Permalink
Browse files

Use wp_unslash() instead of stripslashes() and stripslashes_deep(). U…

…se wp_slash() instead of add_magic_quotes().

see #WP21767


git-svn-id: http://core.svn.wordpress.org/trunk@23591 1a063a9b-81f0-0310-95a4-ce76da25c4cd
  • Loading branch information...
Ryan Boren
Ryan Boren committed Mar 3, 2013
1 parent 2798e39 commit 15a06a35ab053cf9e161d9539e31f6fe17f7b5ed
View
@@ -116,7 +116,7 @@ function admin_created_user_subject( $text ) {
if ( is_wp_error( $user_details[ 'errors' ] ) && !empty( $user_details[ 'errors' ]->errors ) ) {
$add_user_errors = $user_details[ 'errors' ];
} else {
- $new_user_login = apply_filters('pre_user_login', sanitize_user(stripslashes($_REQUEST['user_login']), true));
+ $new_user_login = apply_filters('pre_user_login', sanitize_user(wp_unslash($_REQUEST['user_login']), true));
if ( isset( $_POST[ 'noconfirmation' ] ) && is_super_admin() ) {
add_filter( 'wpmu_signup_user_notification', '__return_false' ); // Disable confirmation email
}
@@ -309,7 +309,7 @@ function admin_created_user_subject( $text ) {
$var = "new_user_$var";
if( isset( $_POST['createuser'] ) ) {
if ( ! isset($$var) )
- $$var = isset( $_POST[$post_field] ) ? stripslashes( $_POST[$post_field] ) : '';
+ $$var = isset( $_POST[$post_field] ) ? wp_unslash( $_POST[$post_field] ) : '';
} else {
$$var = false;
}
View
@@ -64,9 +64,9 @@
);
if ( empty($_REQUEST) ) {
- $referer = '<input type="hidden" name="wp_http_referer" value="'. esc_attr(stripslashes($_SERVER['REQUEST_URI'])) . '" />';
+ $referer = '<input type="hidden" name="wp_http_referer" value="'. esc_attr( wp_unslash( $_SERVER['REQUEST_URI'] ) ) . '" />';
} elseif ( isset($_REQUEST['wp_http_referer']) ) {
- $redirect = remove_query_arg(array('wp_http_referer', 'updated', 'delete_count'), stripslashes($_REQUEST['wp_http_referer']));
+ $redirect = remove_query_arg(array('wp_http_referer', 'updated', 'delete_count'), wp_unslash( $_REQUEST['wp_http_referer'] ) );
$referer = '<input type="hidden" name="wp_http_referer" value="' . esc_attr($redirect) . '" />';
} else {
$redirect = 'users.php';
@@ -357,7 +357,7 @@ function delete_users_add_js() { ?>
default:
if ( !empty($_GET['_wp_http_referer']) ) {
- wp_redirect(remove_query_arg(array('_wp_http_referer', '_wpnonce'), stripslashes($_SERVER['REQUEST_URI'])));
+ wp_redirect( remove_query_arg( array( '_wp_http_referer', '_wpnonce'), wp_unslash( $_SERVER['REQUEST_URI'] ) ) );
exit;
}
@@ -381,7 +381,7 @@ function delete_users_add_js() { ?>
case 'add':
if ( isset( $_GET['id'] ) && ( $user_id = $_GET['id'] ) && current_user_can( 'edit_user', $user_id ) ) {
$messages[] = '<div id="message" class="updated"><p>' . sprintf( __( 'New user created. <a href="%s">Edit user</a>' ),
- esc_url( add_query_arg( 'wp_http_referer', urlencode( stripslashes( $_SERVER['REQUEST_URI'] ) ),
+ esc_url( add_query_arg( 'wp_http_referer', urlencode( wp_unslash( $_SERVER['REQUEST_URI'] ) ),
self_admin_url( 'user-edit.php?user_id=' . $user_id ) ) ) ) . '</p></div>';
} else {
$messages[] = '<div id="message" class="updated"><p>' . __( 'New user created.' ) . '</p></div>';
@@ -310,7 +310,7 @@ public function wp_redirect_status( $status ) {
public function post_value( $setting ) {
if ( ! isset( $this->_post_values ) ) {
if ( isset( $_POST['customized'] ) )
- $this->_post_values = json_decode( stripslashes( $_POST['customized'] ), true );
+ $this->_post_values = json_decode( wp_unslash( $_POST['customized'] ), true );
else
$this->_post_values = false;
}
@@ -144,7 +144,7 @@ public function _preview_filter( $original ) {
* @return mixed Null if an input isn't valid, otherwise the sanitized value.
*/
public function sanitize( $value ) {
