WordPress.org
Get WordPress

Make WordPress Core

Opened 16 years ago

Closed 15 years ago

#10656 closed defect (bug) (fixed)

Creating or updating serialized custom field values via XML-RPC serializes them again

Reported by: jonathanrogers's profile JonathanRogers Owned by: josephscott's profile josephscott
Milestone: 2.9 Priority: high
Severity: normal Version: 2.9
Component: XML-RPC Keywords: has-patch tested
Focuses: Cc:

Description

If one creates or updates a page via XML-RPC and the page has custom fields with values that are PHP serialized strings, they will be silently corrupted by serializing them again. Other strings are unmodified.

Attachments (3)

wordpress_xmlrpc_custom_serialized.patch​ (2.4 KB) - added by JonathanRogers 16 years ago.
Prevents XML-RPC server from re-serializing custom field values that are already serialized.
wp-test.py​ (824 bytes) - added by Sewar 15 years ago.
This script could be used to test XML-RPC functions of Wordpress, including post meta.
10656.patch​ (1.5 KB) - added by Sewar 15 years ago.
Fixes the bug

Download all attachments as: .zip

Change History (8)

@JonathanRogers
16 years ago

Prevents XML-RPC server from re-serializing custom field values that are already serialized.

#1 @Sewar
15 years ago

  • Cc xsewarx@… added
  • Keywords has-patch tested added
  • Priority changed from normal to high

I have faced the same problem, applied this patch and it worked very well. I will attach a python script that can be used to test this.

@Sewar
15 years ago

This script could be used to test XML-RPC functions of Wordpress, including post meta.

#2 @Sewar
15 years ago

  • Keywords tested removed

Actually the patch seems not working very well, will do more tests and update later.

@Sewar
15 years ago

Fixes the bug

#3 @Sewar
15 years ago

  • Keywords tested added
  • Milestone changed from Unassigned to 2.9
  • Version changed from 2.8.4 to 2.9

The bug is in using stripslashes and trim functions which returns strings, so they will convert any value to string (like arrays to "Array"). I have tested it with XML-RPC "metaWeblog.newPost" and worked very well.

#4 @ryan
15 years ago

I think stripslashes_deep() would be appropriate here.

#5 @automattor
15 years ago

  • Resolution set to fixed
  • Status changed from new to closed

(In [12336]) Use stripslashes_deep to strip meta values. Props JonathanRogers, Sewar. fixes #10656

Note: See TracTickets for help on using tickets.