Changeset 58069

Timestamp:

05/01/2024 05:59:05 PM (5 months ago)

Author:

swissspidy

Message:

General: Remove any usage of wp_reset_vars().

The way wp_reset_vars() sets global variables based on $_POST and $_GET values makes code hard to understand and maintain. It also makes it easy to forget to sanitize input.

This change removes the few places where wp_reset_vars() is used in the admin to explicitly use $_REQUEST and sanitize any input.

Props swissspidy, audrasjb, davideferre, killua99, weijland, voldemortensen.
Fixes #38073.

Location:

trunk/src/wp-admin

Files:

• admin-post.php (modified) (1 diff)
• comment.php (modified) (1 diff)
• customize.php (modified) (1 diff)
• edit-tag-form.php (modified) (1 diff)
• includes/class-wp-links-list-table.php (modified) (1 diff)
• includes/class-wp-ms-themes-list-table.php (modified) (1 diff)
• includes/class-wp-plugin-install-list-table.php (modified) (1 diff)
• includes/class-wp-plugins-list-table.php (modified) (1 diff)
• includes/class-wp-theme-install-list-table.php (modified) (1 diff)
• includes/misc.php (modified) (1 diff)
• link-add.php (modified) (1 diff)
• link.php (modified) (1 diff)
• media.php (modified) (1 diff)
• options-head.php (modified) (1 diff)
• options.php (modified) (1 diff)
• post.php (modified) (1 diff)
• revision.php (modified) (1 diff)
• site-health.php (modified) (1 diff)
• theme-editor.php (modified) (1 diff)
• theme-install.php (modified) (1 diff)
• themes.php (modified) (1 diff)
• user-edit.php (modified) (1 diff)

trunk/src/wp-admin/admin-post.php

@@ -30 +30 @@
 do_action( 'admin_init' );
 
-$action = ! empty( $_REQUEST['action'] ) ? $_REQUEST['action'] : '';
+$action = ! empty( $_REQUEST['action'] ) ? sanitize_text_field( $_REQUEST['action'] ) : '';
 
 // Reject invalid parameters.

trunk/src/wp-admin/comment.php

@@ -17 +17 @@
  */
 global $action;
-wp_reset_vars( array( 'action' ) );
+
+$action = ! empty( $_REQUEST['action'] ) ? sanitize_text_field( $_REQUEST['action'] ) : '';
 
 if ( isset( $_POST['deletecomment'] ) ) {

trunk/src/wp-admin/customize.php

@@ -85 +85 @@
 }
 
-
-wp_reset_vars( array( 'url', 'return', 'autofocus' ) );
+$url       = ! empty( $_REQUEST['url'] ) ? sanitize_text_field( $_REQUEST['url'] ) : '';
+$return    = ! empty( $_REQUEST['return'] ) ? sanitize_text_field( $_REQUEST['return'] ) : '';
+$autofocus = ! empty( $_REQUEST['autofocus'] ) ? sanitize_text_field( $_REQUEST['autofocus'] ) : '';
+
 if ( ! empty( $url ) ) {
     $wp_customize->set_preview_url( wp_unslash( $url ) );

trunk/src/wp-admin/edit-tag-form.php

@@ -45 +45 @@
 }
 
-/**
- * Use with caution, see https://developer.wordpress.org/reference/functions/wp_reset_vars/
- */
-wp_reset_vars( array( 'wp_http_referer' ) );
-
+$wp_http_referer = ! empty( $_REQUEST['wp_http_referer'] ) ? sanitize_text_field( $_REQUEST['wp_http_referer'] ) : '';
 $wp_http_referer = remove_query_arg( array( 'action', 'message', 'tag_ID' ), $wp_http_referer );
 

trunk/src/wp-admin/includes/class-wp-links-list-table.php

@@ -51 +51 @@
         global $cat_id, $s, $orderby, $order;
 
-        wp_reset_vars( array( 'action', 'cat_id', 'link_id', 'orderby', 'order', 's' ) );
+        $cat_id  = ! empty( $_REQUEST['cat_id'] ) ? absint( $_REQUEST['cat_id'] ) : 0;
+        $orderby = ! empty( $_REQUEST['orderby'] ) ? sanitize_text_field( $_REQUEST['orderby'] ) : '';
+        $order   = ! empty( $_REQUEST['order'] ) ? sanitize_text_field( $_REQUEST['order'] ) : '';
+        $s       = ! empty( $_REQUEST['s'] ) ? sanitize_text_field( $_REQUEST['s'] ) : '';
 
