From acb5008e9caac9741a6319d26dee2af5b45b2d63 Mon Sep 17 00:00:00 2001 From: Ryan Boren Date: Thu, 1 Jun 2006 23:38:34 +0000 Subject: [PATCH] Strip extra slashes from _POST when doing nonce AYS. Props MarkJaquith and mdawaffe. fixes #2761 git-svn-id: https://develop.svn.wordpress.org/trunk@3833 602fd350-edb4-49c9-b593-d223f7449a82 --- wp-includes/pluggable-functions.php | 2 ++ 1 file changed, 2 insertions(+) diff --git a/wp-includes/pluggable-functions.php b/wp-includes/pluggable-functions.php index b6dde6c1e7..97d9339a4a 100644 --- a/wp-includes/pluggable-functions.php +++ b/wp-includes/pluggable-functions.php @@ -238,6 +238,8 @@ function check_admin_referer($action = -1) { $adminurl = $referer; $title = __('WordPress Confirmation'); require_once(ABSPATH . '/wp-admin/admin-header.php'); + // Remove extra layer of slashes. + $_POST = stripslashes_deep($_POST ); if ( $_POST ) { $q = http_build_query($_POST); $q = explode( ini_get('arg_separator.output'), $q);