WordPress.org
Get WordPress

Make WordPress Core

Changeset 23594


Ignore:
Timestamp:
03/03/2013 09:11:40 PM (14 years ago)
Author:
ryan
Message:

Use wp_unslash() instead of stripslashes() and stripslashes_deep(). Use wp_slash() instead of add_magic_quotes().

see #21767

Location:
trunk
Files:
8 edited

Legend:

Unmodified
Added
Removed

  • trunk/wp-includes/post-template.php

    r23554 r23594  
    584584        }
    585585
    586         $hash = stripslashes( $_COOKIE[ 'wp-postpass_' . COOKIEHASH ] );
     586        $hash = wp_unslash( $_COOKIE[ 'wp-postpass_' . COOKIEHASH ] );
    587587
    588588        return ! $wp_hasher->CheckPassword( $post->post_password, $hash );

  • trunk/wp-includes/post.php

    r23554 r23594  
    361361        }
    362362
    363         // Strip leading and trailing whitespace
     363        // ` leading and trailing whitespace
    364364        $main = preg_replace('/^[\s]*(.*)[\s]*$/', '\\1', $main);
    365365        $extended = preg_replace('/^[\s]*(.*)[\s]*$/', '\\1', $extended);
    … …  
    27982798        $data = compact( array( 'post_author', 'post_date', 'post_date_gmt', 'post_content', 'post_content_filtered', 'post_title', 'post_excerpt', 'post_status', 'post_type', 'comment_status', 'ping_status', 'post_password', 'post_name', 'to_ping', 'pinged', 'post_modified', 'post_modified_gmt', 'post_parent', 'menu_order', 'guid' ) );
    27992799        $data = apply_filters('wp_insert_post_data', $data, $postarr);
    2800         $data = stripslashes_deep( $data );
     2800        $data = wp_unslash( $data );
    28012801        $where = array( 'ID' => $post_ID );
    28022802
    … …  
    28112811        } else {
    28122812                if ( isset($post_mime_type) )
    2813                         $data['post_mime_type'] = stripslashes( $post_mime_type ); // This isn't in the update
     2813                        $data['post_mime_type'] = wp_unslash( $post_mime_type ); // This isn't in the update
    28142814                // If there is a suggested ID, use it if not already present
    28152815                if ( !empty($import_id) ) {
    … …  
    29052905                // non-escaped post was passed
    29062906                $postarr = get_object_vars($postarr);
    2907                 $postarr = add_magic_quotes($postarr);
     2907                $postarr = wp_slash($postarr);
    29082908        }
    29092909
    … …  
    29122912
    29132913        // Escape data pulled from DB.
    2914         $post = add_magic_quotes($post);
     2914        $post = wp_slash($post);
    29152915
    29162916        // Passed post category list overwrites existing category list if not empty.
    … …  
    32583258        $new = apply_filters('add_ping', $new);
    32593259        // expected_slashed ($new)
    3260         $new = stripslashes($new);
     3260        $new = wp_unslash($new);
    32613261        return $wpdb->update( $wpdb->posts, array( 'pinged' => $new ), array( 'ID' => $post_id ) );
    32623262}
    … …  
    33513351                foreach( (array) $trackback_urls as $tb_url) {
    33523352                        $tb_url = trim($tb_url);
    3353                         trackback($tb_url, stripslashes($post_title), $excerpt, $post_id);
     3353                        trackback($tb_url, wp_unslash($post_title), $excerpt, $post_id);
    33543354                }
    33553355        }
    … …  
    36953695
    36963696                // meta_key and meta_value might be slashed
    3697                 $meta_key = stripslashes($meta_key);
    3698                 $meta_value = stripslashes($meta_value);
     3697                $meta_key = wp_unslash($meta_key);
     3698                $meta_value = wp_unslash($meta_value);
    36993699                if ( ! empty( $meta_key ) )
    37003700                        $where .= $wpdb->prepare(" AND $wpdb->postmeta.meta_key = %s", $meta_key);
    … …  
    39663966        // expected_slashed (everything!)
    39673967        $data = compact( array( 'post_author', 'post_date', 'post_date_gmt', 'post_content', 'post_content_filtered', 'post_title', 'post_excerpt', 'post_status', 'post_type', 'comment_status', 'ping_status', 'post_password', 'post_name', 'to_ping', 'pinged', 'post_modified', 'post_modified_gmt', 'post_parent', 'menu_order', 'post_mime_type', 'guid' ) );
    3968         $data = stripslashes_deep( $data );
     3968        $data = wp_unslash( $data );
    39693969
    39703970        if ( $update ) {

  • trunk/wp-includes/revision.php

    r23554 r23594  
    242242
    243243        $post = _wp_post_revision_fields( $post, $autosave );
    244         $post = add_magic_quotes($post); //since data is from db
     244        $post = wp_slash($post); //since data is from db
    245245
    246246        $revision_id = wp_insert_post( $post );
    … …  
    321321        $update['ID'] = $revision['post_parent'];
    322322
    323         $update = add_magic_quotes( $update ); //since data is from db
     323        $update = wp_slash( $update ); //since data is from db
    324324
    325325        $post_id = wp_update_post( $update );

