Opened 17 years ago
Closed 17 years ago
#11778 closed defect (bug) (fixed)
ms-edit.php updates options without the slightest sanitization or unslashing
| Reported by: | Denis-de-Bernardy | Owned by: | |
|---|---|---|---|
| Priority: | normal | Milestone: | 3.0 |
| Component: | Multisite | Version: | 3.0 |
| Severity: | major | Keywords: | |
| Cc: | Focuses: |
Description
we're at least missing a call to strip_slashes_deep() over in:
foreach ( (array) $_POST['option'] as $key => $val ) {
if( $key === 0 )
continue; // Avoids "0 is a protected WP option and may not be modified" error when edit blog options
if( $c == $count ) {
update_option( $key, $val );
} else {
update_option( $key, $val, false ); // no need to refresh blog details yet
}
$c++;
}
Note:
See TracTickets
for help on using tickets.
![(please configure the [header_logo] section in trac.ini)](/chrome/site/your_project_logo.png)
(In [13115]) strip slashes, block arrays in ms-edit.php, fixes #11778