sergiotarxz
/
Wordpress
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Use the non-slashing variants of kses functions in sanitize_option() to avoid slash ping pong. fixes #21892. 

git-svn-id: https://develop.svn.wordpress.org/trunk@21850 602fd350-edb4-49c9-b593-d223f7449a82
This commit is contained in:
Andrew Nacin 2012-09-14 19:32:53 +00:00
parent 537a6769e6
commit 8c13f286e3
1 changed files with 2 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
wp-includes/formatting.php
View File

@ -2789,9 +2789,7 @@ function sanitize_option($option, $value) {
case 'blogdescription':
case 'blogname':
$value = addslashes($value);
$value = wp_filter_post_kses( $value ); // calls stripslashes then addslashes
$value = stripslashes($value);
$value = wp_kses_post( $value );
$value = esc_html( $value );
break;
@ -2807,9 +2805,7 @@ function sanitize_option($option, $value) {
case 'ping_sites':
case 'upload_path':
$value = strip_tags($value);
$value = addslashes($value);
$value = wp_filter_kses($value); // calls stripslashes then addslashes
$value = stripslashes($value);
$value = wp_kses_data($value);
break;
case 'gmt_offset':