- $value = stripslashes_deep( $value );
+ $value = wp_unslash( $value );
return apply_filters( "customize_sanitize_{$this->id}", $value, $this );
}
@@ -280,16 +280,16 @@ function set_custom_fields($post_id, $fields) {
$meta['id'] = (int) $meta['id'];
$pmeta = get_metadata_by_mid( 'post', $meta['id'] );
if ( isset($meta['key']) ) {
- $meta['key'] = stripslashes( $meta['key'] );
+ $meta['key'] = wp_unslash( $meta['key'] );
if ( $meta['key'] != $pmeta->meta_key )
continue;
- $meta['value'] = stripslashes_deep( $meta['value'] );
+ $meta['value'] = wp_unslash( $meta['value'] );
if ( current_user_can( 'edit_post_meta', $post_id, $meta['key'] ) )
update_metadata_by_mid( 'post', $meta['id'], $meta['value'] );
} elseif ( current_user_can( 'delete_post_meta', $post_id, $pmeta->meta_key ) ) {
delete_metadata_by_mid( 'post', $meta['id'] );
}
- } elseif ( current_user_can( 'add_post_meta', $post_id, stripslashes( $meta['key'] ) ) ) {
+ } elseif ( current_user_can( 'add_post_meta', $post_id, wp_unslash( $meta['key'] ) ) ) {
add_post_meta( $post_id, $meta['key'], $meta['value'] );
}
}
@@ -3746,9 +3746,9 @@ function blogger_getPost($args) {
$categories = implode(',', wp_get_post_categories($post_ID));
- $content = '<title>'.stripslashes($post_data['post_title']).'</title>';
+ $content = '<title>'.wp_unslash($post_data['post_title']).'</title>';
$content .= '<category>'.$categories.'</category>';
- $content .= stripslashes($post_data['post_content']);
+ $content .= wp_unslash($post_data['post_content']);
$struct = array(
'userid' => $post_data['post_author'],
@@ -3800,9 +3800,9 @@ function blogger_getRecentPosts($args) {
$post_date = $this->_convert_date( $entry['post_date'] );
$categories = implode(',', wp_get_post_categories($entry['ID']));
- $content = '<title>'.stripslashes($entry['post_title']).'</title>';
+ $content = '<title>'.wp_unslash($entry['post_title']).'</title>';
$content .= '<category>'.$categories.'</category>';
- $content .= stripslashes($entry['post_content']);
+ $content .= wp_unslash($entry['post_content']);
$struct[] = array(
'userid' => $entry['post_author'],
View
@@ -634,21 +634,21 @@ function wp_set_comment_cookies($comment, $user) {
function sanitize_comment_cookies() {
if ( isset($_COOKIE['comment_author_'.COOKIEHASH]) ) {
$comment_author = apply_filters('pre_comment_author_name', $_COOKIE['comment_author_'.COOKIEHASH]);
- $comment_author = stripslashes($comment_author);
+ $comment_author = wp_unslash($comment_author);
$comment_author = esc_attr($comment_author);
$_COOKIE['comment_author_'.COOKIEHASH] = $comment_author;
}
if ( isset($_COOKIE['comment_author_email_'.COOKIEHASH]) ) {
$comment_author_email = apply_filters('pre_comment_author_email', $_COOKIE['comment_author_email_'.COOKIEHASH]);
- $comment_author_email = stripslashes($comment_author_email);
+ $comment_author_email = wp_unslash($comment_author_email);
$comment_author_email = esc_attr($comment_author_email);
$_COOKIE['comment_author_email_'.COOKIEHASH] = $comment_author_email;
}
if ( isset($_COOKIE['comment_author_url_'.COOKIEHASH]) ) {
$comment_author_url = apply_filters('pre_comment_author_url', $_COOKIE['comment_author_url_'.COOKIEHASH]);
- $comment_author_url = stripslashes($comment_author_url);
+ $comment_author_url = wp_unslash($comment_author_url);
$_COOKIE['comment_author_url_'.COOKIEHASH] = $comment_author_url;
}
}
@@ -1262,7 +1262,7 @@ function wp_get_current_commenter() {
*/
function wp_insert_comment($commentdata) {
global $wpdb;
- extract(stripslashes_deep($commentdata), EXTR_SKIP);
+ extract(wp_unslash($commentdata), EXTR_SKIP);
if ( ! isset($comment_author_IP) )
$comment_author_IP = '';
