WordPress.org

Make WordPress Core

Changeset 2784


Ignore:
Timestamp:
08/15/05 04:02:19 (9 years ago)
Author:
matt
Message:

Typos and more secure unsetting. Hat tip: Stefen Esser

File:
1 edited

Legend:

Unmodified
Added
Removed
  • trunk/wp-settings.php

    r2772 r2784  
    11<?php 
    22// Turn register globals off 
    3 if ( ini_get('register_globals') ) { 
    4     $superglobals = array($_SERVER, $_ENV, $_FILES, $_COOKIE, $_POST, $_GET); 
    5     if ( isset($_SESSION) ) 
    6         array_unshift($superglobals, $_SESSION); 
     3function unregister_GLOBALS() { 
     4    if ( !ini_get('register_globals') ) 
     5        return; 
     6 
     7    if ( isset($_REQUEST['GLOBALS']) ) 
     8        die('GLOBALS overwrite attempt detected'); 
     9 
     10    // Variables that shouldn't be unset 
     11    $noUnset = array('GLOBALS', '_GET', '_POST', '_COOKIE', '_REQUEST', '_SERVER', '_ENV', '_FILES', 'table_prefix'); 
    712     
    8     foreach ( $superglobals as $superglobal ) 
    9         foreach ( $superglobal as $global => $value ) 
    10             if ( 'table_prefix' != $global ) 
    11                 unset( $GLOBALS[$global] ); 
     13    $input = array_merge($_GET, $_POST, $_COOKIE, $_SERVER, $_ENV, $_FILES, isset($_SESSION) && is_array($_SESSION) ? $_SESSION : array()); 
     14    foreach ( $input as $k => $v )  
     15        if ( !in_array($k, $noUnset) && isset($GLOBALS[$k]) ) 
     16            unset($GLOBALS[$k]); 
    1217} 
    1318 
    14 $HTTP_HOST = getenv('HTTP_HOST');  /* domain name */ 
    15 $REMOTE_ADDR = getenv('REMOTE_ADDR'); /* visitor's IP */ 
    16 $HTTP_USER_AGENT = getenv('HTTP_USER_AGENT'); /* visitor's browser */ 
     19unregister_GLOBALS();  
     20 
     21$HTTP_USER_AGENT = getenv('HTTP_USER_AGENT'); 
     22unset( $wp_filter, $cache_userdata, $cache_lastcommentmodified, $cache_lastpostdate, $cache_settings, $category_cache, $cache_categories ); 
    1723 
    1824// Fix for IIS, which doesn't set REQUEST_URI 
Note: See TracChangeset for help on using the changeset viewer.