sergiotarxz
/
Wordpress
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

User state settings: 

- Allow empty cookie value to be saved.
- Use get_current_user_id() instead of wp_get_current_user().
- Use is_user_member_of_blog().
- Sanitize both name and value in wp_set_all_user_settings().
- Some var names and code formatting cleanup.
Fixes #24921.

git-svn-id: https://develop.svn.wordpress.org/trunk@25109 602fd350-edb4-49c9-b593-d223f7449a82
This commit is contained in:
Andrew Ozz 2013-08-23 21:42:23 +00:00
parent 46c24c3cf2
commit a380ed51f7
1 changed files with 57 additions and 61 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

118
src/wp-includes/option.php
View File

@ -541,37 +541,36 @@ function wp_user_settings() {
if ( defined('DOING_AJAX') ) if ( defined('DOING_AJAX') )
return; return;
if ( ! $user = wp_get_current_user() ) if ( ! $user_id = get_current_user_id() )
return; return;
if ( is_super_admin( $user->ID ) && if ( is_super_admin() && ! is_user_member_of_blog() )
! in_array( get_current_blog_id(), array_keys( get_blogs_of_user( $user->ID ) ) )
)
return; return;
$settings = get_user_option( 'user-settings', $user->ID ); $settings = (string) get_user_option( 'user-settings', $user_id );
if ( isset( $_COOKIE['wp-settings-' . $user->ID] ) ) { if ( isset( $_COOKIE['wp-settings-' . $user_id] ) ) {
$cookie = preg_replace( '/[^A-Za-z0-9=&_]/', '', $_COOKIE['wp-settings-' . $user->ID] ); $cookie = preg_replace( '/[^A-Za-z0-9=&_]/', '', $_COOKIE['wp-settings-' . $user_id] );
if ( ! empty( $cookie ) && strpos( $cookie, '=' ) ) { // No change or both empty
if ( $cookie == $settings ) if ( $cookie == $settings )
return; return;
$last_time = (int) get_user_option( 'user-settings-time', $user->ID ); $last_saved = (int) get_user_option( 'user-settings-time', $user_id );
$saved = isset( $_COOKIE['wp-settings-time-' . $user->ID]) ? preg_replace( '/[^0-9]/', '', $_COOKIE['wp-settings-time-' . $user->ID] ) : 0; $current = isset( $_COOKIE['wp-settings-time-' . $user_id]) ? preg_replace( '/[^0-9]/', '', $_COOKIE['wp-settings-time-' . $user_id] ) : 0;
if ( $saved > $last_time ) { // The cookie is newer than the saved value. Update the user_option and leave the cookie as-is
update_user_option( $user->ID, 'user-settings', $cookie, false ); if ( $current > $last_saved ) {
update_user_option( $user->ID, 'user-settings-time', time() - 5, false ); update_user_option( $user_id, 'user-settings', $cookie, false );
return; update_user_option( $user_id, 'user-settings-time', time() - 5, false );
} return;
} }
} }
setcookie( 'wp-settings-' . $user->ID, $settings, time() + YEAR_IN_SECONDS, SITECOOKIEPATH ); // The cookie is not set in the current browser or the saved value is newer.
setcookie( 'wp-settings-time-' . $user->ID, time(), time() + YEAR_IN_SECONDS, SITECOOKIEPATH ); setcookie( 'wp-settings-' . $user_id, $settings, time() + YEAR_IN_SECONDS, SITECOOKIEPATH );
$_COOKIE['wp-settings-' . $user->ID] = $settings; setcookie( 'wp-settings-time-' . $user_id, time(), time() + YEAR_IN_SECONDS, SITECOOKIEPATH );
$_COOKIE['wp-settings-' . $user_id] = $settings;
} }
/** /**
@ -586,10 +585,9 @@ function wp_user_settings() {
* @return mixed the last saved user setting or the default value/false if it doesn't exist. * @return mixed the last saved user setting or the default value/false if it doesn't exist.
*/ */
function get_user_setting( $name, $default = false ) { function get_user_setting( $name, $default = false ) {
$all_user_settings = get_all_user_settings();
$all = get_all_user_settings(); return isset( $all_user_settings[$name] ) ? $all_user_settings[$name] : $default;
return isset($all[$name]) ? $all[$name] : $default;
} }
/** /**
@ -611,15 +609,10 @@ function set_user_setting( $name, $value ) {
if ( headers_sent() ) if ( headers_sent() )
return false; return false;
$all = get_all_user_settings(); $all_user_settings = get_all_user_settings();
$name = preg_replace( '/[^A-Za-z0-9_]+/', '', $name ); $all_user_settings[$name] = $value;
if ( empty($name) ) return wp_set_all_user_settings( $all_user_settings );
return false;
$all[$name] = $value;
return wp_set_all_user_settings($all);
} }
/** /**
