sergiotarxz/Wordpress
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Bail on update_user_meta() when $object_id is non-numeric.

Browse Source 
Adds unit test.

Props jacklenox, wonderboymusic.
Fixes #28315.


git-svn-id: https://develop.svn.wordpress.org/trunk@29339 602fd350-edb4-49c9-b593-d223f7449a82
This commit is contained in:
Scott Taylor 2014-08-01 17:09:53 +00:00
parent 758b290d02
commit 5686f4511a
2 changed files with 16 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
src/wp-includes/meta.php
View File

@ -137,8 +137,9 @@ function update_metadata($meta_type, $object_id, $meta_key, $meta_value, $prev_v
if ( !$meta_type || !$meta_key )
return false;
if ( !$object_id = absint($object_id) )
if ( ! is_numeric( $object_id ) || ! $object_id = absint( $object_id ) ) {
return false;
}
if ( ! $table = _get_meta_table($meta_type) )
return false;

14
tests/phpunit/tests/user.php
View File

@ -627,4 +627,18 @@ class Tests_User extends WP_UnitTestCase {
// If this test fails, it will error out for calling the to_array() method on a non-object.
$this->assertInstanceOf( 'WP_Error', wp_update_user( array( 'ID' => $user_id ) ) );
}
/**
* @ticket 28315
*/
function test_user_meta_error() {
$this->factory->user->create( array( 'user_email' => 'taco@burrito.com' ) );
$id = $this->factory->user->create( array( 'user_email' => 'taco@burrito.com' ) );
$this->assertWPError( $id );
@update_user_meta( $id, 'key', 'value' );
$metas = array_keys( get_user_meta( 1 ) );
$this->assertNotContains( 'key', $metas );
}
}