Changeset 44070

Timestamp:

12/13/2018 01:56:35 AM (8 years ago)

Author:

pento

Message:

Editor: Remove unwanted fields before saving posts.

The meta_input, file, and guid fields are not intended to be updated through user input.

Merges [44047] to the 4.0 branch.

Location:

branches/4.0

Files:

• . (modified) (1 prop)
• src/wp-admin/includes/ajax-actions.php (modified) (1 diff)
• src/wp-admin/includes/post.php (modified) (11 diffs)
• src/wp-admin/post.php (modified) (1 diff)

branches/4.0/src/wp-admin/includes/ajax-actions.php

@@ -1836 +1836 @@
         }
 
-        $post_data = isset( $_REQUEST['post_data'] ) ? $_REQUEST['post_data'] : array();
+        $post_data = ! empty( $_REQUEST['post_data'] ) ? _wp_get_allowed_postdata( _wp_translate_postdata( false, (array) $_REQUEST['post_data'] ) ) : array();
+
+        if ( is_wp_error( $post_data ) ) {
+                wp_die( $post_data->get_error_message() );
+        }
 
         // If the context is custom header or background, make sure the uploaded file is an image.

branches/4.0/src/wp-admin/includes/post.php

@@ -177 +177 @@
 
 /**
+ * Returns only allowed post data fields
+ *
+ * @since 4.9.9
+ *
+ * @param array $post_data Array of post data. Defaults to the contents of $_POST.
+ * @return object|bool WP_Error on failure, true on success.
+ */
+function _wp_get_allowed_postdata( $post_data = null ) {
+        if ( empty( $post_data ) ) {
+                $post_data = $_POST;
+        }
+
+        // Pass through errors
+        if ( is_wp_error( $post_data ) ) {
+                return $post_data;
+        }
+
+        return array_diff_key( $post_data, array_flip( array( 'meta_input', 'file', 'guid' ) ) );
+}
+
+/**
  * Update an existing post with values provided in $_POST.
  *
@@ -242 +263 @@
         if ( is_wp_error($post_data) )
                 wp_die( $post_data->get_error_message() );
+        $translated = _wp_get_allowed_postdata( $post_data );
 
         // Post Formats
@@ -319 +341 @@
 
                 /** This filter is documented in wp-admin/includes/media.php */
-                $post_data = apply_filters( 'attachment_fields_to_save', $post_data, $attachment_data );
+                $translated = apply_filters( 'attachment_fields_to_save', $translated, $attachment_data );
         }
 
@@ -326 +348 @@
         update_post_meta( $post_ID, '_edit_last', get_current_user_id() );
 
-        $success = wp_update_post( $post_data );
+        $success = wp_update_post( $translated );
         // If the save failed, see if we can sanity check the main fields and try again
         if ( ! $success && is_callable( array( $wpdb, 'strip_invalid_text_for_column' ) ) ) {
@@ -332 +354 @@
 
                 foreach( $fields as $field ) {
-                        if ( isset( $post_data[ $field ] ) ) {
-                                $post_data[ $field ] = $wpdb->strip_invalid_text_for_column( $wpdb->posts, $field, $post_data[ $field ] );
+                        if ( isset( $translated[ $field ] ) ) {
+                                $translated[ $field ] = $wpdb->strip_invalid_text_for_column( $wpdb->posts, $field, $translated[ $field ] );
                         }
                 }
 
-                wp_update_post( $post_data );
+                wp_update_post( $translated );
         }
 
@@ -495 +517 @@
                 }
 
+                $post_data['post_ID']        = $post_ID;
                 $post_data['post_type'] = $post->post_type;
                 $post_data['post_mime_type'] = $post->post_mime_type;
-                $post_data['guid'] = $post->guid;
 
                 foreach ( array( 'comment_status', 'ping_status', 'post_author' ) as $field ) {
@@ -505 +527 @@
                 }
 
-                $post_data['ID'] = $post_ID;
-                $post_data['post_ID'] = $post_ID;
-
                 $post_data = _wp_translate_postdata( true, $post_data );
                 if ( is_wp_error( $post_data ) ) {
@@ -513 +532 @@
                         continue;
                 }
+                $post_data = _wp_get_allowed_postdata( $post_data );
 
                 $updated[] = wp_update_post( $post_data );
@@ -523 +543 @@
                 }
 
-                if ( isset( $post_data['post_format'] ) )
-                        set_post_format( $post_ID, $post_data['post_format'] );
+                if ( isset( $shared_post_data['post_format'] ) )
+                        set_post_format( $post_ID, $shared_post_data['post_format'] );
         }
 
@@ -700 +720 @@
         if ( is_wp_error($translated) )
                 return $translated;
+        $translated = _wp_get_allowed_postdata( $translated );
 
         // Create the post.
-        $post_ID = wp_insert_post( $_POST );
+        $post_ID = wp_insert_post( $translated );
         if ( is_wp_error( $post_ID ) )
                 return $post_ID;
@@ -1547 +1568 @@
         if ( is_wp_error( $post_data ) )
                 return $post_data;
+        $post_data = _wp_get_allowed_postdata( $post_data );
 
         $post_author = get_current_user_id();

branches/4.0/src/wp-admin/post.php

@@ -228 +228 @@
         // Update the thumbnail filename
         $newmeta = wp_get_attachment_metadata( $post_id, true );
-        $newmeta['thumb'] = $_POST['thumb'];
+        $newmeta['thumb'] = wp_basename( $_POST['thumb'] );
 
         wp_update_attachment_metadata( $post_id, $newmeta );