Changeset 6184

Timestamp:

10/03/2007 04:26:16 PM (17 years ago)

Author:

ryan

Message:

Add page sanitization. Props xknown. fixes #5135 for 2.3

Location:

branches/2.3

Files:

• wp-admin/includes/template.php (modified) (1 diff)
• wp-includes/post.php (modified) (6 diffs)

branches/2.3/wp-admin/includes/template.php

@@ -494 +494 @@
                 $current = '';
 
-            echo "\n\t<option value='$item->ID'$current>$pad $item->post_title</option>";
+            echo "\n\t<option value='$item->ID'$current>$pad " . wp_specialchars($item->post_title) . "</option>";
             parent_dropdown( $default, $item->ID, $level +1 );
         }

branches/2.3/wp-includes/post.php

@@ -103 +103 @@
     } elseif ( is_object($post) ) {
         if ( 'page' == $post->post_type )
-            return get_page($post, $output);
+            return get_page($post, $output, $filter);
         if ( !isset($post_cache[$blog_id][$post->ID]) )
             $post_cache[$blog_id][$post->ID] = &$post;
@@ -112 +112 @@
             $_post = & $post_cache[$blog_id][$post];
         elseif ( $_post = wp_cache_get($post, 'pages') )
-            return get_page($_post, $output);
+            return get_page($_post, $output, $filter);
         else {
             $query = "SELECT * FROM $wpdb->posts WHERE ID = '$post' LIMIT 1";
             $_post = & $wpdb->get_row($query);
             if ( 'page' == $_post->post_type )
-                return get_page($_post, $output);
+                return get_page($_post, $output, $filter);
             $post_cache[$blog_id][$post] = & $_post;
         }
@@ -973 +973 @@
 // Retrieves page data given a page ID or page object.
 // Handles page caching.
-function &get_page(&$page, $output = OBJECT) {
+function &get_page(&$page, $output = OBJECT, $filter = 'raw') {
     global $wpdb, $blog_id;
 
@@ -986 +986 @@
     } elseif ( is_object($page) ) {
         if ( 'post' == $page->post_type )
-            return get_post($page, $output);
+            return get_post($page, $output, $filter);
         wp_cache_add($page->ID, $page, 'pages');
         $_page = $page;
@@ -999 +999 @@
                 wp_cache_add($_page->ID, $_page, 'pages');
             } elseif ( isset($GLOBALS['post_cache'][$blog_id][$page]) ) { // it's actually a page, and is cached
-                return get_post($page, $output);
+                return get_post($page, $output, $filter);
             } else { // it's not in any caches, so off to the DB we go
                 // Why are we using assignment for this query?
                 $_page = & $wpdb->get_row("SELECT * FROM $wpdb->posts WHERE ID= '$page' LIMIT 1");
                 if ( 'post' == $_page->post_type )
-                    return get_post($_page, $output);
+                    return get_post($_page, $output, $filter);
                 // Potential issue: we're not checking to see if the post_type = 'page'
                 // So all non-'post' posts will get cached as pages.
@@ -1011 +1011 @@
         }
     }
+
+    $_page = sanitize_post($_page, $filter);
 
     // at this point, one way or another, $_post contains the page object