Changeset 41292

Timestamp:

08/22/2017 02:51:47 PM (8 years ago)

Author:

johnbillion

Message:

Widgets: Correctly strip slashes from widget and sidebar names to allow namespaced widgets to function correctly.

Fixes #27770

Props jdgrimes

File:

• trunk/src/wp-admin/includes/ajax-actions.php (modified) (2 diffs)

trunk/src/wp-admin/includes/ajax-actions.php

@@ -1880 +1880 @@
     if ( is_array($_POST['sidebars']) ) {
         $sidebars = array();
-        foreach ( $_POST['sidebars'] as $key => $val ) {
+        foreach ( wp_unslash( $_POST['sidebars'] ) as $key => $val ) {
             $sb = array();
             if ( !empty($val) ) {
@@ -1936 +1936 @@
     do_action( 'sidebar_admin_setup' );
 
-    $id_base = $_POST['id_base'];
-    $widget_id = $_POST['widget-id'];
+    $id_base = wp_unslash( $_POST['id_base'] );
+    $widget_id = wp_unslash( $_POST['widget-id'] );
     $sidebar_id = $_POST['sidebar'];
     $multi_number = !empty($_POST['multi_number']) ? (int) $_POST['multi_number'] : 0;