diff --git a/src/wp-includes/meta.php b/src/wp-includes/meta.php index 19ce664da8..a3cbed0b99 100644 --- a/src/wp-includes/meta.php +++ b/src/wp-includes/meta.php @@ -161,6 +161,7 @@ function update_metadata($meta_type, $object_id, $meta_key, $meta_value, $prev_v $id_column = 'user' == $meta_type ? 'umeta_id' : 'meta_id'; // expected_slashed ($meta_key) + $raw_meta_key = $meta_key; $meta_key = wp_unslash($meta_key); $passed_value = $meta_value; $meta_value = wp_unslash($meta_value); @@ -198,7 +199,7 @@ function update_metadata($meta_type, $object_id, $meta_key, $meta_value, $prev_v $meta_ids = $wpdb->get_col( $wpdb->prepare( "SELECT $id_column FROM $table WHERE meta_key = %s AND $column = %d", $meta_key, $object_id ) ); if ( empty( $meta_ids ) ) { - return add_metadata($meta_type, $object_id, $meta_key, $passed_value); + return add_metadata( $meta_type, $object_id, $raw_meta_key, $passed_value ); } $_meta_value = $meta_value; diff --git a/tests/phpunit/tests/meta/updateMetadata.php b/tests/phpunit/tests/meta/updateMetadata.php new file mode 100644 index 0000000000..5e376425b6 --- /dev/null +++ b/tests/phpunit/tests/meta/updateMetadata.php @@ -0,0 +1,30 @@ +assertSame( 'bar', $found ); + } + + /** + * @ticket 35795 + */ + public function test_slashed_key_for_existing_metadata() { + global $wpdb; + + add_metadata( 'post', 123, wp_slash( 'foo\foo' ), 'bar' ); + update_metadata( 'post', 123, wp_slash( 'foo\foo' ), 'baz' ); + + $found = get_metadata( 'post', 123, 'foo\foo', true ); + $this->assertSame( 'baz', $found ); + } +}