Changeset 44295 for trunk/src/wp-admin/includes/ajax-actions.php

Timestamp:

12/18/2018 09:31:14 PM (6 years ago)

Author:

desrosj

Message:

Editor: Remove unwanted fields before saving posts.

The meta_input, file, and guid fields are not intended to be updated through user input.

Merges [44047] to trunk.

Location:

trunk

Files:

• . (modified) (1 prop)
• src/wp-admin/includes/ajax-actions.php (modified) (1 diff)

trunk/src/wp-admin/includes/ajax-actions.php

@@ -2263 +2263 @@
     }
 
-    $post_data = isset( $_REQUEST['post_data'] ) ? $_REQUEST['post_data'] : array();
+    $post_data = ! empty( $_REQUEST['post_data'] ) ? _wp_get_allowed_postdata( _wp_translate_postdata( false, (array) $_REQUEST['post_data'] ) ) : array();
+
+    if ( is_wp_error( $post_data ) ) {
+        wp_die( $post_data->get_error_message() );
+    }
 
     // If the context is custom header or background, make sure the uploaded file is an image.