] = trim( stripslashes( $_REQUEST['orderby'] ) );64 $args['orderby'] = trim( wp_unslash( $_REQUEST['orderby'] ) ); 65 65 66 66 if ( !empty( $_REQUEST['order'] ) ) 67 $args['order'] = trim( stripslashes( $_REQUEST['order'] ) );67 $args['order'] = trim( wp_unslash( $_REQUEST['order'] ) ); 68 68 69 69 $this->callback_args = $args; -
trunk/wp-admin/includes/class-wp-theme-install-list-table.php
r23554 r23563 25 25 $search_string = ''; 26 26 if ( ! empty( $_REQUEST['s'] ) ){ 27 $search_string = strtolower( stripslashes( $_REQUEST['s'] ) );27 $search_string = strtolower( wp_unslash( $_REQUEST['s'] ) ); 28 28 $search_terms = array_unique( array_filter( array_map( 'trim', explode( ',', $search_string ) ) ) ); 29 29 } … … 60 60 switch ( $tab ) { 61 61 case 'search': 62 $type = isset( $_REQUEST['type'] ) ? stripslashes( $_REQUEST['type'] ) : 'term';62 $type = isset( $_REQUEST['type'] ) ? wp_unslash( $_REQUEST['type'] ) : 'term'; 63 63 switch ( $type ) { 64 64 case 'tag': -
trunk/wp-admin/includes/class-wp-themes-list-table.php
r23554 r23563 29 29 30 30 if ( ! empty( $_REQUEST['s'] ) ) 31 $this->search_terms = array_unique( array_filter( array_map( 'trim', explode( ',', strtolower( stripslashes( $_REQUEST['s'] ) ) ) ) ) );31 $this->search_terms = array_unique( array_filter( array_map( 'trim', explode( ',', strtolower( wp_unslash( $_REQUEST['s'] ) ) ) ) ) ); 32 32 33 33 if ( ! empty( $_REQUEST['features'] ) ) … … 236 236 */ 237 237 function _js_vars( $extra_args = array() ) { 238 $search_string = isset( $_REQUEST['s'] ) ? esc_attr( stripslashes( $_REQUEST['s'] ) ) : '';238 $search_string = isset( $_REQUEST['s'] ) ? esc_attr( wp_unslash( $_REQUEST['s'] ) ) : ''; 239 239 240 240 $args = array( -
trunk/wp-admin/includes/class-wp-upgrader.php
r23554 r23563 1428 1428 $install_actions = array(); 1429 1429 1430 $from = isset($_GET['from']) ? stripslashes($_GET['from']) : 'plugins';1430 $from = isset($_GET['from']) ? wp_unslash( $_GET['from'] ) : 'plugins'; 1431 1431 1432 1432 if ( 'import' == $from ) -
trunk/wp-admin/includes/class-wp-users-list-table.php
r23554 r23563 242 242 if ( current_user_can( 'list_users' ) ) { 243 243 // Set up the user editing link 244 $edit_link = esc_url( add_query_arg( 'wp_http_referer', urlencode( stripslashes( $_SERVER['REQUEST_URI'] ) ), get_edit_user_link( $user_object->ID ) ) );244 $edit_link = esc_url( add_query_arg( 'wp_http_referer', urlencode( wp_unslash( $_SERVER['REQUEST_URI'] ) ), get_edit_user_link( $user_object->ID ) ) ); 245 245 246 246 // Set up the hover actions for this user -
trunk/wp-admin/includes/dashboard.php
r23554 r23563 1094 1094 1095 1095 if ( 'POST' == $_SERVER['REQUEST_METHOD'] && isset($_POST['widget-rss'][$number]) ) { 1096 $_POST['widget-rss'][$number] = stripslashes_deep( $_POST['widget-rss'][$number] );1096 $_POST['widget-rss'][$number] = wp_unslash( $_POST['widget-rss'][$number] ); 1097 1097 $widget_options[$widget_id] = wp_widget_rss_process( $_POST['widget-rss'][$number] ); 1098 1098 // title is optional. If black, fill it if possible -
trunk/wp-admin/includes/deprecated.php
r23554 r23563 473 473 _deprecated_function( __FUNCTION__, '3.1', 'WP_User_Query' ); 474 474 475 $this->search_term = stripslashes( $search_term );475 $this->search_term = wp_unslash( $search_term ); 476 476 $this->raw_page = ( '' == $page ) ? false : (int) $page; 477 477 $this->page = (int) ( '' == $page ) ? 1 : $page; … … 552 552 */ 553 553 function prepare_vars_for_template_usage() { 554 $this->search_term = stripslashes($this->search_term); // done with DB, from now on we want slashes gone554 $this->search_term = wp_unslash($this->search_term); // done with DB, from now on we want slashes gone 555 555 } 556 556 -
