WordPress.org

Make WordPress Core

Changeset 41292


Ignore:
Timestamp:
08/22/2017 02:51:47 PM (3 years ago)
Author:
johnbillion
Message:

Widgets: Correctly strip slashes from widget and sidebar names to allow namespaced widgets to function correctly.

Fixes #27770

Props jdgrimes

File:
1 edited

Legend:

Unmodified
Added
Removed
  • trunk/src/wp-admin/includes/ajax-actions.php

    r41290 r41292  
    18801880    if ( is_array($_POST['sidebars']) ) {
    18811881        $sidebars = array();
    1882         foreach ( $_POST['sidebars'] as $key => $val ) {
     1882        foreach ( wp_unslash( $_POST['sidebars'] ) as $key => $val ) {
    18831883            $sb = array();
    18841884            if ( !empty($val) ) {
     
    19361936    do_action( 'sidebar_admin_setup' );
    19371937
    1938     $id_base = $_POST['id_base'];
    1939     $widget_id = $_POST['widget-id'];
     1938    $id_base = wp_unslash( $_POST['id_base'] );
     1939    $widget_id = wp_unslash( $_POST['widget-id'] );
    19401940    $sidebar_id = $_POST['sidebar'];
    19411941    $multi_number = !empty($_POST['multi_number']) ? (int) $_POST['multi_number'] : 0;
Note: See TracChangeset for help on using the changeset viewer.