Changeset 38381

Timestamp:

08/26/2016 07:08:23 PM (8 years ago)

Author:

boonebgorges

Message:

Don't improperly cast IDs when fetching post, user, or term objects.

Blindly casting passed IDs to integers can generate false positives
when the ID is cast to 1.

Props deeptiboddapati.
Fixes #37738.

Location:

trunk

Files:

• src/wp-includes/class-wp-comment.php (modified) (1 diff)
• src/wp-includes/class-wp-post.php (modified) (1 diff)
• src/wp-includes/class-wp-term.php (modified) (1 diff)
• tests/phpunit/tests/comment/wpComment.php (added)
• tests/phpunit/tests/post/wpPost.php (added)
• tests/phpunit/tests/term/wpTerm.php (added)

trunk/src/wp-includes/class-wp-comment.php

@@ -192 +192 @@
         global $wpdb;
 
+        if ( ! is_numeric( $id ) || $id != floor( $id ) || ! $id ) {
+            return false;
+        }
+
         $comment_id = (int) $id;
-        if ( ! $comment_id ) {
-            return false;
-        }
 
         $_comment = wp_cache_get( $comment_id, 'comment' );

trunk/src/wp-includes/class-wp-post.php

@@ -211 +211 @@
         global $wpdb;
 
+        if ( ! is_numeric( $post_id ) || $post_id != floor( $post_id ) || ! $post_id ) {
+            return false;
+        }
+
         $post_id = (int) $post_id;
-        if ( ! $post_id )
-            return false;
 
         $_post = wp_cache_get( $post_id, 'posts' );

trunk/src/wp-includes/class-wp-term.php

@@ -126 +126 @@
         global $wpdb;
 
+        if ( ! is_numeric( $term_id ) || $term_id != floor( $term_id ) || ! $term_id ) {
+            return false;
+        }
+
         $term_id = (int) $term_id;
-        if ( ! $term_id ) {
-            return false;
-        }
 
         $_term = wp_cache_get( $term_id, 'terms' );