vhad/wordpress-develop
1
0
Fork 0
mirror of https://github.com/gosticks/wordpress-develop.git synced 2026-08-11 12:20:22 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Revert 23416, 23419, 23445 except for wp_reset_vars() changes. We are going a different direction with the slashing cleanup, so resetting to a clean slate. see #21767

Browse Source 
git-svn-id: https://develop.svn.wordpress.org/trunk@23554 602fd350-edb4-49c9-b593-d223f7449a82
This commit is contained in:
Ryan Boren
2013-03-01 16:28:40 +00:00
parent 158a124d0b
commit c363aea627
89 changed files with 657 additions and 533 deletions
Download Patch File Download Diff File Expand all files Collapse all files
wp-admin/includes/post.php
+31 -23
View File
@@ -149,8 +149,8 @@ function _wp_translate_postdata( $update = false, $post_data = null ) {
*/
function edit_post( $post_data = null ) {
if ( empty( $post_data ) )
$post_data = wp_unslash( $_POST );
if ( empty($post_data) )
$post_data = &$_POST;
// Clear out any data in internal vars.
unset( $post_data['filter'] );
@@ -236,9 +236,10 @@ function edit_post( $post_data = null ) {
if ( 'attachment' == $post_data['post_type'] ) {
if ( isset( $post_data[ '_wp_attachment_image_alt' ] ) ) {
$image_alt = get_post_meta( $post_ID, '_wp_attachment_image_alt', true );
if ( $image_alt != $post_data['_wp_attachment_image_alt'] ) {
$image_alt = wp_strip_all_tags( $post_data['_wp_attachment_image_alt'], true );
wp_update_post_meta( $post_ID, '_wp_attachment_image_alt', $image_alt );
if ( $image_alt != stripslashes( $post_data['_wp_attachment_image_alt'] ) ) {
$image_alt = wp_strip_all_tags( stripslashes( $post_data['_wp_attachment_image_alt'] ), true );
// update_meta expects slashed
update_post_meta( $post_ID, '_wp_attachment_image_alt', addslashes( $image_alt ) );
}
}
@@ -248,7 +249,7 @@ function edit_post( $post_data = null ) {
add_meta( $post_ID );
wp_update_post_meta( $post_ID, '_edit_last', $GLOBALS['current_user']->ID );
update_post_meta( $post_ID, '_edit_last', $GLOBALS['current_user']->ID );
wp_update_post( $post_data );
@@ -429,15 +430,15 @@ function get_default_post_to_edit( $post_type = 'post', $create_in_db = false )
$post_title = '';
if ( !empty( $_REQUEST['post_title'] ) )
$post_title = esc_html( wp_unslash( $_REQUEST['post_title'] ));
$post_title = esc_html( stripslashes( $_REQUEST['post_title'] ));
$post_content = '';
if ( !empty( $_REQUEST['content'] ) )
$post_content = esc_html( wp_unslash( $_REQUEST['content'] ));
$post_content = esc_html( stripslashes( $_REQUEST['content'] ));
$post_excerpt = '';
if ( !empty( $_REQUEST['excerpt'] ) )
$post_excerpt = esc_html( wp_unslash( $_REQUEST['excerpt'] ));
$post_excerpt = esc_html( stripslashes( $_REQUEST['excerpt'] ));
if ( $create_in_db ) {
$post_id = wp_insert_post( array( 'post_title' => __( 'Auto Draft' ), 'post_type' => $post_type, 'post_status' => 'auto-draft' ) );
@@ -486,9 +487,9 @@ function get_default_post_to_edit( $post_type = 'post', $create_in_db = false )
function post_exists($title, $content = '', $date = '') {
global $wpdb;
$post_title = sanitize_post_field( 'post_title', $title, 0, 'db' );
$post_content = sanitize_post_field( 'post_content', $content, 0, 'db' );
$post_date = sanitize_post_field( 'post_date', $date, 0, 'db' );
$post_title = stripslashes( sanitize_post_field( 'post_title', $title, 0, 'db' ) );
$post_content = stripslashes( sanitize_post_field( 'post_content', $content, 0, 'db' ) );
$post_date = stripslashes( sanitize_post_field( 'post_date', $date, 0, 'db' ) );
$query = "SELECT ID FROM $wpdb->posts WHERE 1=1";
$args = array();
@@ -566,7 +567,7 @@ function wp_write_post() {
}
// Create the post.
