Changeset 49387

Timestamp:

10/29/2020 06:05:21 PM (5 years ago)

Author:

desrosj

Message:

Meta: Sanitize meta key before checking protection status.

Props zieladam, peterwilsoncc, xknown, whyisjake.
Merges [49377,49381] to trunk.

Location:

trunk

Files:

• . (modified) (1 prop)
• src/wp-includes/meta.php (modified) (1 diff)
• tests/phpunit/tests/meta/isProtectedMeta.php (copied) (copied from branches/5.5/tests/phpunit/tests/meta/isProtectedMeta.php)

trunk/src/wp-includes/meta.php

@@ -1160 +1160 @@
  */
 function is_protected_meta( $meta_key, $meta_type = '' ) {
-    $protected = ( '_' === $meta_key[0] );
+    $sanitized_key = preg_replace( "/[^\x20-\x7E\p{L}]/", '', $meta_key );
+    $protected     = strlen( $sanitized_key ) > 0 && ( '_' === $sanitized_key[0] );
 
     /**