Changeset 23563 for trunk/wp-admin/includes/ajax-actions.php

Timestamp:

03/01/2013 05:00:25 PM (14 years ago)

Author:

ryan

Message:

Use wp_unslash() instead of stripslashes() and stripslashes_deep(). Use wp_slash() instead of add_magic_quotes().

see #21767

File:

• trunk/wp-admin/includes/ajax-actions.php (modified) (11 diffs)

trunk/wp-admin/includes/ajax-actions.php

@@ -60 +60 @@
         }
 
-        $s = stripslashes( $_GET['q'] );
+        $s = wp_unslash( $_GET['q'] );
 
         $comma = _x( ',', 'tag delimiter' );
@@ -573 +573 @@
                 else if ( is_array( $cat_id ) )
                         $cat_id = $cat_id['term_id'];
-                $cat_name = esc_html(stripslashes($cat_name));
+                $cat_name = esc_html(wp_unslash($cat_name));
                 $x->add( array(
                         'what' => 'link-category',
@@ -958 +958 @@
         } else { // Update?
                 $mid = (int) key( $_POST['meta'] );
-                $key = stripslashes( $_POST['meta'][$mid]['key'] );
-                $value = stripslashes( $_POST['meta'][$mid]['value'] );
+                $key = wp_unslash( $_POST['meta'][$mid]['key'] );
+                $value = wp_unslash( $_POST['meta'][$mid]['value'] );
                 if ( '' == trim($key) )
                         wp_die( __( 'Please provide a custom field name.' ) );
@@ -1228 +1228 @@
 
         if ( isset( $_POST['search'] ) )
-                $args['s'] = stripslashes( $_POST['search'] );
+                $args['s'] = wp_unslash( $_POST['search'] );
         $args['pagenum'] = ! empty( $_POST['page'] ) ? absint( $_POST['page'] ) : 1;
 
@@ -1329 +1329 @@
 
         $post = get_post( $post_ID, ARRAY_A );
-        $post = add_magic_quotes($post); //since it is from db
+        $post = wp_slash($post); //since it is from db
 
         $data['content'] = $post['post_content'];
@@ -1426 +1426 @@
         unset( $post_types['attachment'] );
 
-        $s = stripslashes( $_POST['ps'] );
+        $s = wp_unslash( $_POST['ps'] );
         $searchand = $search = '';
         $args = array(
@@ -1891 +1891 @@
         if ( isset( $changes['alt'] ) ) {
                 $alt = get_post_meta( $id, '_wp_attachment_image_alt', true );
-                $new_alt = stripslashes( $changes['alt'] );
+                $new_alt = wp_unslash( $changes['alt'] );
                 if ( $alt != $new_alt ) {
                         $new_alt = wp_strip_all_tags( $new_alt, true );
@@ -1991 +1991 @@
         check_ajax_referer( 'media-send-to-editor', 'nonce' );
 
-        $attachment = stripslashes_deep( $_POST['attachment'] );
+        $attachment = wp_unslash( $_POST['attachment'] );
 
         $id = intval( $attachment['id'] );
@@ -2046 +2046 @@
         check_ajax_referer( 'media-send-to-editor', 'nonce' );
 
-        if ( ! $src = stripslashes( $_POST['src'] ) )
+        if ( ! $src = wp_unslash( $_POST['src'] ) )
                 wp_send_json_error();
 
@@ -2055 +2055 @@
                 wp_send_json_error();
 
-        if ( ! $title = trim( stripslashes( $_POST['title'] ) ) )
+        if ( ! $title = trim( wp_unslash( $_POST['title'] ) ) )
                 $title = wp_basename( $src );
 
@@ -2115 +2115 @@
 
         if ( ! empty($_POST['data']) ) {
-                $data = stripslashes_deep( (array) $_POST['data'] );
+                $data = wp_unslash( (array) $_POST['data'] );
                 $response = apply_filters( 'heartbeat_nopriv_received', $response, $data, $screen_id );
         }