Changeset 23578

Timestamp:

03/01/2013 05:58:43 PM (14 years ago)

Author:

nacin

Message:

Ensure the referer functions operate completely on unslashed data: wp_referer_field(), wp_original_referer_field(), wp_get_referer(), wp_get_original_referer().

Use wp_slash() instead of addslashes().

see #21767.

Location:

trunk

Files:

• wp-admin/edit-comments.php (modified) (1 diff)
• wp-admin/edit-form-comment.php (modified) (1 diff)
• wp-admin/includes/media.php (modified) (1 diff)
• wp-admin/includes/post.php (modified) (2 diffs)
• wp-includes/functions.php (modified) (5 diffs)

trunk/wp-admin/edit-comments.php

@@ -22 +22 @@
         if ( 'delete_all' == $doaction && !empty( $_REQUEST['pagegen_timestamp'] ) ) {
                 $comment_status = wp_unslash( $_REQUEST['comment_status'] );
-                $delete_time = wp_unslash ( $_REQUEST['pagegen_timestamp'] );
+                $delete_time = wp_unslash( $_REQUEST['pagegen_timestamp'] );
                 $comment_ids = $wpdb->get_col( $wpdb->prepare( "SELECT comment_ID FROM $wpdb->comments WHERE comment_approved = %s AND %s > comment_date_gmt", $comment_status, $delete_time ) );
                 $doaction = 'delete';

trunk/wp-admin/edit-form-comment.php

@@ -133 +133 @@
 <input type="hidden" name="c" value="<?php echo esc_attr($comment->comment_ID) ?>" />
 <input type="hidden" name="p" value="<?php echo esc_attr($comment->comment_post_ID) ?>" />
-<input name="referredby" type="hidden" id="referredby" value="<?php echo esc_url(wp_unslash(wp_get_referer())); ?>" />
+<input name="referredby" type="hidden" id="referredby" value="<?php echo esc_url( wp_get_referer() ); ?>" />
 <?php wp_original_referer_field(true, 'previous'); ?>
 <input type="hidden" name="noredir" value="1" />

trunk/wp-admin/includes/media.php

@@ -468 +468 @@
 
                 if ( isset($attachment['image_alt']) ) {
-                        $image_alt = get_post_meta($attachment_id, '_wp_attachment_image_alt', true);
-                        if ( $image_alt != wp_unslash($attachment['image_alt']) ) {
-                                $image_alt = wp_strip_all_tags( wp_unslash($attachment['image_alt']), true );
+                        $image_alt = wp_unslash( $attachment['image_alt'] );
+                        if ( $image_alt != get_post_meta($attachment_id, '_wp_attachment_image_alt', true) ) {
+                                $image_alt = wp_strip_all_tags( $image_alt, true );
                                 // update_meta expects slashed
-                                update_post_meta( $attachment_id, '_wp_attachment_image_alt', addslashes($image_alt) );
+                                update_post_meta( $attachment_id, '_wp_attachment_image_alt', wp_slash( $image_alt ) );
                         }
                 }

trunk/wp-admin/includes/post.php

@@ -198 +198 @@
 
         if ( isset( $post_data[ '_wp_format_url' ] ) ) {
-                update_post_meta( $post_ID, '_wp_format_url', addslashes( esc_url_raw( wp_unslash( $post_data['_wp_format_url'] ) ) ) );
+                update_post_meta( $post_ID, '_wp_format_url', wp_slash( esc_url_raw( wp_unslash( $post_data['_wp_format_url'] ) ) ) );
         }
 
@@ -236 +236 @@
         if ( 'attachment' == $post_data['post_type'] ) {
                 if ( isset( $post_data[ '_wp_attachment_image_alt' ] ) ) {
-                        $image_alt = get_post_meta( $post_ID, '_wp_attachment_image_alt', true );
-                        if ( $image_alt != wp_unslash( $post_data['_wp_attachment_image_alt'] ) ) {
-                                $image_alt = wp_strip_all_tags( wp_unslash( $post_data['_wp_attachment_image_alt'] ), true );
+                        $image_alt = wp_unslash( $post_data['_wp_attachment_image_alt'] );
+                        if ( $image_alt != get_post_meta( $post_ID, '_wp_attachment_image_alt', true ) ) {
+                                $image_alt = wp_strip_all_tags( $image_alt, true );
                                 // update_meta expects slashed
-                                update_post_meta( $post_ID, '_wp_attachment_image_alt', addslashes( $image_alt ) );
+                                update_post_meta( $post_ID, '_wp_attachment_image_alt', wp_slash( $image_alt ) );
                         }
                 }

trunk/wp-includes/functions.php

@@ -1234 +1234 @@
  */
 function wp_referer_field( $echo = true ) {
-        $ref = esc_attr( $_SERVER['REQUEST_URI'] );
-        $referer_field = '<input type="hidden" name="_wp_http_referer" value="'. $ref . '" />';
+        $referer_field = '<input type="hidden" name="_wp_http_referer" value="'. esc_attr( wp_unslash( $_SERVER['REQUEST_URI'] ) ) . '" />';
 
         if ( $echo )
@@ -1258 +1257 @@
  */
 function wp_original_referer_field( $echo = true, $jump_back_to = 'current' ) {
-        $jump_back_to = ( 'previous' == $jump_back_to ) ? wp_get_referer() : $_SERVER['REQUEST_URI'];
-        $ref = ( wp_get_original_referer() ) ? wp_get_original_referer() : $jump_back_to;
-        $orig_referer_field = '<input type="hidden" name="_wp_original_http_referer" value="' . esc_attr( stripslashes( $ref ) ) . '" />';
+        if ( ! $ref = wp_get_original_referer() ) {
+                $ref = 'previous' == $jump_back_to ? wp_get_referer() : wp_unslash( $_SERVER['REQUEST_URI'] );
+        }
+        $orig_referer_field = '<input type="hidden" name="_wp_original_http_referer" value="' . esc_attr( $ref ) . '" />';
         if ( $echo )
                 echo $orig_referer_field;
@@ -1279 +1279 @@
         $ref = false;
         if ( ! empty( $_REQUEST['_wp_http_referer'] ) )
-                $ref = $_REQUEST['_wp_http_referer'];
+                $ref = wp_unslash( $_REQUEST['_wp_http_referer'] );
         else if ( ! empty( $_SERVER['HTTP_REFERER'] ) )
-                $ref = $_SERVER['HTTP_REFERER'];
-
-        if ( $ref && $ref !== $_SERVER['REQUEST_URI'] )
+                $ref = wp_unslash( $_SERVER['HTTP_REFERER'] );
+
+        if ( $ref && $ref !== wp_unslash( $_SERVER['REQUEST_URI'] ) )
                 return wp_unslash( $ref );
         return false;
@@ -1299 +1299 @@
 function wp_get_original_referer() {
         if ( !empty( $_REQUEST['_wp_original_http_referer'] ) )
-                return $_REQUEST['_wp_original_http_referer'];
+                return wp_unslash( $_REQUEST['_wp_original_http_referer'] );
         return false;
 }
@@ -3907 +3907 @@
 /**
  * Output the JS that shows the wp-login iframe when the user is no longer logged in
- */ 
+ */
 function wp_auth_check_js() {
         ?>