$post_ID = wp_insert_post( wp_unslash( $_POST ) );
$post_ID = wp_insert_post( $_POST );
if ( is_wp_error( $post_ID ) )
return $post_ID;
@@ -575,7 +576,7 @@ function wp_write_post() {
add_meta( $post_ID );
wp_add_post_meta( $post_ID, '_edit_last', $GLOBALS['current_user']->ID );
add_post_meta( $post_ID, '_edit_last', $GLOBALS['current_user']->ID );
// Now that we have an ID we can fix any attachment anchor hrefs
_fix_attachment_links( $post_ID );
@@ -619,9 +620,9 @@ function add_meta( $post_ID ) {
global $wpdb;
$post_ID = (int) $post_ID;
$metakeyselect = isset($_POST['metakeyselect']) ? wp_unslash( trim( $_POST['metakeyselect'] ) ) : '';
$metakeyinput = isset($_POST['metakeyinput']) ? wp_unslash( trim( $_POST['metakeyinput'] ) ) : '';
$metavalue = isset($_POST['metavalue']) ? wp_unslash( trim( $_POST['metavalue'] ) ) : '';
$metakeyselect = isset($_POST['metakeyselect']) ? stripslashes( trim( $_POST['metakeyselect'] ) ) : '';
$metakeyinput = isset($_POST['metakeyinput']) ? stripslashes( trim( $_POST['metakeyinput'] ) ) : '';
$metavalue = isset($_POST['metavalue']) ? $_POST['metavalue'] : '';
if ( is_string( $metavalue ) )
$metavalue = trim( $metavalue );
@@ -638,7 +639,9 @@ function add_meta( $post_ID ) {
if ( is_protected_meta( $metakey, 'post' ) || ! current_user_can( 'add_post_meta', $post_ID, $metakey ) )
return false;
return wp_add_post_meta( $post_ID, $metakey, $metavalue );
$metakey = esc_sql( $metakey );
return add_post_meta( $post_ID, $metakey, $metavalue );
}
return false;
@@ -711,11 +714,14 @@ function has_meta( $postid ) {
* @since 1.2.0
*
* @param unknown_type $meta_id
* @param unknown_type $meta_key
* @param unknown_type $meta_value
* @param unknown_type $meta_key Expect Slashed
* @param unknown_type $meta_value Expect Slashed
* @return unknown
*/
function update_meta( $meta_id, $meta_key, $meta_value ) {
$meta_key = stripslashes( $meta_key );
$meta_value = stripslashes_deep( $meta_value );
return update_metadata_by_mid( 'post', $meta_id, $meta_value, $meta_key );
}
@@ -769,6 +775,8 @@ function _fix_attachment_links( $post_ID ) {
if ( $replace ) {
$post['post_content'] = $content;
// Escape data pulled from DB.
$post = add_magic_quotes($post);
return wp_update_post($post);
}
@@ -1179,7 +1187,7 @@ function wp_set_post_lock( $post_id ) {
$now = time();
$lock = "$now:$user_id";
wp_update_post_meta( $post->ID, '_edit_lock', $lock );
update_post_meta( $post->ID, '_edit_lock', $lock );
return array( $now, $user_id );
}
@@ -1230,14 +1238,14 @@ function wp_create_post_autosave( $post_id ) {
// Only store one autosave. If there is already an autosave, overwrite it.
if ( $old_autosave = wp_get_post_autosave( $post_id ) ) {
$new_autosave = _wp_post_revision_fields( wp_unslash( $_POST ), true );
$new_autosave = _wp_post_revision_fields( $_POST, true );
$new_autosave['ID'] = $old_autosave->ID;
$new_autosave['post_author'] = get_current_user_id();
return wp_update_post( $new_autosave );
}
// _wp_put_post_revision() expects unescaped.
$_POST = wp_unslash( $_POST );
$_POST = stripslashes_deep($_POST);
// Otherwise create the new autosave as a special post revision
return _wp_put_post_revision( $_POST, true );