WordPress.org

Make WordPress Core

Changeset 23576


Ignore:
Timestamp:
03/01/2013 05:57:08 PM (7 years ago)
Author:
nacin
Message:

Unslash early, directly on the superglobal. see #21767.

File:
1 edited

Legend:

Unmodified
Added
Removed
  • trunk/wp-admin/includes/ajax-actions.php

    r23563 r23576  
    560560    if ( !current_user_can( 'manage_categories' ) )
    561561        wp_die( -1 );
    562     $names = explode(',', $_POST['newcat']);
     562    $names = explode(',', wp_unslash( $_POST['newcat'] ) );
    563563    $x = new WP_Ajax_Response();
    564564    foreach ( $names as $cat_name ) {
     
    573573        else if ( is_array( $cat_id ) )
    574574            $cat_id = $cat_id['term_id'];
    575         $cat_name = esc_html(wp_unslash($cat_name));
     575        $cat_name = esc_html( $cat_name );
    576576        $x->add( array(
    577577            'what' => 'link-category',
     
    18901890
    18911891    if ( isset( $changes['alt'] ) ) {
    1892         $alt = get_post_meta( $id, '_wp_attachment_image_alt', true );
    1893         $new_alt = wp_unslash( $changes['alt'] );
    1894         if ( $alt != $new_alt ) {
    1895             $new_alt = wp_strip_all_tags( $new_alt, true );
    1896             update_post_meta( $id, '_wp_attachment_image_alt', addslashes( $new_alt ) );
     1892        $alt = wp_unslash( $changes['alt'] );
     1893        if ( $alt != get_post_meta( $id, '_wp_attachment_image_alt', true ) ) {
     1894            $alt = wp_strip_all_tags( $alt, true );
     1895            update_post_meta( $id, '_wp_attachment_image_alt', wp_slash( $alt ) );
    18971896        }
    18981897    }
     
    22042203    $restoreaction = wp_nonce_url(
    22052204        add_query_arg(
    2206             array( 'revision' => $revision->ID, 
     2205            array( 'revision' => $revision->ID,
    22072206                'action' => 'restore' ),
    22082207                '/wp-admin/revision.php'
Note: See TracChangeset for help on using the changeset viewer.