trunk/wp-admin/includes/file.php
r23554 r23563 902 902 903 903 // If defined, set it to that, Else, If POST'd, set it to that, If not, Set it to whatever it previously was(saved details in option) 904 $credentials['hostname'] = defined('FTP_HOST') ? FTP_HOST : (!empty($_POST['hostname']) ? stripslashes($_POST['hostname']) : $credentials['hostname']);905 $credentials['username'] = defined('FTP_USER') ? FTP_USER : (!empty($_POST['username']) ? stripslashes($_POST['username']) : $credentials['username']);906 $credentials['password'] = defined('FTP_PASS') ? FTP_PASS : (!empty($_POST['password']) ? stripslashes($_POST['password']) : '');904 $credentials['hostname'] = defined('FTP_HOST') ? FTP_HOST : (!empty($_POST['hostname']) ? wp_unslash( $_POST['hostname'] ) : $credentials['hostname']); 905 $credentials['username'] = defined('FTP_USER') ? FTP_USER : (!empty($_POST['username']) ? wp_unslash( $_POST['username'] ) : $credentials['username']); 906 $credentials['password'] = defined('FTP_PASS') ? FTP_PASS : (!empty($_POST['password']) ? wp_unslash( $_POST['password'] ) : ''); 907 907 908 908 // Check to see if we are setting the public/private keys for ssh 909 $credentials['public_key'] = defined('FTP_PUBKEY') ? FTP_PUBKEY : (!empty($_POST['public_key']) ? stripslashes($_POST['public_key']) : '');910 $credentials['private_key'] = defined('FTP_PRIKEY') ? FTP_PRIKEY : (!empty($_POST['private_key']) ? stripslashes($_POST['private_key']) : '');909 $credentials['public_key'] = defined('FTP_PUBKEY') ? FTP_PUBKEY : (!empty($_POST['public_key']) ? wp_unslash( $_POST['public_key'] ) : ''); 910 $credentials['private_key'] = defined('FTP_PRIKEY') ? FTP_PRIKEY : (!empty($_POST['private_key']) ? wp_unslash( $_POST['private_key'] ) : ''); 911 911 912 912 //sanitize the hostname, Some people might pass in odd-data: … … 926 926 $credentials['connection_type'] = 'ftps'; 927 927 else if ( !empty($_POST['connection_type']) ) 928 $credentials['connection_type'] = stripslashes($_POST['connection_type']);928 $credentials['connection_type'] = wp_unslash( $_POST['connection_type'] ); 929 929 else if ( !isset($credentials['connection_type']) ) //All else fails (And it's not defaulted to something else saved), Default to FTP 930 930 $credentials['connection_type'] = 'ftp'; … … 1051 1051 foreach ( (array) $extra_fields as $field ) { 1052 1052 if ( isset( $_POST[ $field ] ) ) 1053 echo '<input type="hidden" name="' . esc_attr( $field ) . '" value="' . esc_attr( stripslashes( $_POST[ $field ] ) ) . '" />';1053 echo '<input type="hidden" name="' . esc_attr( $field ) . '" value="' . esc_attr( wp_unslash( $_POST[ $field ] ) ) . '" />'; 1054 1054 } 1055 1055 submit_button( __( 'Proceed' ), 'button', 'upgrade' ); -
trunk/wp-admin/includes/image-edit.php
r23554 r23563 455 455 return false; 456 456 457 $changes = !empty($_REQUEST['history']) ? json_decode( stripslashes($_REQUEST['history']) ) : null;457 $changes = !empty($_REQUEST['history']) ? json_decode( wp_unslash($_REQUEST['history']) ) : null; 458 458 if ( $changes ) 459 459 $img = image_edit_apply_changes( $img, $changes ); … … 588 588 } 589 589 } elseif ( !empty($_REQUEST['history']) ) { 590 $changes = json_decode( stripslashes($_REQUEST['history']) );590 $changes = json_decode( wp_unslash($_REQUEST['history']) ); 591 591 if ( $changes ) 592 592 $img = image_edit_apply_changes($img, $changes); -
trunk/wp-admin/includes/media.php
