Changeset 49378

Timestamp:

10/29/2020 05:31:40 PM (4 years ago)

Author:

whyisjake

Message:

Meta: Sanitize meta key before checking protection status.

Props zieladam, peterwilsoncc, xknown, whyisjake.

Location:

branches/5.5

Files:

• src/wp-includes/meta.php (modified) (1 diff)
• tests/phpunit/tests/meta/isProtectedMeta.php (added)

branches/5.5/src/wp-includes/meta.php

@@ -1160 +1160 @@
  */
 function is_protected_meta( $meta_key, $meta_type = '' ) {
-    $protected = ( '_' === $meta_key[0] );
+    $sanitized_key = preg_replace( "/[^\x20-\x7E\p{L}]/", '', $meta_key );
+    $protected     = strlen( $sanitized_key ) > 0 && ( '_' == $sanitized_key[0] );
 
     /**