sergiotarxz/Wordpress
sergiotarxz/Wordpress
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Validate $object_id in *_metadata() functions. Props scribu fixes #11841

Browse Source 
git-svn-id: https://develop.svn.wordpress.org/trunk@13347 602fd350-edb4-49c9-b593-d223f7449a82
This commit is contained in:
Andrew Nacin 2010-02-23 22:42:54 +00:00
parent b9b5480c8e
commit d37de180e1
1 changed files with 13 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
wp-includes/meta.php
View File

@ -32,6 +32,9 @@ function add_metadata($meta_type, $object_id, $meta_key, $meta_value, $unique =
if ( !$meta_type || !$meta_key ) if ( !$meta_type || !$meta_key )
return false; return false;
if ( !$object_id = absint($object_id) )
return false;
if ( ! $table = _get_meta_table($meta_type) ) if ( ! $table = _get_meta_table($meta_type) )
return false; return false;
@ -85,6 +88,9 @@ function update_metadata($meta_type, $object_id, $meta_key, $meta_value, $prev_v
if ( !$meta_type || !$meta_key ) if ( !$meta_type || !$meta_key )
return false; return false;
if ( !$object_id = absint($object_id) )
return false;
if ( ! $table = _get_meta_table($meta_type) ) if ( ! $table = _get_meta_table($meta_type) )
return false; return false;
@ -138,7 +144,10 @@ function update_metadata($meta_type, $object_id, $meta_key, $meta_value, $prev_v
* @return bool True on successful delete, false on failure. * @return bool True on successful delete, false on failure.
*/ */
function delete_metadata($meta_type, $object_id, $meta_key, $meta_value = '', $delete_all = false) { function delete_metadata($meta_type, $object_id, $meta_key, $meta_value = '', $delete_all = false) {
if ( !$meta_type || !$meta_key || (!$delete_all && ! (int)$object_id) ) if ( !$meta_type || !$meta_key )
return false;
if ( !$object_id = absint($object_id) && !$delete_all )
return false; return false;
if ( ! $table = _get_meta_table($meta_type) ) if ( ! $table = _get_meta_table($meta_type) )
@ -195,6 +204,9 @@ function get_metadata($meta_type, $object_id, $meta_key = '', $single = false) {
if ( !$meta_type ) if ( !$meta_type )
return false; return false;
if ( !$object_id = absint($object_id) )
return false;
$meta_cache = wp_cache_get($object_id, $meta_type . '_meta'); $meta_cache = wp_cache_get($object_id, $meta_type . '_meta');
if ( !$meta_cache ) { if ( !$meta_cache ) {