Changeset 4874

Timestamp:

02/12/2007 07:20:31 PM (19 years ago)

Author:

ryan

Message:

editPage and newPage escaping fixes from Joseph.

File:

• trunk/xmlrpc.php (modified) (3 diffs)

trunk/xmlrpc.php

@@ -149 +149 @@
                 global $wpdb;
 
-                foreach ( (array) $array as $k => $v ) {
-                        if (is_array($v)) {
-                                $this->escape($array[$k]);
-                        } else if (is_object($v)) {
-                                //skip
-                        } else {
-                                $array[$k] = $wpdb->escape($v);
+                if(is_string($array)) {
+                        return($wpdb->escape($array));
+                }
+                else {
+                        foreach ( (array) $array as $k => $v ) {
+                                if (is_array($v)) {
+                                        $this->escape($array[$k]);
+                                } else if (is_object($v)) {
+                                        //skip
+                                } else {
+                                        $array[$k] = $wpdb->escape($v);
+                                }
                         }
                 }
@@ -284 +289 @@
          */
         function wp_newPage($args) {
-                $this->escape($args);
-
-                $blog_id        = $args[0];
-                $username       = $args[1];
-                $password       = $args[2];
+                // Items not escaped here will be escaped in newPost.
+                $username       = $this->escape($args[1]);
+                $password       = $this->escape($args[2]);
                 $page           = $args[3];
                 $publish        = $args[4];
@@ -356 +359 @@
          */
         function wp_editPage($args) {
-                $this->escape($args);
-
+                // Items not escaped here will be escaped in editPost.
                 $blog_id        = $args[0];
-                $page_id        = $args[1];
-                $username       = $args[2];
-                $password       = $args[3];
+                $page_id        = $this->escape($args[1]);
+                $username       = $this->escape($args[2]);
+                $password       = $this->escape($args[3]);
                 $content        = $args[4];
                 $publish        = $args[5];