         $args = array(

trunk/src/wp-admin/includes/class-wp-ms-themes-list-table.php

@@ -100 +100 @@
         global $status, $totals, $page, $orderby, $order, $s;
 
-        wp_reset_vars( array( 'orderby', 'order', 's' ) );
+        $orderby = ! empty( $_REQUEST['orderby'] ) ? sanitize_text_field( $_REQUEST['orderby'] ) : '';
+        $order   = ! empty( $_REQUEST['order'] ) ? sanitize_text_field( $_REQUEST['order'] ) : '';
+        $s       = ! empty( $_REQUEST['s'] ) ? sanitize_text_field( $_REQUEST['s'] ) : '';
 
         $themes = array(

trunk/src/wp-admin/includes/class-wp-plugin-install-list-table.php

@@ -93 +93 @@
         global $tabs, $tab, $paged, $type, $term;
 
-        wp_reset_vars( array( 'tab' ) );
+        $tab = ! empty( $_REQUEST['tab'] ) ? sanitize_text_field( $_REQUEST['tab'] ) : '';
 
         $paged = $this->get_pagenum();

trunk/src/wp-admin/includes/class-wp-plugins-list-table.php

@@ -91 +91 @@
         global $status, $plugins, $totals, $page, $orderby, $order, $s;
 
-        wp_reset_vars( array( 'orderby', 'order' ) );
+        $orderby = ! empty( $_REQUEST['orderby'] ) ? sanitize_text_field( $_REQUEST['orderby'] ) : '';
+        $order   = ! empty( $_REQUEST['order'] ) ? sanitize_text_field( $_REQUEST['order'] ) : '';
 
         /**

trunk/src/wp-admin/includes/class-wp-theme-install-list-table.php

@@ -37 +37 @@
 
         global $tabs, $tab, $paged, $type, $theme_field_defaults;
-        wp_reset_vars( array( 'tab' ) );
+
+        $tab = ! empty( $_REQUEST['tab'] ) ? sanitize_text_field( $_REQUEST['tab'] ) : '';
 
         $search_terms  = array();

trunk/src/wp-admin/includes/misc.php

@@ -576 +576 @@
 }
 
-
 /**
  * Resets global variables based on $_GET and $_POST.

trunk/src/wp-admin/link-add.php

@@ -18 +18 @@
 $parent_file = 'link-manager.php';
 
-wp_reset_vars( array( 'action', 'cat_id', 'link_id' ) );
+$action  = ! empty( $_REQUEST['action'] ) ? sanitize_text_field( $_REQUEST['action'] ) : '';
+$cat_id  = ! empty( $_REQUEST['cat_id'] ) ? absint( $_REQUEST['cat_id'] ) : 0;
+$link_id = ! empty( $_REQUEST['link_id'] ) ? absint( $_REQUEST['link_id'] ) : 0;
 
 wp_enqueue_script( 'link' );

trunk/src/wp-admin/link.php

@@ -13 +13 @@
 require_once __DIR__ . '/admin.php';
 
-wp_reset_vars( array( 'action', 'cat_id', 'link_id' ) );
+$action  = ! empty( $_REQUEST['action'] ) ? sanitize_text_field( $_REQUEST['action'] ) : '';
+$cat_id  = ! empty( $_REQUEST['cat_id'] ) ? absint( $_REQUEST['cat_id'] ) : 0;
+$link_id = ! empty( $_REQUEST['link_id'] ) ? absint( $_REQUEST['link_id'] ) : 0;
 
 if ( ! current_user_can( 'manage_links' ) ) {

trunk/src/wp-admin/media.php

@@ -16 +16 @@
 $submenu_file = 'upload.php';
 
-wp_reset_vars( array( 'action' ) );
+$action = ! empty( $_REQUEST['action'] ) ? sanitize_text_field( $_REQUEST['action'] ) : '';
 
 switch ( $action ) {

trunk/src/wp-admin/options-head.php

@@ -9 +9 @@
  */
 
-wp_reset_vars( array( 'action' ) );
+$action = ! empty( $_REQUEST['action'] ) ? sanitize_text_field( $_REQUEST['action'] ) : '';
 
 if ( isset( $_GET['updated'] ) && isset( $_GET['page'] ) ) {

trunk/src/wp-admin/options.php

@@ -24 +24 @@
 $parent_file = 'options-general.php';
 
