25708e95f1
Use wp_slash() in places where we improperly used the DB API instead. see #21767 .
...
git-svn-id: https://develop.svn.wordpress.org/trunk@24713 602fd350-edb4-49c9-b593-d223f7449a82
2013-07-16 14:19:03 +00:00
c363aea627
Revert 23416, 23419, 23445 except for wp_reset_vars() changes. We are going a different direction with the slashing cleanup, so resetting to a clean slate. see #21767
...
git-svn-id: https://develop.svn.wordpress.org/trunk@23554 602fd350-edb4-49c9-b593-d223f7449a82
2013-03-01 16:28:40 +00:00
a6c8efadb9
Change all core API to expect unslashed rather than slashed arguments.
...
The exceptions to this are update_post_meta() and add_post_meta() which are often used by plugins in POST handlers and will continue accepting slashed data for now.
Introduce wp_upate_post_meta() and wp_add_post_meta() as unslashed alternatives to update_post_meta() and add_post_meta(). These functions could become methods in WP_Post so don't use them too heavily yet.
Remove all escape() calls from wp_xmlrpc_server. Now that core expects unslashed data this is no longer needed.
Remove addslashes(), addslashes_gpc(), add_magic_quotes() calls on data being prepared for handoff to core functions that until now expected slashed data. Adding slashes in no longer necessary.
Introduce wp_unslash() and use to it remove slashes from GPCS data before using it in core API. Almost every instance of stripslashes() in core should now be wp_unslash(). In the future (a release or three) when GPCS is no longer slashed, wp_unslash() will stop stripping slashes and simply return what is passed. At this point wp_unslash() calls can be removed from core.
Introduce wp_slash() for slashing GPCS data. This will also turn into a noop once GPCS is no longer slashed. wp_slash() should almost never be used. It is mainly of use in unit tests.
Plugins should use wp_unslash() on data being passed to core API.
Plugins should no longer slash data being passed to core. So when you get_post() and then wp_insert_post() the post data from get_post() no longer needs addslashes(). Most plugins were not bothering with this. They will magically start doing the right thing. Unfortunately, those few souls who did it properly will now have to avoid calling addslashes() for 3.6 and newer.
Use wp_kses_post() and wp_kses_data(), which expect unslashed data, instead of wp_filter_post_kses() and wp_filter_kses(), which expect slashed data. Filters are no longer passed slashed data.
Remove many no longer necessary calls to $wpdb->escape() and esc_sql().
In wp_get_referer() and wp_get_original_referer(), return unslashed data.
Remove old stripslashes() calls from WP_Widget::update() handlers. These haven't been necessary since WP_Widget.
Switch several queries over to prepare().
Expect something to break.
Props alexkingorg
see #21767
git-svn-id: https://develop.svn.wordpress.org/trunk@23416 602fd350-edb4-49c9-b593-d223f7449a82
2013-02-14 22:51:06 +00:00
1daab2358b
Use wp_safe_redirect(). No need to allow offsite redirects.
...
git-svn-id: https://develop.svn.wordpress.org/trunk@20425 602fd350-edb4-49c9-b593-d223f7449a82
2012-04-10 17:21:17 +00:00
6f9ceb2326
Introduce WP_User::exists(). see #20372
...
git-svn-id: https://develop.svn.wordpress.org/trunk@20378 602fd350-edb4-49c9-b593-d223f7449a82
2012-04-06 19:18:45 +00:00
2b186b0c45
Lose EOF ?>. Clean up EOF newlines. fixes #12307
...
git-svn-id: https://develop.svn.wordpress.org/trunk@19712 602fd350-edb4-49c9-b593-d223f7449a82
2012-01-08 17:01:11 +00:00
ef0a93fea9
Make it possible for commenter cookies to be disabled if someone wants to by setting them on an action instead of always. Fixes #17976 props SergeyBiryukov and pishmishy .
...
git-svn-id: https://develop.svn.wordpress.org/trunk@19622 602fd350-edb4-49c9-b593-d223f7449a82
2011-12-21 10:57:42 +00:00
a3bdf19206
Be more consistent with ERROR: messages. fixes #15887
...
git-svn-id: https://develop.svn.wordpress.org/trunk@18841 602fd350-edb4-49c9-b593-d223f7449a82
2011-09-30 17:18:35 +00:00
3ebb27ae3e
Always exit after wp_redirect. props filosofo, fixes #15518 .
