Use wp_parse_id_list() in gallery_shortcode()

[SergeyBiryukov]

In gallery_shortcode(), a regex is used to sanitize a list of IDs in 'include' and 'exclude' parameters.

We have a special function for that:
​http://core.trac.wordpress.org/browser/tags/3.4.2/wp-includes/functions.php#L2345

[TobiasBg]

wp_parse_id_list() is already applied to the 'include' parameter in get_posts(), after the patch it would be done twice...

Never mind, it's only done to be able to count the number of posts. It's not actually changing the 'include' parameter.

Wrong again... The 'include' parameter is being mapped to 'post__in', with wp_parse_id_list() applied, and then not used again. Thus, with the patch from above, wp_parse_id_list() would be applied twice here.

[SergeyBiryukov]

Indeed: ​http://core.trac.wordpress.org/browser/tags/3.4.2/wp-includes/post.php#L1450

Thanks! So the sanitization in gallery_shortcode() is not necessary at all.

[nacin]

In [21833]:

Don't sanitize include and exclude in gallery_shortcode(), as this is handled further down the stack, and better. props SergeyBiryukov, TobiasBg. fixes #21827.