sergiotarxz/Wordpress
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Use stripslashes_deep to strip meta values. Props JonathanRogers, Sewar. fixes #10656

Browse Source 
git-svn-id: https://develop.svn.wordpress.org/trunk@12336 602fd350-edb4-49c9-b593-d223f7449a82
This commit is contained in:
Ryan Boren 2009-12-08 00:48:39 +00:00
parent 0cc6b29c9b
commit bd86766a72
1 changed files with 4 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
wp-admin/includes/post.php
View File

@ -559,7 +559,9 @@ function add_meta( $post_ID ) {
$metakeyselect = isset($_POST['metakeyselect']) ? stripslashes( trim( $_POST['metakeyselect'] ) ) : '';
$metakeyinput = isset($_POST['metakeyinput']) ? stripslashes( trim( $_POST['metakeyinput'] ) ) : '';
$metavalue = isset($_POST['metavalue']) ? maybe_serialize( stripslashes( trim( $_POST['metavalue'] ) ) ) : '';
$metavalue = isset($_POST['metavalue']) ? maybe_serialize( stripslashes_deep( $_POST['metavalue'] ) ) : '';
if ( is_string($metavalue) )
$metavalue = trim( $metavalue );
if ( ('0' === $metavalue || !empty ( $metavalue ) ) && ((('#NONE#' != $metakeyselect) && !empty ( $metakeyselect) ) || !empty ( $metakeyinput) ) ) {
// We have a key/value pair. If both the select and the
@ -686,7 +688,7 @@ function update_meta( $meta_id, $meta_key, $meta_value ) {
$post_id = $wpdb->get_var( $wpdb->prepare("SELECT post_id FROM $wpdb->postmeta WHERE meta_id = %d", $meta_id) );
wp_cache_delete($post_id, 'post_meta');
$meta_value = maybe_serialize( stripslashes( $meta_value ) );
$meta_value = maybe_serialize( stripslashes_deep( $meta_value ) );
$meta_id = (int) $meta_id;
$data = compact( 'meta_key', 'meta_value' );