...
git-svn-id: https://develop.svn.wordpress.org/trunk@16847 602fd350-edb4-49c9-b593-d223f7449a82
2010-12-09 18:02:54 +00:00
161b1af64e
Allow comments on private posts to proceed past the comment_on_draft action and exit branch. We handle whether the commenter has the appropriate caps further down. fixes #13276 .
...
git-svn-id: https://develop.svn.wordpress.org/trunk@14473 602fd350-edb4-49c9-b593-d223f7449a82
2010-05-06 15:38:40 +00:00
2e60fb8e0e
Register 'inherit' as a post status. Check the parent post status when commenting on attachments.
...
git-svn-id: https://develop.svn.wordpress.org/trunk@14086 602fd350-edb4-49c9-b593-d223f7449a82
2010-04-14 14:07:48 +00:00
561dd7050a
Deny commenting on any post with a non-public status. see #9674
...
git-svn-id: https://develop.svn.wordpress.org/trunk@13200 602fd350-edb4-49c9-b593-d223f7449a82
2010-02-18 20:08:35 +00:00
866c3021d4
Block comments for future posts and password protected posts (when password not provided). Props filosofo. fixes #11810 for trunk
...
git-svn-id: https://develop.svn.wordpress.org/trunk@12647 602fd350-edb4-49c9-b593-d223f7449a82
2010-01-07 19:37:16 +00:00
42e6256e10
Accept either user_id or user_ID. Remove user_id global. see #11271 #11222
...
git-svn-id: https://develop.svn.wordpress.org/trunk@12300 602fd350-edb4-49c9-b593-d223f7449a82
2009-12-01 02:06:02 +00:00
387ac8c9b5
Fix notices and phpdoc, props hakre, fixes #10758
...
git-svn-id: https://develop.svn.wordpress.org/trunk@12284 602fd350-edb4-49c9-b593-d223f7449a82
2009-11-26 11:29:54 +00:00
27db8a8161
Standardize on user_id instead of user_ID when passing comment data. fixes #11222
...
git-svn-id: https://develop.svn.wordpress.org/trunk@12267 602fd350-edb4-49c9-b593-d223f7449a82
2009-11-23 21:04:11 +00:00
bc7e8e284b
Trash comments when trashing a post. see #11073
...
git-svn-id: https://develop.svn.wordpress.org/trunk@12148 602fd350-edb4-49c9-b593-d223f7449a82
2009-11-05 21:03:09 +00:00
ba1c3bdd5b
Deprecate sanitize_url() and clean_url() in favor of esc_url_raw() and esc_url()
...
git-svn-id: https://develop.svn.wordpress.org/trunk@11383 602fd350-edb4-49c9-b593-d223f7449a82
2009-05-18 16:00:33 +00:00
79a1dd8466
Add 'pre_comment_on_post' action to allow early denial by spam plugin. Fixes #8343 .
...
git-svn-id: https://develop.svn.wordpress.org/trunk@11248 602fd350-edb4-49c9-b593-d223f7449a82
2009-05-10 07:11:12 +00:00
5926a70719
Allow a plugin to vary the comment cookie lifetime (or even remove the cookies altogether). Fixes #4996 .
...
git-svn-id: https://develop.svn.wordpress.org/trunk@11223 602fd350-edb4-49c9-b593-d223f7449a82
2009-05-06 20:58:46 +00:00
6a301a48c4
Require user to be logged in to comment on private posts. Props tott. see #8997
...
git-svn-id: https://develop.svn.wordpress.org/trunk@10684 602fd350-edb4-49c9-b593-d223f7449a82
2009-03-02 22:42:22 +00:00
03792b2e62
Handle blank display_name for commenters. props mrmist. fixes #7494
...
git-svn-id: https://develop.svn.wordpress.org/trunk@9781 602fd350-edb4-49c9-b593-d223f7449a82
2008-11-19 06:58:44 +00:00
0623c49a93
Notice fixes from Viper007Bond. see #7509
...
git-svn-id: https://develop.svn.wordpress.org/trunk@9515 602fd350-edb4-49c9-b593-d223f7449a82
2008-11-04 20:16:54 +00:00
9f54a77081
Redirect back to correct comment page after replying. Props Viper007Bond. fixes #8055
...
