Changeset 4384 for branches/2.0/wp-admin/admin-functions.php

Timestamp:

10/13/2006 12:24:51 AM (20 years ago)

Author:

markjaquith

Message:

Prevent users from entering strings that will be interpreted as serialized arrays/objects on the way out. fixes #2591

File:

• branches/2.0/wp-admin/admin-functions.php (modified) (3 diffs)

branches/2.0/wp-admin/admin-functions.php

@@ -849 +849 @@
                 if ('_' == $entry['meta_key'] { 0 })
                         $style .= ' hidden';
+
+                if ( is_serialized($entry['meta_value']) ) {
+                        if ( is_serialized_string($entry['meta_value']) ) {
+                                // this is a serialized string, so we should display it
+                                $entry['meta_value'] = maybe_unserialize($entry['meta_value']);
+                        } else {
+                                // this is a serialized array/object so we should NOT display it
+                                --$count;
+                                continue;
+                        }
+                }
+
                 $entry['meta_key'] = wp_specialchars( $entry['meta_key'], true );
                 $entry['meta_value'] = wp_specialchars( $entry['meta_value'], true );
@@ -923 +935 @@
         $metakeyselect = $wpdb->escape(stripslashes(trim($_POST['metakeyselect'])));
         $metakeyinput = $wpdb->escape(stripslashes(trim($_POST['metakeyinput'])));
-        $metavalue = $wpdb->escape(stripslashes(trim($_POST['metavalue'])));
+        $metavalue = maybe_serialize(stripslashes((trim($_POST['metavalue']))));
+        $metavalue = $wpdb->escape($metavalue);
 
         if ( ('0' === $metavalue || !empty ($metavalue)) && ((('#NONE#' != $metakeyselect) && !empty ($metakeyselect)) || !empty ($metakeyinput)) ) {
@@ -951 +964 @@
 function update_meta($mid, $mkey, $mvalue) {
         global $wpdb;
-
+        $mvalue = maybe_serialize(stripslashes($mvalue));
+        $mvalue = $wpdb->escape($mvalue);
+        $mid = (int) $mid;
         return $wpdb->query("UPDATE $wpdb->postmeta SET meta_key = '$mkey', meta_value = '$mvalue' WHERE meta_id = '$mid'");
 }