Changeset 47633 for trunk/src/wp-includes/post.php

Timestamp:

04/29/2020 03:12:50 PM (4 years ago)

Author:

whyisjake

Message:

Customize: Add additional filters to Customizer to prevent JSON corruption.

This solution extends the wp_insert_post_data filter to pass in addition to the slashed/sanitized/processed data, and the slashed/sanitized/unprocessed data, to also pass the initial slashed/unsanitized/unprocessed data which was passed into wp_insert_post(). This then allows plugins to have complete control over how sanitization is performed based on the post type.

Props westonruter, peterwilsoncc, sstoqnov, whyisjake, xknown.

File:

• trunk/src/wp-includes/post.php (modified) (3 diffs)

trunk/src/wp-includes/post.php

@@ -3595 +3595 @@
     global $wpdb;
 
+    // Capture original pre-sanitized array for passing into filters.
+    $unsanitized_postarr = $postarr;
+
     $user_id = get_current_user_id();
 
@@ -3919 +3922 @@
          *
          * @since 3.9.0
+         * @since 5.4.1 `$unsanitized_postarr` argument added.
          *
-         * @param array $data    An array of sanitized attachment post data.
-         * @param array $postarr An array of unsanitized attachment post data.
+         * @param array $data                An array of slashed, sanitized, and processed attachment post data.
+         * @param array $postarr             An array of slashed and sanitized attachment post data, but not processed.
+         * @param array $unsanitized_postarr An array of slashed yet *unsanitized* and unprocessed attachment post data
+         *                                   as originally passed to wp_insert_post().
          */
-        $data = apply_filters( 'wp_insert_attachment_data', $data, $postarr );
+        $data = apply_filters( 'wp_insert_attachment_data', $data, $postarr, $unsanitized_postarr );
     } else {
         /**
@@ -3929 +3935 @@
          *
          * @since 2.7.0
+         * @since 5.4.1 `$unsanitized_postarr` argument added.
          *
-         * @param array $data    An array of slashed post data.
-         * @param array $postarr An array of sanitized, but otherwise unmodified post data.
+         * @param array $data                An array of slashed, sanitized, and processed post data.
+         * @param array $postarr             An array of sanitized (and slashed) but otherwise unmodified post data.
+         * @param array $unsanitized_postarr An array of slashed yet *unsanitized* and unprocessed post data as
+         *                                   originally passed to wp_insert_post().
          */
-        $data = apply_filters( 'wp_insert_post_data', $data, $postarr );
+        $data = apply_filters( 'wp_insert_post_data', $data, $postarr, $unsanitized_postarr );
     }
     $data  = wp_unslash( $data );