Changeset 60646

Timestamp:

08/19/2025 12:28:20 PM (6 weeks ago)

Author:

SergeyBiryukov

Message:

Coding Standards: Sanitize input values in wp-trackback.php.

Follow-up to [4676], [12284], [23594], [53719].

Props utsav72640, mukesh27, ankitmaru, dhruvang21, SergeyBiryukov.
Fixes #58511.

File:

• trunk/src/wp-trackback.php (modified) (1 diff)

trunk/src/wp-trackback.php

@@ -51 +51 @@
 }
 
-$trackback_url = isset( $_POST['url'] ) ? $_POST['url'] : '';
-$charset       = isset( $_POST['charset'] ) ? $_POST['charset'] : '';
+$trackback_url = isset( $_POST['url'] ) ? sanitize_url( $_POST['url'] ) : '';
+$charset       = isset( $_POST['charset'] ) ? sanitize_text_field( $_POST['charset'] ) : '';
 
 // These three are stripslashed here so they can be properly escaped after mb_convert_encoding().
-$title     = isset( $_POST['title'] ) ? wp_unslash( $_POST['title'] ) : '';
-$excerpt   = isset( $_POST['excerpt'] ) ? wp_unslash( $_POST['excerpt'] ) : '';
-$blog_name = isset( $_POST['blog_name'] ) ? wp_unslash( $_POST['blog_name'] ) : '';
+$title     = isset( $_POST['title'] ) ? sanitize_text_field( wp_unslash( $_POST['title'] ) ) : '';
+$excerpt   = isset( $_POST['excerpt'] ) ? sanitize_textarea_field( wp_unslash( $_POST['excerpt'] ) ) : '';
+$blog_name = isset( $_POST['blog_name'] ) ? sanitize_text_field( wp_unslash( $_POST['blog_name'] ) ) : '';
 
 if ( $charset ) {