r23554 r23563 469 469 if ( isset($attachment['image_alt']) ) { 470 470 $image_alt = get_post_meta($attachment_id, '_wp_attachment_image_alt', true); 471 if ( $image_alt != stripslashes($attachment['image_alt']) ) {472 $image_alt = wp_strip_all_tags( stripslashes($attachment['image_alt']), true );471 if ( $image_alt != wp_unslash($attachment['image_alt']) ) { 472 $image_alt = wp_strip_all_tags( wp_unslash($attachment['image_alt']), true ); 473 473 // update_meta expects slashed 474 474 update_post_meta( $attachment_id, '_wp_attachment_image_alt', addslashes($image_alt) ); … … 502 502 503 503 if ( isset($send_id) ) { 504 $attachment = stripslashes_deep( $_POST['attachments'][$send_id] );504 $attachment = wp_unslash( $_POST['attachments'][$send_id] ); 505 505 506 506 $html = isset( $attachment['post_title'] ) ? $attachment['post_title'] : ''; … … 547 547 548 548 if ( isset( $_POST['media_type'] ) && 'image' != $_POST['media_type'] ) { 549 $title = esc_html( stripslashes( $_POST['title'] ) );549 $title = esc_html( wp_unslash( $_POST['title'] ) ); 550 550 if ( empty( $title ) ) 551 551 $title = esc_html( basename( $src ) ); … … 562 562 } else { 563 563 $align = ''; 564 $alt = esc_attr( stripslashes( $_POST['alt'] ) );564 $alt = esc_attr( wp_unslash( $_POST['alt'] ) ); 565 565 if ( isset($_POST['align']) ) { 566 $align = esc_attr( stripslashes( $_POST['align'] ) );566 $align = esc_attr( wp_unslash( $_POST['align'] ) ); 567 567 $class = " class='align$align'"; 568 568 } -
trunk/wp-admin/includes/misc.php
r23554 r23563 221 221 */ 222 222 function url_shorten( $url ) { 223 $short_url = str_replace( 'http://', '', stripslashes( $url ));223 $short_url = str_replace( 'http://', '', wp_unslash( $url )); 224 224 $short_url = str_replace( 'www.', '', $short_url ); 225 225 $short_url = untrailingslashit( $short_url ); -
trunk/wp-admin/includes/plugin-install.php
r23554 r23563 117 117 */ 118 118 function install_search_form( $type_selector = true ) { 119 $type = isset($_REQUEST['type']) ? stripslashes( $_REQUEST['type'] ) : 'term';120 $term = isset($_REQUEST['s']) ? stripslashes( $_REQUEST['s'] ) : '';119 $type = isset($_REQUEST['type']) ? wp_unslash( $_REQUEST['type'] ) : 'term'; 120 $term = isset($_REQUEST['s']) ? wp_unslash( $_REQUEST['s'] ) : ''; 121 121 122 122 ?><form id="search-plugins" method="get" action=""> … … 161 161 */ 162 162 function install_plugins_favorites_form() { 163 $user = ! empty( $_GET['user'] ) ? stripslashes( $_GET['user'] ) : get_user_option( 'wporg_favorites' );163 $user = ! empty( $_GET['user'] ) ? wp_unslash( $_GET['user'] ) : get_user_option( 'wporg_favorites' ); 164 164 ?> 165 165 <p class="install-help"><?php _e( 'If you have marked plugins as favorites on WordPress.org, you can browse them here.' ); ?></p> … … 252 252 } 253 253 if ( isset($_GET['from']) ) 254 $url .= '&from=' . urlencode( stripslashes($_GET['from']));254 $url .= '&from=' . urlencode( wp_unslash( $_GET['from'] ) ); 255 255 256 256 return compact('status', 'url', 'version'); … … 265 265 global $tab; 266 266 267 $api = plugins_api('plugin_information', array('slug' => stripslashes( $_REQUEST['plugin'] ) ));267 $api = plugins_api('plugin_information', array('slug' => wp_unslash( $_REQUEST['plugin'] ) )); 268 268 269 269 if ( is_wp_error($api) ) … … 296 296 } 297 297 298 $section = isset($_REQUEST['section']) ? stripslashes( $_REQUEST['section'] ) : 'description'; //Default to the Description tab, Do not translate, API returns English.298 $section = isset($_REQUEST['section']) ? wp_unslash( $_REQUEST['section'] ) : 'description'; //Default to the Description tab, Do not translate, API returns English. 299 299 if ( empty($section) || ! isset($api->sections[ $section ]) ) 300 300 $section = array_shift( $section_titles = array_keys((array)$api->sections) ); -
trunk/wp-admin/includes/post.php