@ -640,18 +633,19 @@ function delete_user_setting( $names ) {
if ( headers_sent() ) if ( headers_sent() )
return false; return false;
$all = get_all_user_settings(); $all_user_settings = get_all_user_settings();
$names = (array) $names; $names = (array) $names;
$deleted = false;
foreach ( $names as $name ) { foreach ( $names as $name ) {
if ( isset($all[$name]) ) { if ( isset( $all_user_settings[$name] ) ) {
unset($all[$name]); unset( $all_user_settings[$name] );
$deleted = true; $deleted = true;
} }
} }
if ( isset($deleted) ) if ( $deleted )
return wp_set_all_user_settings($all); return wp_set_all_user_settings( $all_user_settings );
return false; return false;
} }
@ -668,26 +662,27 @@ function delete_user_setting( $names ) {
function get_all_user_settings() { function get_all_user_settings() {
global $_updated_user_settings; global $_updated_user_settings;
if ( ! $user = wp_get_current_user() ) if ( ! $user_id = get_current_user_id() )
return array(); return array();
if ( isset($_updated_user_settings) && is_array($_updated_user_settings) ) if ( isset( $_updated_user_settings ) && is_array( $_updated_user_settings ) )
return $_updated_user_settings; return $_updated_user_settings;
$all = array(); $user_settings = array();
if ( isset($_COOKIE['wp-settings-' . $user->ID]) ) { if ( isset( $_COOKIE['wp-settings-' . $user_id] ) ) {
$cookie = preg_replace( '/[^A-Za-z0-9=&_]/', '', $_COOKIE['wp-settings-' . $user->ID] ); $cookie = preg_replace( '/[^A-Za-z0-9=&_]/', '', $_COOKIE['wp-settings-' . $user_id] );
if ( $cookie && strpos($cookie, '=') ) // the '=' cannot be 1st char if ( $cookie && strpos( $cookie, '=' ) ) // '=' cannot be 1st char
parse_str($cookie, $all); parse_str( $cookie, $user_settings );
} else { } else {
$option = get_user_option('user-settings', $user->ID); $option = get_user_option( 'user-settings', $user_id );
if ( $option && is_string($option) ) if ( $option && is_string($option) )
parse_str( $option, $all ); parse_str( $option, $user_settings );
} }
return $all; $_updated_user_settings = $user_settings;
return $user_settings;
} }
/** /**
@ -697,31 +692,32 @@ function get_all_user_settings() {
* @subpackage Option * @subpackage Option
* @since 2.8.0 * @since 2.8.0
* *
* @param unknown $all * @param array $user_settings
* @return bool * @return bool
*/ */
function wp_set_all_user_settings($all) { function wp_set_all_user_settings( $user_settings ) {
global $_updated_user_settings; global $_updated_user_settings;
if ( ! $user = wp_get_current_user() ) if ( ! $user_id = get_current_user_id() )
return false; return false;
if ( is_super_admin( $user->ID ) && if ( is_super_admin() && ! is_user_member_of_blog() )
! in_array( get_current_blog_id(), array_keys( get_blogs_of_user( $user->ID ) ) )
)
return; return;
$_updated_user_settings = $all;
$settings = ''; $settings = '';
foreach ( $all as $k => $v ) { foreach ( $user_settings as $name => $value ) {
$v = preg_replace( '/[^A-Za-z0-9_]+/', '', $v ); $_name = preg_replace( '/[^A-Za-z0-9_]+/', '', $name );
$settings .= $k . '=' . $v . '&'; $_value = preg_replace( '/[^A-Za-z0-9_]+/', '', $value );
if ( ! empty( $_name ) )
$settings .= $_name . '=' . $_value . '&';
} }
$settings = rtrim($settings, '&'); $settings = rtrim($settings, '&');
parse_str( $settings, $_updated_user_settings );
update_user_option( $user->ID, 'user-settings', $settings, false ); update_user_option( $user_id, 'user-settings', $settings, false );
update_user_option( $user->ID, 'user-settings-time', time(), false ); update_user_option( $user_id, 'user-settings-time', time(), false );
return true; return true;
} }
@ -734,11 +730,11 @@ function wp_set_all_user_settings($all) {
* @since 2.7.0 * @since 2.7.0
*/ */
function delete_all_user_settings() { function delete_all_user_settings() {
if ( ! $user = wp_get_current_user() ) if ( ! $user_id = get_current_user_id() )
return; return;
update_user_option( $user->ID, 'user-settings', '', false ); update_user_option( $user_id, 'user-settings', '', false );
setcookie('wp-settings-' . $user->ID, ' ', time() - YEAR_IN_SECONDS, SITECOOKIEPATH); setcookie('wp-settings-' . $user_id, ' ', time() - YEAR_IN_SECONDS, SITECOOKIEPATH);
} }
/** /**