Use wp_unslash() for $_REQUEST Parameter in wp-admin/admin-post.php file

[yagniksangani]

Need to use the wp_unslash() for $_REQUEST['action'], you can see screenshot.

[yagniksangani]

Git Diff File

[SergeyBiryukov]

Hi there, welcome back to WordPress Trac! Thanks for the report.

Could you provide some more details about why wp_unslash() is needed here? What would be the steps to reproduce the issue on a clean install?

[yagniksangani]

Here wp_unslash() needed to remove slashes, we are using $_REQUEST to get parameters, so we need to remove slashes from parameters as per coding standards. And it will also help as per security point of view. Hope now it will be more clear to you.

Hi there, welcome back to WordPress Trac! Thanks for the report.

Could you provide some more details about why wp_unslash() is needed here? What would be the steps to reproduce the issue on a clean install?

[yagniksangani]

Diff file

[sabernhardt]

14 other files in the wp-admin directory also use $_REQUEST['action'] without wp_unslash. If the change is necessary in admin-post.php, those may need the same.

Since changeset:41205, the two files with $_REQUEST['action'] in wp-includes both use the function (class-wp-customize-manager.php and theme.php).

[yagniksangani]

New Diff File : Added wp_unslash() function for $_REQUESTaction? where needed in files