Changeset 44295 for trunk/src/wp-admin/includes/post.php

Timestamp:

12/18/2018 09:31:14 PM (6 years ago)

Author:

desrosj

Message:

Editor: Remove unwanted fields before saving posts.

The meta_input, file, and guid fields are not intended to be updated through user input.

Merges [44047] to trunk.

Location:

trunk

Files:

• . (modified) (1 prop)
• src/wp-admin/includes/post.php (modified) (11 diffs)

trunk/src/wp-admin/includes/post.php

@@ -197 +197 @@
 
 /**
+ * Returns only allowed post data fields
+ *
+ * @since 4.9.9
+ *
+ * @param array $post_data Array of post data. Defaults to the contents of $_POST.
+ * @return object|bool WP_Error on failure, true on success.
+ */
+function _wp_get_allowed_postdata( $post_data = null ) {
+    if ( empty( $post_data ) ) {
+        $post_data = $_POST;
+    }
+
+    // Pass through errors
+    if ( is_wp_error( $post_data ) ) {
+        return $post_data;
+    }
+
+    return array_diff_key( $post_data, array_flip( array( 'meta_input', 'file', 'guid' ) ) );
+}
+
+/**
  * Update an existing post with values provided in $_POST.
  *
@@ -274 +295 @@
         wp_die( $post_data->get_error_message() );
     }
+    $translated = _wp_get_allowed_postdata( $post_data );
 
     // Post Formats
@@ -363 +385 @@
 
         /** This filter is documented in wp-admin/includes/media.php */
-        $post_data = apply_filters( 'attachment_fields_to_save', $post_data, $attachment_data );
+        $translated = apply_filters( 'attachment_fields_to_save', $translated, $attachment_data );
     }
 
@@ -372 +394 @@
 
             if ( $tax_object && isset( $tax_object->meta_box_sanitize_cb ) ) {
-                $post_data['tax_input'][ $taxonomy ] = call_user_func_array( $tax_object->meta_box_sanitize_cb, array( $taxonomy, $terms ) );
+                $translated['tax_input'][ $taxonomy ] = call_user_func_array( $tax_object->meta_box_sanitize_cb, array( $taxonomy, $terms ) );
             }
         }
@@ -381 +403 @@
     update_post_meta( $post_ID, '_edit_last', get_current_user_id() );
 
-    $success = wp_update_post( $post_data );
+    $success = wp_update_post( $translated );
     // If the save failed, see if we can sanity check the main fields and try again
     if ( ! $success && is_callable( array( $wpdb, 'strip_invalid_text_for_column' ) ) ) {
@@ -387 +409 @@
 
         foreach ( $fields as $field ) {
-            if ( isset( $post_data[ $field ] ) ) {
-                $post_data[ $field ] = $wpdb->strip_invalid_text_for_column( $wpdb->posts, $field, $post_data[ $field ] );
-            }
-        }
-
-        wp_update_post( $post_data );
+            if ( isset( $translated[ $field ] ) ) {
+                $translated[ $field ] = $wpdb->strip_invalid_text_for_column( $wpdb->posts, $field, $translated[ $field ] );
+            }
+        }
+
+        wp_update_post( $translated );
     }
 
@@ -570 +592 @@
         }
 
+        $post_data['post_ID']        = $post_ID;
         $post_data['post_type']      = $post->post_type;
         $post_data['post_mime_type'] = $post->post_mime_type;
-        $post_data['guid']           = $post->guid;
 
         foreach ( array( 'comment_status', 'ping_status', 'post_author' ) as $field ) {
@@ -579 +601 @@
             }
         }
-
-        $post_data['ID']      = $post_ID;
-        $post_data['post_ID'] = $post_ID;
 
         $post_data = _wp_translate_postdata( true, $post_data );
@@ -588 +607 @@
             continue;
         }
-
-        if ( isset( $post_data['post_format'] ) ) {
-            set_post_format( $post_ID, $post_data['post_format'] );
+        $post_data = _wp_get_allowed_postdata( $post_data );
+
+        if ( isset( $shared_post_data['post_format'] ) ) {
+            set_post_format( $post_ID, $shared_post_data['post_format'] );
             unset( $post_data['tax_input']['post_format'] );
         }
@@ -807 +827 @@
         return $translated;
     }
+    $translated = _wp_get_allowed_postdata( $translated );
 
     // Create the post.
-    $post_ID = wp_insert_post( $_POST );
+    $post_ID = wp_insert_post( $translated );
     if ( is_wp_error( $post_ID ) ) {
         return $post_ID;
@@ -1769 +1790 @@
         return $post_data;
     }
+    $post_data = _wp_get_allowed_postdata( $post_data );
 
     $post_author = get_current_user_id();