ms-edit.php creates garbage data for anything that is potentially affected by addslashes() and is on the whole completely unsanitized

[Denis-de-Bernardy]

in addition to not getting the handy strip_slashes_deep(), we have a completely unsanitized query:

		// update blogs table
		$result = $wpdb->query( "UPDATE {$wpdb->blogs} SET
				domain       = '".$_POST[ 'blog' ][ 'domain' ]."',
				path         = '".$_POST[ 'blog' ][ 'path' ]."',
				registered   = '".$_POST[ 'blog' ][ 'registered' ]."',
				public       = '".$_POST[ 'blog' ][ 'public' ]."',
				archived     = '".$_POST[ 'blog' ][ 'archived' ]."',
				mature       = '".$_POST[ 'blog' ][ 'mature' ]."',
				deleted      = '".$_POST[ 'blog' ][ 'deleted' ]."',
				spam         = '".$_POST[ 'blog' ][ 'spam' ]."'
			WHERE  blog_id = '$id'" );

[nacin]

Denis:
Ryan has blessed a new keyword 'multisite' for when we opt for a component other than Multisite on a ticket. I'm going to start adding it, can you possibly create a report that highlights all Multisite keyword/component tickets?

[Denis-de-Bernardy]

See also #11774, #11775, #11776, #11777, #11778...

Basically, in this file, anything that can potentially be changed by addslashes/stripslashes can lead to bugs and problems. The function that is noted in #11771 is a completely incorrect means to fix this.

Re report: will do.

[dd32]

Looks like this was removed along the way as expected with the cleanup? Denis, can you confirm?

[nacin]

[12774]