  • trunk/wp-includes/taxonomy.php

    r23554 r23594  
    960960        } else if ( 'name' == $field ) {
    961961                // Assume already escaped
    962                 $value = stripslashes($value);
     962                $value = wp_unslash($value);
    963963                $field = 't.name';
    964964        } else {
    … …  
    15001500        }
    15011501
    1502         $term = trim( stripslashes( $term ) );
     1502        $term = trim( wp_unslash( $term ) );
    15031503
    15041504        if ( '' === $slug = sanitize_title($term) )
    … …  
    20632063
    20642064        // expected_slashed ($name)
    2065         $name = stripslashes($name);
    2066         $description = stripslashes($description);
     2065        $name = wp_unslash($name);
     2066        $description = wp_unslash($description);
    20672067
    20682068        if ( empty($slug) )
    … …  
    24462446
    24472447        // Escape data pulled from DB.
    2448         $term = add_magic_quotes($term);
     2448        $term = wp_slash($term);
    24492449
    24502450        // Merge old and new args with new args overwriting old ones.
    … …  
    24572457
    24582458        // expected_slashed ($name)
    2459         $name = stripslashes($name);
    2460         $description = stripslashes($description);
     2459        $name = wp_unslash($name);
     2460        $description = wp_unslash($description);
    24612461
    24622462        if ( '' == trim($name) )

  • trunk/wp-includes/user.php

    r23588 r23594  
    13911391
    13921392        $data = compact( 'user_pass', 'user_email', 'user_url', 'user_nicename', 'display_name', 'user_registered' );
    1393         $data = stripslashes_deep( $data );
     1393        $data = wp_unslash( $data );
    13941394
    13951395        if ( $update ) {
    … …  
    15051505 */
    15061506function wp_create_user($username, $password, $email = '') {
    1507         $user_login = esc_sql( $username );
    1508         $user_email = esc_sql( $email    );
     1507        $user_login = wp_slash( $username );
     1508        $user_email = wp_slash( $email    );
    15091509        $user_pass = $password;
    15101510

  • trunk/wp-login.php

    r23558 r23594  
    400400
    401401        // 10 days
    402         setcookie( 'wp-postpass_' . COOKIEHASH, $wp_hasher->HashPassword( stripslashes( $_POST['post_password'] ) ), time() + 10 * DAY_IN_SECONDS, COOKIEPATH );
     402        setcookie( 'wp-postpass_' . COOKIEHASH, $wp_hasher->HashPassword( wp_unslash( $_POST['post_password'] ) ), time() + 10 * DAY_IN_SECONDS, COOKIEPATH );
    403403
    404404        wp_safe_redirect( wp_get_referer() );
    … …  
    435435        login_header(__('Lost Password'), '<p class="message">' . __('Please enter your username or email address. You will receive a link to create a new password via email.') . '</p>', $errors);
    436436
    437         $user_login = isset($_POST['user_login']) ? stripslashes($_POST['user_login']) : '';
     437        $user_login = isset($_POST['user_login']) ? wp_unslash($_POST['user_login']) : '';
    438438
    439439?>
    … …  
    551551        <p>
    552552                <label for="user_login"><?php _e('Username') ?><br />
    553                 <input type="text" name="user_login" id="user_login" class="input" value="<?php echo esc_attr(stripslashes($user_login)); ?>" size="20" /></label>
     553                <input type="text" name="user_login" id="user_login" class="input" value="<?php echo esc_attr(wp_unslash($user_login)); ?>" size="20" /></label>
    554554        </p>
    555555        <p>
    556556                <label for="user_email"><?php _e('E-mail') ?><br />
    557                 <input type="text" name="user_email" id="user_email" class="input" value="<?php echo esc_attr(stripslashes($user_email)); ?>" size="25" /></label>
     557                <input type="text" name="user_email" id="user_email" class="input" value="<?php echo esc_attr(wp_unslash($user_email)); ?>" size="25" /></label>
    558558        </p>
    559559<?php do_action('register_form'); ?>
    … …  
    671671
    672672        if ( isset($_POST['log']) )
    673                 $user_login = ( 'incorrect_password' == $errors->get_error_code() || 'empty_password' == $errors->get_error_code() ) ? esc_attr(stripslashes($_POST['log'])) : '';
     673                $user_login = ( 'incorrect_password' == $errors->get_error_code() || 'empty_password' == $errors->get_error_code() ) ? esc_attr(wp_unslash($_POST['log'])) : '';
    674674        $rememberme = ! empty( $_POST['rememberme'] );
    675675?>

  • trunk/wp-mail.php

    r23554 r23594  
    203203
    204204        $post_data = compact('post_content','post_title','post_date','post_date_gmt','post_author','post_category', 'post_status');
    205         $post_data = add_magic_quotes($post_data);
     205        $post_data = wp_slash($post_data);
    206206
    207207        $post_ID = wp_insert_post($post_data);

  • trunk/wp-trackback.php

    r23554 r23594  
    4646
    4747// These three are stripslashed here so that they can be properly escaped after mb_convert_encoding()
    48 $title     = isset($_POST['title'])     ? stripslashes($_POST['title'])      : '';
    49 $excerpt   = isset($_POST['excerpt'])   ? stripslashes($_POST['excerpt'])    : '';
    50 $blog_name = isset($_POST['blog_name']) ? stripslashes($_POST['blog_name'])  : '';
     48$title     = isset($_POST['title'])     ? wp_unslash($_POST['title'])      : '';
     49$excerpt   = isset($_POST['excerpt'])   ? wp_unslash($_POST['excerpt'])    : '';
     50$blog_name = isset($_POST['blog_name']) ? wp_unslash($_POST['blog_name'])  : '';
    5151
    5252if ($charset)
    … …  
    6666
    6767// Now that mb_convert_encoding() has been given a swing, we need to escape these three
    68 $title     = $wpdb->escape($title);
    69 $excerpt   = $wpdb->escape($excerpt);
    70 $blog_name = $wpdb->escape($blog_name);
     68$title     = wp_slash($title);
     69$excerpt   = wp_slash($excerpt);
     70$blog_name = wp_slash($blog_name);
    7171
    7272if ( is_single() || is_page() )
Note: See TracChangeset for help on using the changeset viewer.