Changeset 23578

Timestamp:

03/01/2013 05:58:43 PM (12 years ago)

Author:

nacin

Message:

Ensure the referer functions operate completely on unslashed data: wp_referer_field(), wp_original_referer_field(), wp_get_referer(), wp_get_original_referer().

Use wp_slash() instead of addslashes().

see #21767.

Location:

trunk

Files:

• wp-admin/edit-comments.php (modified) (1 diff)
• wp-admin/edit-form-comment.php (modified) (1 diff)
• wp-admin/includes/media.php (modified) (1 diff)
• wp-admin/includes/post.php (modified) (2 diffs)
• wp-includes/functions.php (modified) (5 diffs)

trunk/wp-admin/edit-comments.php

@@ -22 +22 @@
     if ( 'delete_all' == $doaction && !empty( $_REQUEST['pagegen_timestamp'] ) ) {
         $comment_status = wp_unslash( $_REQUEST['comment_status'] );
-        $delete_time = wp_unslash ( $_REQUEST['pagegen_timestamp'] );
+        $delete_time = wp_unslash( $_REQUEST['pagegen_timestamp'] );
         $comment_ids = $wpdb->get_col( $wpdb->prepare( "SELECT comment_ID FROM $wpdb->comments WHERE comment_approved = %s AND %s > comment_date_gmt", $comment_status, $delete_time ) );
         $doaction = 'delete';

trunk/wp-admin/edit-form-comment.php

@@ -133 +133 @@
 <input type="hidden" name="c" value="<?php echo esc_attr($comment->comment_ID) ?>" />
 <input type="hidden" name="p" value="<?php echo esc_attr($comment->comment_post_ID) ?>" />
-<input name="referredby" type="hidden" id="referredby" value="<?php echo esc_url(wp_unslash(wp_get_referer())); ?>" />
+<input name="referredby" type="hidden" id="referredby" value="<?php echo esc_url( wp_get_referer() ); ?>" />
 <?php wp_original_referer_field(true, 'previous'); ?>
 <input type="hidden" name="noredir" value="1" />

trunk/wp-admin/includes/media.php

@@ -468 +468 @@
 
         if ( isset($attachment['image_alt']) ) {
-            $image_alt = get_post_meta($attachment_id, '_wp_attachment_image_alt', true);
-            if ( $image_alt != wp_unslash($attachment['image_alt']) ) {
-                $image_alt = wp_strip_all_tags( wp_unslash($attachment['image_alt']), true );
+            $image_alt = wp_unslash( $attachment['image_alt'] );
+            if ( $image_alt != get_post_meta($attachment_id, '_wp_attachment_image_alt', true) ) {
+                $image_alt = wp_strip_all_tags( $image_alt, true );
                 // update_meta expects slashed
-                update_post_meta( $attachment_id, '_wp_attachment_image_alt', addslashes($image_alt) );
+                update_post_meta( $attachment_id, '_wp_attachment_image_alt', wp_slash( $image_alt ) );
             }
         }

trunk/wp-admin/includes/post.php

@@ -198 +198 @@
 
     if ( isset( $post_data[ '_wp_format_url' ] ) ) {
-        update_post_meta( $post_ID, '_wp_format_url', addslashes( esc_url_raw( wp_unslash( $post_data['_wp_format_url'] ) ) ) );
+        update_post_meta( $post_ID, '_wp_format_url', wp_slash( esc_url_raw( wp_unslash( $post_data['_wp_format_url'] ) ) ) );
     }
 
@@ -236 +236 @@
     if ( 'attachment' == $post_data['post_type'] ) {
         if ( isset( $post_data[ '_wp_attachment_image_alt' ] ) ) {
-            $image_alt = get_post_meta( $post_ID, '_wp_attachment_image_alt', true );
-            if ( $image_alt != wp_unslash( $post_data['_wp_attachment_image_alt'] ) ) {
-                $image_alt = wp_strip_all_tags( wp_unslash( $post_data['_wp_attachment_image_alt'] ), true );
+            $image_alt = wp_unslash( $post_data['_wp_attachment_image_alt'] );
+            if ( $image_alt != get_post_meta( $post_ID, '_wp_attachment_image_alt', true ) ) {
+                $image_alt = wp_strip_all_tags( $image_alt, true );
                 // update_meta expects slashed
-                update_post_meta( $post_ID, '_wp_attachment_image_alt', addslashes( $image_alt ) );
+                update_post_meta( $post_ID, '_wp_attachment_image_alt', wp_slash( $image_alt ) );
             }
         }

trunk/wp-includes/functions.php

@@ -1234 +1234 @@
  */
 function wp_referer_field( $echo = true ) {
-    $ref = esc_attr( $_SERVER['REQUEST_URI'] );
-    $referer_field = '<input type="hidden" name="_wp_http_referer" value="'. $ref . '" />';
+    $referer_field = '<input type="hidden" name="_wp_http_referer" value="'. esc_attr( wp_unslash( $_SERVER['REQUEST_URI'] ) ) . '" />';
 
     if ( $echo )
@@ -1258 +1257 @@
  */
 function wp_original_referer_field( $echo = true, $jump_back_to = 'current' ) {
-    $jump_back_to = ( 'previous' == $jump_back_to ) ? wp_get_referer() : $_SERVER['REQUEST_URI'];
-    $ref = ( wp_get_original_referer() ) ? wp_get_original_referer() : $jump_back_to;
-    $orig_referer_field = '<input type="hidden" name="_wp_original_http_referer" value="' . esc_attr( stripslashes( $ref ) ) . '" />';
+    if ( ! $ref = wp_get_original_referer() ) {
+        $ref = 'previous' == $jump_back_to ? wp_get_referer() : wp_unslash( $_SERVER['REQUEST_URI'] );
+    }
+    $orig_referer_field = '<input type="hidden" name="_wp_original_http_referer" value="' . esc_attr( $ref ) . '" />';
     if ( $echo )
         echo $orig_referer_field;
@@ -1279 +1279 @@
     $ref = false;
     if ( ! empty( $_REQUEST['_wp_http_referer'] ) )
-        $ref = $_REQUEST['_wp_http_referer'];
+        $ref = wp_unslash( $_REQUEST['_wp_http_referer'] );
     else if ( ! empty( $_SERVER['HTTP_REFERER'] ) )
-        $ref = $_SERVER['HTTP_REFERER'];
-
-    if ( $ref && $ref !== $_SERVER['REQUEST_URI'] )
+        $ref = wp_unslash( $_SERVER['HTTP_REFERER'] );
+
+    if ( $ref && $ref !== wp_unslash( $_SERVER['REQUEST_URI'] ) )
         return wp_unslash( $ref );
     return false;
@@ -1299 +1299 @@
 function wp_get_original_referer() {
     if ( !empty( $_REQUEST['_wp_original_http_referer'] ) )
-        return $_REQUEST['_wp_original_http_referer'];
+        return wp_unslash( $_REQUEST['_wp_original_http_referer'] );
     return false;
 }
@@ -3907 +3907 @@
 /**
  * Output the JS that shows the wp-login iframe when the user is no longer logged in
- */ 
+ */
 function wp_auth_check_js() {
     ?>