-wp_reset_vars( array( 'action', 'option_page' ) );
+$action      = ! empty( $_REQUEST['action'] ) ? sanitize_text_field( $_REQUEST['action'] ) : '';
+$option_page = ! empty( $_REQUEST['option_page'] ) ? sanitize_text_field( $_REQUEST['option_page'] ) : '';
 
 $capability = 'manage_options';

trunk/src/wp-admin/post.php

@@ -15 +15 @@
 $submenu_file = 'edit.php';
 
-wp_reset_vars( array( 'action' ) );
+$action = ! empty( $_REQUEST['action'] ) ? sanitize_text_field( $_REQUEST['action'] ) : '';
 
 if ( isset( $_GET['post'] ) && isset( $_POST['post_ID'] ) && (int) $_GET['post'] !== (int) $_POST['post_ID'] ) {

trunk/src/wp-admin/revision.php

@@ -22 +22 @@
  * @global int    $to       Optional, required if revision missing. The revision to compare to.
  */
-wp_reset_vars( array( 'revision', 'action', 'from', 'to' ) );
 
-$revision_id = absint( $revision );
+$revision_id = ! empty( $_REQUEST['revision'] ) ? absint( $_REQUEST['revision'] ) : 0;
+$action      = ! empty( $_REQUEST['action'] ) ? sanitize_text_field( $_REQUEST['action'] ) : '';
+$from        = ! empty( $_REQUEST['from'] ) && is_numeric( $_REQUEST['from'] ) ? absint( $_REQUEST['from'] ) : null;
+$to          = ! empty( $_REQUEST['to'] ) && is_numeric( $_REQUEST['to'] ) ? absint( $_REQUEST['to'] ) : null;
 
-$from = is_numeric( $from ) ? absint( $from ) : null;
 if ( ! $revision_id ) {
-    $revision_id = absint( $to );
+    $revision_id = $to;
 }
+
 $redirect = 'edit.php';
 

trunk/src/wp-admin/site-health.php

@@ -10 +10 @@
 require_once __DIR__ . '/admin.php';
 
-wp_reset_vars( array( 'action' ) );
+$action = ! empty( $_REQUEST['action'] ) ? sanitize_text_field( $_REQUEST['action'] ) : '';
 
 $tabs = array(

trunk/src/wp-admin/theme-editor.php

@@ -57 +57 @@
 );
 
-wp_reset_vars( array( 'action', 'error', 'file', 'theme' ) );
+$action = ! empty( $_REQUEST['action'] ) ? sanitize_text_field( $_REQUEST['action'] ) : '';
+$theme  = ! empty( $_REQUEST['theme'] ) ? sanitize_text_field( $_REQUEST['theme'] ) : '';
+$file   = ! empty( $_REQUEST['file'] ) ? sanitize_text_field( $_REQUEST['file'] ) : '';
+$error  = ! empty( $_REQUEST['error'] );
 
 if ( $theme ) {

trunk/src/wp-admin/theme-install.php

@@ -11 +11 @@
 require ABSPATH . 'wp-admin/includes/theme-install.php';
 
-wp_reset_vars( array( 'tab' ) );
+$tab = ! empty( $_REQUEST['tab'] ) ? sanitize_text_field( $_REQUEST['tab'] ) : '';
 
 if ( ! current_user_can( 'install_themes' ) ) {

trunk/src/wp-admin/themes.php

@@ -216 +216 @@
     $themes = wp_prepare_themes_for_js( array( wp_get_theme() ) );
 }
-wp_reset_vars( array( 'theme', 'search' ) );
+
+$theme  = ! empty( $_REQUEST['theme'] ) ? sanitize_text_field( $_REQUEST['theme'] ) : '';
+$search = ! empty( $_REQUEST['search'] ) ? sanitize_text_field( $_REQUEST['search'] ) : '';
 
 wp_localize_script(

trunk/src/wp-admin/user-edit.php

@@ -13 +13 @@
 require_once ABSPATH . 'wp-admin/includes/translation-install.php';
 
-wp_reset_vars( array( 'action', 'user_id', 'wp_http_referer' ) );
-
-$user_id      = (int) $user_id;
+$action          = ! empty( $_REQUEST['action'] ) ? sanitize_text_field( $_REQUEST['action'] ) : '';
+$user_id         = ! empty( $_REQUEST['user_id'] ) ? absint( $_REQUEST['user_id'] ) : 0;
+$wp_http_referer = ! empty( $_REQUEST['wp_http_referer'] ) ? sanitize_text_field( $_REQUEST['wp_http_referer'] ) : '';
+
 $current_user = wp_get_current_user();