Changeset 23594 for trunk/wp-login.php

Timestamp:

03/03/2013 09:11:40 PM (13 years ago)

Author:

ryan

Message:

Use wp_unslash() instead of stripslashes() and stripslashes_deep(). Use wp_slash() instead of add_magic_quotes().

see #21767

File:

• trunk/wp-login.php (modified) (4 diffs)

trunk/wp-login.php

@@ -400 +400 @@
 
     // 10 days
-    setcookie( 'wp-postpass_' . COOKIEHASH, $wp_hasher->HashPassword( stripslashes( $_POST['post_password'] ) ), time() + 10 * DAY_IN_SECONDS, COOKIEPATH );
+    setcookie( 'wp-postpass_' . COOKIEHASH, $wp_hasher->HashPassword( wp_unslash( $_POST['post_password'] ) ), time() + 10 * DAY_IN_SECONDS, COOKIEPATH );
 
     wp_safe_redirect( wp_get_referer() );
@@ -435 +435 @@
     login_header(__('Lost Password'), '<p class="message">' . __('Please enter your username or email address. You will receive a link to create a new password via email.') . '</p>', $errors);
 
-    $user_login = isset($_POST['user_login']) ? stripslashes($_POST['user_login']) : '';
+    $user_login = isset($_POST['user_login']) ? wp_unslash($_POST['user_login']) : '';
 
 ?>
@@ -551 +551 @@
     <p>
         <label for="user_login"><?php _e('Username') ?><br />
-        <input type="text" name="user_login" id="user_login" class="input" value="<?php echo esc_attr(stripslashes($user_login)); ?>" size="20" /></label>
+        <input type="text" name="user_login" id="user_login" class="input" value="<?php echo esc_attr(wp_unslash($user_login)); ?>" size="20" /></label>
     </p>
     <p>
         <label for="user_email"><?php _e('E-mail') ?><br />
-        <input type="text" name="user_email" id="user_email" class="input" value="<?php echo esc_attr(stripslashes($user_email)); ?>" size="25" /></label>
+        <input type="text" name="user_email" id="user_email" class="input" value="<?php echo esc_attr(wp_unslash($user_email)); ?>" size="25" /></label>
     </p>
 <?php do_action('register_form'); ?>
@@ -671 +671 @@
 
     if ( isset($_POST['log']) )
-        $user_login = ( 'incorrect_password' == $errors->get_error_code() || 'empty_password' == $errors->get_error_code() ) ? esc_attr(stripslashes($_POST['log'])) : '';
+        $user_login = ( 'incorrect_password' == $errors->get_error_code() || 'empty_password' == $errors->get_error_code() ) ? esc_attr(wp_unslash($_POST['log'])) : '';
     $rememberme = ! empty( $_POST['rememberme'] );
 ?>