Changeset 34274

Timestamp:

09/17/2015 10:21:06 PM (9 years ago)

Author:

wonderboymusic

Message:

In wp-comments-post.php, sanity check a few of the comment inputs that are expected to be a string beford calling string-only functions on them.

Props Kloon.
Fixes #23416.

File:

• trunk/src/wp-comments-post.php (modified) (1 diff)

trunk/src/wp-comments-post.php

@@ -90 +90 @@
 }
 
-$comment_author       = ( isset($_POST['author']) )  ? trim(strip_tags($_POST['author'])) : null;
-$comment_author_email = ( isset($_POST['email']) )   ? trim($_POST['email']) : null;
-$comment_author_url   = ( isset($_POST['url']) )     ? trim($_POST['url']) : null;
-$comment_content      = ( isset($_POST['comment']) ) ? trim($_POST['comment']) : null;
+$comment_author       = ( isset( $_POST['author'] ) && is_string( $_POST['author'] ) ) ? trim( strip_tags( $_POST['author'] ) ) : null;
+$comment_author_email = ( isset( $_POST['email'] ) && is_email( $_POST['email'] ) ) ? trim( $_POST['email'] ) : null;
+$comment_author_url   = ( isset( $_POST['url'] ) && is_string( $_POST['url'] ) ) ? trim( $_POST['url'] ) : null;
+$comment_content      = ( isset( $_POST['comment'] ) && is_string( $_POST['comment'] ) ) ? trim( $_POST['comment'] ) : null;
 
 // If the user is logged in