r23560 r23563 198 198 199 199 if ( isset( $post_data[ '_wp_format_url' ] ) ) { 200 update_post_meta( $post_ID, '_wp_format_url', addslashes( esc_url_raw( stripslashes( $post_data['_wp_format_url'] ) ) ) );200 update_post_meta( $post_ID, '_wp_format_url', addslashes( esc_url_raw( wp_unslash( $post_data['_wp_format_url'] ) ) ) ); 201 201 } 202 202 … … 237 237 if ( isset( $post_data[ '_wp_attachment_image_alt' ] ) ) { 238 238 $image_alt = get_post_meta( $post_ID, '_wp_attachment_image_alt', true ); 239 if ( $image_alt != stripslashes( $post_data['_wp_attachment_image_alt'] ) ) {240 $image_alt = wp_strip_all_tags( stripslashes( $post_data['_wp_attachment_image_alt'] ), true );239 if ( $image_alt != wp_unslash( $post_data['_wp_attachment_image_alt'] ) ) { 240 $image_alt = wp_strip_all_tags( wp_unslash( $post_data['_wp_attachment_image_alt'] ), true ); 241 241 // update_meta expects slashed 242 242 update_post_meta( $post_ID, '_wp_attachment_image_alt', addslashes( $image_alt ) ); … … 431 431 $post_title = ''; 432 432 if ( !empty( $_REQUEST['post_title'] ) ) 433 $post_title = esc_html( stripslashes( $_REQUEST['post_title'] ));433 $post_title = esc_html( wp_unslash( $_REQUEST['post_title'] )); 434 434 435 435 $post_content = ''; 436 436 if ( !empty( $_REQUEST['content'] ) ) 437 $post_content = esc_html( stripslashes( $_REQUEST['content'] ));437 $post_content = esc_html( wp_unslash( $_REQUEST['content'] )); 438 438 439 439 $post_excerpt = ''; 440 440 if ( !empty( $_REQUEST['excerpt'] ) ) 441 $post_excerpt = esc_html( stripslashes( $_REQUEST['excerpt'] ));441 $post_excerpt = esc_html( wp_unslash( $_REQUEST['excerpt'] )); 442 442 443 443 if ( $create_in_db ) { … … 488 488 global $wpdb; 489 489 490 $post_title = stripslashes( sanitize_post_field( 'post_title', $title, 0, 'db' ) );491 $post_content = stripslashes( sanitize_post_field( 'post_content', $content, 0, 'db' ) );492 $post_date = stripslashes( sanitize_post_field( 'post_date', $date, 0, 'db' ) );490 $post_title = wp_unslash( sanitize_post_field( 'post_title', $title, 0, 'db' ) ); 491 $post_content = wp_unslash( sanitize_post_field( 'post_content', $content, 0, 'db' ) ); 492 $post_date = wp_unslash( sanitize_post_field( 'post_date', $date, 0, 'db' ) ); 493 493 494 494 $query = "SELECT ID FROM $wpdb->posts WHERE 1=1"; … … 621 621 $post_ID = (int) $post_ID; 622 622 623 $metakeyselect = isset($_POST['metakeyselect']) ? stripslashes( trim( $_POST['metakeyselect'] ) ) : '';624 $metakeyinput = isset($_POST['metakeyinput']) ? stripslashes( trim( $_POST['metakeyinput'] ) ) : '';623 $metakeyselect = isset($_POST['metakeyselect']) ? wp_unslash( trim( $_POST['metakeyselect'] ) ) : ''; 624 $metakeyinput = isset($_POST['metakeyinput']) ? wp_unslash( trim( $_POST['metakeyinput'] ) ) : ''; 625 625 $metavalue = isset($_POST['metavalue']) ? $_POST['metavalue'] : ''; 626 626 if ( is_string( $metavalue ) ) … … 720 720 */ 721 721 function update_meta( $meta_id, $meta_key, $meta_value ) { 722 $meta_key = stripslashes( $meta_key );723 $meta_value = stripslashes_deep( $meta_value );722 $meta_key = wp_unslash( $meta_key ); 723 $meta_value = wp_unslash( $meta_value ); 724 724 725 725 return update_metadata_by_mid( 'post', $meta_id, $meta_value, $meta_key ); … … 1246 1246 1247 1247 // _wp_put_post_revision() expects unescaped. 1248 $_POST = stripslashes_deep($_POST);1248 $_POST = wp_unslash($_POST); 1249 1249 1250 1250 // Otherwise create the new autosave as a special post revision -
trunk/wp-admin/includes/taxonomy.php
r23554 r23563 159 159 160 160 // Escape data pulled from DB. 161 $category = add_magic_quotes($category);161 $category = wp_slash($category); 162 162 163 163 // Merge old and new fields with new fields overwriting old ones.
Note:
See TracChangeset
for help on using the changeset viewer.
