| - | + |
|---|
| caps as $cap => $value) { - if(!$wp_roles->is_role($cap)) { - if($output != '') $output .= ', '; + foreach ( $profileuser->caps as $cap => $value ) { + if ( !$wp_roles->is_role($cap) ) { + if ( $output != '' ) + $output .= ', '; $output .= $value ? $cap : "Denied: {$cap}"; } } @@ -328,7 +329,7 @@ ?> |
Index: wp-admin/users.php
===================================================================
--- wp-admin/users.php (revision 11906)
+++ wp-admin/users.php (working copy)
@@ -385,14 +385,6 @@
- 'user_login', 'first_name' => 'user_firstname', 'last_name' => 'user_lastname', 'email' => 'user_email', 'url' => 'user_uri', 'role' => 'user_role') as $formpost => $var ) {
- $var = 'new_' . $var;
- $$var = isset($_REQUEST[$formpost]) ? esc_attr(stripslashes($_REQUEST[$formpost])) : '';
- }
- unset($name);
-?>
-
]*?>.*?@si', '', $string );
+ $string = strip_tags($string);
+
+ if ( $remove_breaks )
+ $string = preg_replace('/\s+/', ' ', $string);
+
+ return trim($string);
+}
+
+/**
+ * Sanitize a string from user input or from the db
+ *
+ * check for invalid UTF-8,
+ * Convert single < characters to entity,
+ * strip all tags,
+ * remove line breaks, tabs and extra whitre space,
+ * strip octets.
+ *
+ * @since 2.9
+ *
+ * @param string $str
+ * @return string
+ */
+function sanitize_text_field($str) {
+ $filtered = wp_check_invalid_utf8( $str );
+
+ if ( strpos($filtered, '<') !== false ) {
+ $filtered = wp_pre_kses_less_than( $filtered );
+ $filtered = wp_strip_all_tags( $filtered, true );
+ } else {
+ $filtered = trim( preg_replace('/\s+/', ' ', $filtered) );
+ }
+
+ $match = array();
+ while ( preg_match('/%[a-f0-9]{2}/i', $filtered, $match) )
+ $filtered = str_replace($match[0], '', $filtered);
+
+ return apply_filters('sanitize_text_field', $filtered, $str);
+}
+
?>
Index: wp-includes/registration.php
===================================================================
--- wp-includes/registration.php (revision 11906)
+++ wp-includes/registration.php (working copy)
@@ -169,7 +169,7 @@
$user_nicename_check = $wpdb->get_var( $wpdb->prepare("SELECT ID FROM $wpdb->users WHERE user_nicename = %s AND user_login != %s LIMIT 1" , $user_nicename, $user_login));
- if ($user_nicename_check) {
+ if ( $user_nicename_check ) {
$suffix = 2;
while ($user_nicename_check) {
$alt_user_nicename = $user_nicename . "-$suffix";
@@ -198,10 +198,11 @@
update_usermeta( $user_id, 'comment_shortcuts', $comment_shortcuts);
update_usermeta( $user_id, 'admin_color', $admin_color);
update_usermeta( $user_id, 'use_ssl', $use_ssl);
- foreach (_wp_get_user_contactmethods() as $method => $name) {
+
+ foreach ( _wp_get_user_contactmethods() as $method => $name ) {
if ( empty($$method) )
$$method = '';
-
+
update_usermeta( $user_id, $method, $$method );
}
Index: wp-includes/user.php
===================================================================
--- wp-includes/user.php (revision 11906)
+++ wp-includes/user.php (working copy)
@@ -600,4 +600,121 @@
wp_cache_add($user->user_nicename, $user->ID, 'userslugs');
}
+/**
+ * Sanitize every user field.
+ *
+ * If the context is 'raw', then the user object or array will get minimal santization of the int fields.
+ *
+ * @since 2.3.0
+ * @uses sanitize_user_field() Used to sanitize the fields.
+ *
+ * @param object|array $user The User Object or Array
+ * @param string $context Optional, default is 'display'. How to sanitize user fields.