@@ -1502,7 +1502,7 @@ function wp_update_comment($commentarr) {
$commentarr = wp_filter_comment( $commentarr );
// Now extract the merged array.
- extract(stripslashes_deep($commentarr), EXTR_SKIP);
+ extract(wp_unslash($commentarr), EXTR_SKIP);
$comment_content = apply_filters('comment_save_pre', $comment_content);
View
@@ -230,7 +230,7 @@ function spawn_cron( $gmt_time = 0 ) {
set_transient( 'doing_cron', $doing_wp_cron );
ob_start();
- wp_redirect( add_query_arg('doing_wp_cron', $doing_wp_cron, stripslashes($_SERVER['REQUEST_URI'])) );
+ wp_redirect( add_query_arg( 'doing_wp_cron', $doing_wp_cron, wp_unslash( $_SERVER['REQUEST_URI'] ) ) );
echo ' ';
// flush any buffers and send the headers
View
@@ -488,7 +488,7 @@ function prep_atom_text_construct($data) {
*/
function self_link() {
$host = @parse_url(home_url());
- echo esc_url( apply_filters( 'self_link', set_url_scheme( 'http://' . $host['host'] . stripslashes( $_SERVER['REQUEST_URI'] ) ) ) );
+ echo esc_url( apply_filters( 'self_link', set_url_scheme( 'http://' . $host['host'] . wp_unslash( $_SERVER['REQUEST_URI'] ) ) ) );
}
/**
@@ -1423,7 +1423,7 @@ function addslashes_gpc($gpc) {
if ( get_magic_quotes_gpc() )
$gpc = stripslashes($gpc);
- return esc_sql($gpc);
+ return wp_slash($gpc);
}
/**
@@ -1719,7 +1719,7 @@ function wp_rel_nofollow( $text ) {
// This is a pre save filter, so text is already escaped.
$text = stripslashes($text);
$text = preg_replace_callback('|<a (.+?)>|i', 'wp_rel_nofollow_callback', $text);
- $text = esc_sql($text);
+ $text = wp_slash($text);
return $text;
}
View
@@ -43,8 +43,8 @@ function add_metadata($meta_type, $object_id, $meta_key, $meta_value, $unique =
$column = esc_sql($meta_type . '_id');
// expected_slashed ($meta_key)
- $meta_key = stripslashes($meta_key);
- $meta_value = stripslashes_deep($meta_value);
+ $meta_key = wp_unslash($meta_key);
+ $meta_value = wp_unslash($meta_value);
$meta_value = sanitize_meta( $meta_key, $meta_value, $meta_type );
$check = apply_filters( "add_{$meta_type}_metadata", null, $object_id, $meta_key, $meta_value, $unique );
@@ -114,9 +114,9 @@ function update_metadata($meta_type, $object_id, $meta_key, $meta_value, $prev_v
$id_column = 'user' == $meta_type ? 'umeta_id' : 'meta_id';
// expected_slashed ($meta_key)
- $meta_key = stripslashes($meta_key);
+ $meta_key = wp_unslash($meta_key);
$passed_value = $meta_value;
- $meta_value = stripslashes_deep($meta_value);
+ $meta_value = wp_unslash($meta_value);
$meta_value = sanitize_meta( $meta_key, $meta_value, $meta_type );
$check = apply_filters( "update_{$meta_type}_metadata", null, $object_id, $meta_key, $meta_value, $prev_value );
@@ -196,8 +196,8 @@ function delete_metadata($meta_type, $object_id, $meta_key, $meta_value = '', $d
$type_column = esc_sql($meta_type . '_id');
$id_column = 'user' == $meta_type ? 'umeta_id' : 'meta_id';
// expected_slashed ($meta_key)
- $meta_key = stripslashes($meta_key);
- $meta_value = stripslashes_deep($meta_value);
+ $meta_key = wp_unslash($meta_key);
+ $meta_value = wp_unslash($meta_value);
$check = apply_filters( "delete_{$meta_type}_metadata", null, $object_id, $meta_key, $meta_value, $delete_all );
if ( null !== $check )
View
@@ -58,7 +58,7 @@
header( 'Expires: ' . gmdate( 'D, d M Y H:i:s', time() + 100000000 ) . ' GMT' );
// Support for Conditional GET
-$client_etag = isset( $_SERVER['HTTP_IF_NONE_MATCH'] ) ? stripslashes( $_SERVER['HTTP_IF_NONE_MATCH'] ) : false;
+$client_etag = isset( $_SERVER['HTTP_IF_NONE_MATCH'] ) ? wp_unslash( $_SERVER['HTTP_IF_NONE_MATCH'] ) : false;
if( ! isset( $_SERVER['HTTP_IF_MODIFIED_SINCE'] ) )
$_SERVER['HTTP_IF_MODIFIED_SINCE'] = false;

0 comments on commit 15a06a3

Please sign in to comment.