Changeset 38699 for trunk/src/wp-includes/meta.php

Timestamp:

10/01/2016 06:27:27 AM (10 years ago)

Author:

peterwilsoncc

Message:

Meta: Improve ID casting when getting, updating or deleting meta data.

Blindly casting IDs to absolute integers in get_metadata_by_mid(), update_metadata_by_mid() and delete_metadata_by_mid() can cause unexpected behaviour when a floating or negative number is passed.

Fixes #37746.

File:

• trunk/src/wp-includes/meta.php (modified) (3 diffs)

trunk/src/wp-includes/meta.php

@@ -568 +568 @@
         global $wpdb;
 
-        if ( ! $meta_type || ! is_numeric( $meta_id ) ) {
-                return false;
-        }
-
-        $meta_id = absint( $meta_id );
-        if ( ! $meta_id ) {
+        if ( ! $meta_type || ! is_numeric( $meta_id ) || floor( $meta_id ) != $meta_id ) {
+                return false;
+        }
+
+        $meta_id = intval( $meta_id );
+        if ( $meta_id <= 0 ) {
                 return false;
         }
@@ -612 +612 @@
 
         // Make sure everything is valid.
-        if ( ! $meta_type || ! is_numeric( $meta_id ) ) {
-                return false;
-        }
-
-        $meta_id = absint( $meta_id );
-        if ( ! $meta_id ) {
+        if ( ! $meta_type || ! is_numeric( $meta_id ) || floor( $meta_id ) != $meta_id ) {
+                return false;
+        }
+
+        $meta_id = intval( $meta_id );
+        if ( $meta_id <= 0 ) {
                 return false;
         }
@@ -703 +703 @@
 
         // Make sure everything is valid.
-        if ( ! $meta_type || ! is_numeric( $meta_id ) ) {
-                return false;
-        }
-
-        $meta_id = absint( $meta_id );
-        if ( ! $meta_id ) {
+        if ( ! $meta_type || ! is_numeric( $meta_id ) || floor( $meta_id ) != $meta_id ) {
+                return false;
+        }
+
+        $meta_id = intval( $meta_id );
+        if ( $meta_id <= 0 ) {
                 return false;
         }