+ * @return object|array The now sanitized User Object or Array (will be the same type as $user)
+ */
+function sanitize_user_object($user, $context = 'display') {
+ if ( is_object($user) ) {
+ if ( !isset($user->ID) )
+ $user->ID = 0;
+ if ( isset($user->data) )
+ $vars = get_object_vars( $user->data );
+ else
+ $vars = get_object_vars($user);
+ foreach ( array_keys($vars) as $field ) {
+ if ( is_array($user->$field) )
+ continue;
+ $user->$field = sanitize_user_field($field, $user->$field, $user->ID, $context);
+ }
+ $user->filter = $context;
+ } else {
+ if ( !isset($user['ID']) )
+ $user['ID'] = 0;
+ foreach ( array_keys($user) as $field )
+ $user[$field] = sanitize_user_field($field, $user[$field], $user['ID'], $context);
+ $user['filter'] = $context;
+ }
+
+ return $user;
+}
+
+/**
+ * Sanitize user field based on context.
+ *
+ * Possible context values are: 'raw', 'edit', 'db', 'display', 'attribute' and 'js'. The
+ * 'display' context is used by default. 'attribute' and 'js' contexts are treated like 'display'
+ * when calling filters.
+ *
+ * @since 2.3.0
+ * @uses apply_filters() Calls 'edit_$field' and '${field_no_prefix}_edit_pre' passing $value and
+ * $user_id if $context == 'edit' and field name prefix == 'user_'.
+ *
+ * @uses apply_filters() Calls 'edit_user_$field' passing $value and $user_id if $context == 'db'.
+ * @uses apply_filters() Calls 'pre_$field' passing $value if $context == 'db' and field name prefix == 'user_'.
+ * @uses apply_filters() Calls '${field}_pre' passing $value if $context == 'db' and field name prefix != 'user_'.
+ *
+ * @uses apply_filters() Calls '$field' passing $value, $user_id and $context if $context == anything
+ * other than 'raw', 'edit' and 'db' and field name prefix == 'user_'.
+ * @uses apply_filters() Calls 'user_$field' passing $value if $context == anything other than 'raw',
+ * 'edit' and 'db' and field name prefix != 'user_'.
+ *
+ * @param string $field The user Object field name.
+ * @param mixed $value The user Object value.
+ * @param int $user_id user ID.
+ * @param string $context How to sanitize user fields. Looks for 'raw', 'edit', 'db', 'display',
+ * 'attribute' and 'js'.
+ * @return mixed Sanitized value.
+ */
+function sanitize_user_field($field, $value, $user_id, $context) {
+ $int_fields = array('ID');
+ if ( in_array($field, $int_fields) )
+ $value = (int) $value;
+
+ if ( 'raw' == $context )
+ return $value;
+
+ if ( is_array($value) )
+ return $value;
+
+ $prefixed = false;
+ if ( false !== strpos($field, 'user_') ) {
+ $prefixed = true;
+ $field_no_prefix = str_replace('user_', '', $field);
+ }
+
+ if ( 'edit' == $context ) {
+ if ( $prefixed ) {
+ $value = apply_filters("edit_$field", $value, $user_id);
+ } else {
+ $value = apply_filters("edit_user_$field", $value, $user_id);
+ }
+
+ if ( 'description' == $field )
+ $value = esc_html($value);
+ else
+ $value = esc_attr($value);
+ } else if ( 'db' == $context ) {
+ if ( $prefixed ) {
+ $value = apply_filters("pre_$field", $value);
+ } else {
+ $value = apply_filters("pre_user_$field", $value);
+ }
+ } else {
+ // Use display filters by default.
+ if ( $prefixed )
+ $value = apply_filters($field, $value, $user_id, $context);
+ else
+ $value = apply_filters("user_$field", $value, $user_id, $context);
+ }
+
+ if ( 'user_url' == $field )
+ $value = esc_url($value);
+
+ if ( 'attribute' == $context )
+ $value = esc_attr($value);
+ else if ( 'js' == $context )
+ $value = esc_js($value);
+
+ return $value;
+}
+
?>