Changeset 29339

Timestamp:

08/01/2014 05:09:53 PM (12 years ago)

Author:

wonderboymusic

Message:

Bail on update_user_meta() when $object_id is non-numeric.

Adds unit test.

Props jacklenox, wonderboymusic.
Fixes #28315.

Location:

trunk

Files:

• src/wp-includes/meta.php (modified) (1 diff)
• tests/phpunit/tests/user.php (modified) (1 diff)

trunk/src/wp-includes/meta.php

@@ -138 +138 @@
                 return false;
 
-        if ( !$object_id = absint($object_id) )
-                return false;
+        if ( ! is_numeric( $object_id ) || ! $object_id = absint( $object_id ) ) {
+                return false;
+        }
 
         if ( ! $table = _get_meta_table($meta_type) )

trunk/tests/phpunit/tests/user.php

@@ -628 +628 @@
                 $this->assertInstanceOf( 'WP_Error', wp_update_user( array( 'ID' => $user_id ) ) );
         }
+
+        /**
+         * @ticket 28315
+         */
+        function test_user_meta_error() {
+                $this->factory->user->create( array( 'user_email' => 'taco@burrito.com' ) );
+                $id = $this->factory->user->create( array( 'user_email' => 'taco@burrito.com' ) );
+
+                $this->assertWPError( $id );
+                @update_user_meta( $id, 'key', 'value' );
+
+                $metas = array_keys( get_user_meta( 1 ) );
+                $this->assertNotContains( 'key', $metas );
+        }
 }