Changeset 32993 for trunk/src/wp-includes/class-wp-xmlrpc-server.php

Timestamp:

06/29/2015 02:06:25 AM (9 years ago)

Author:

dd32

Message:

XML-RPC: Only escape what we need to in wp.editPage, this allows for passwords with the special characters "' to work in a request.
Props redsweater for initial Patch.
Fixes #32703

File:

• trunk/src/wp-includes/class-wp-xmlrpc-server.php (modified) (1 diff)

trunk/src/wp-includes/class-wp-xmlrpc-server.php

@@ -2748 +2748 @@
      */
     public function wp_editPage( $args ) {
-        // Items not escaped here will be escaped in editPost.
-        $page_id  = (int) $this->escape($args[1]);
-        $username = $this->escape($args[2]);
-        $password = $this->escape($args[3]);
+        // Items will be escaped in mw_editPost.
+        $page_id  = (int) $args[1];
+        $username = $args[2];
+        $password = $args[3];
         $content  = $args[4];
         $publish  = $args[5];
 
-        if ( !$user = $this->login($username, $password) )
-            return $this->error;
+        $escaped_username = $this->escape( $username );
+        $escaped_password = $this->escape( $password );
+
+        if ( !$user = $this->login( $escaped_username, $escaped_password ) ) {
+            return $this->error;
+        }
 
         /** This action is documented in wp-includes/class-wp-xmlrpc-server.php */