git-svn-id: https://develop.svn.wordpress.org/trunk@9508 602fd350-edb4-49c9-b593-d223f7449a82
2008-11-04 03:37:30 +00:00
00b5111693
Redirect back to correct comment page after replying. Props Viper007Bond. fixes #8055
...
git-svn-id: https://develop.svn.wordpress.org/trunk@9507 602fd350-edb4-49c9-b593-d223f7449a82
2008-11-04 03:31:19 +00:00
873a5b075b
Comment paging and sorting from Viper007Bond. see #7927
...
git-svn-id: https://develop.svn.wordpress.org/trunk@9296 602fd350-edb4-49c9-b593-d223f7449a82
2008-10-23 16:08:47 +00:00
3e9d31fc8f
Reply to comments from admin, first run, see #7435
...
git-svn-id: https://develop.svn.wordpress.org/trunk@8720 602fd350-edb4-49c9-b593-d223f7449a82
2008-08-24 06:56:22 +00:00
97d67b7f80
Minor phpdoc fixups.
...
git-svn-id: https://develop.svn.wordpress.org/trunk@8149 602fd350-edb4-49c9-b593-d223f7449a82
2008-06-20 20:56:40 +00:00
e25996c368
File file level phpdoc from jacobsantos. see #7037
...
git-svn-id: https://develop.svn.wordpress.org/trunk@7991 602fd350-edb4-49c9-b593-d223f7449a82
2008-05-25 15:50:15 +00:00
e911cca913
Allow wp-config.php to exist one level up from WordPress root directory. Props sambauers. fixes #6933
...
git-svn-id: https://develop.svn.wordpress.org/trunk@7971 602fd350-edb4-49c9-b593-d223f7449a82
2008-05-21 05:59:27 +00:00
fdc05b24f6
Prepare DB queries in more places. Props filosofo. see #6644
...
git-svn-id: https://develop.svn.wordpress.org/trunk@7645 602fd350-edb4-49c9-b593-d223f7449a82
2008-04-14 16:13:25 +00:00
40f80710a4
Add filters to comments_open() and pings_open(). Props tellyworth. fixes #5761
...
git-svn-id: https://develop.svn.wordpress.org/trunk@6716 602fd350-edb4-49c9-b593-d223f7449a82
2008-02-04 20:27:45 +00:00
8f31e395de
Update wp-comments-post.php to WP coding conventions. props JeremyVisser. fixes #4573
...
git-svn-id: https://develop.svn.wordpress.org/trunk@5777 602fd350-edb4-49c9-b593-d223f7449a82
2007-07-04 16:12:37 +00:00
0f0788d24d
Introducing post_status="pending". see #4446 and put any initial bug reports on that ticket
...
git-svn-id: https://develop.svn.wordpress.org/trunk@5707 602fd350-edb4-49c9-b593-d223f7449a82
2007-06-14 16:24:28 +00:00
12c2ef6be0
Content-Type, not Content-type, as headers are case sensitive. Props foolswisdom and Nazgul. fixes #3545
...
git-svn-id: https://develop.svn.wordpress.org/trunk@5640 602fd350-edb4-49c9-b593-d223f7449a82
2007-06-02 05:21:18 +00:00
82a40d63e6
Requesting wp-comments-post.php with GET should return 405. Props Mike Little. fixes #3797
...
git-svn-id: https://develop.svn.wordpress.org/trunk@5128 602fd350-edb4-49c9-b593-d223f7449a82
2007-03-28 17:34:42 +00:00
d57901d29a
Ryan slays the dragon. (Some of these return WP_Error objects.)
...
git-svn-id: https://develop.svn.wordpress.org/trunk@5089 602fd350-edb4-49c9-b593-d223f7449a82
2007-03-23 02:05:29 +00:00
b1f6f9a6a8
(int)er the dragon.
...
git-svn-id: https://develop.svn.wordpress.org/trunk@5087 602fd350-edb4-49c9-b593-d223f7449a82
2007-03-23 00:59:21 +00:00
096395f366
nonce-protect comments by users with unfiltered_html cap to prevent xsrf/xss. fixes #3973 for trunk
...
git-svn-id: https://develop.svn.wordpress.org/trunk@5039 602fd350-edb4-49c9-b593-d223f7449a82
2007-03-14 23:10:57 +00:00
f8e2216f0e
strip tags from comment author before determining emptiness status. props Nazgul. fixes #3839
...
git-svn-id: https://develop.svn.wordpress.org/trunk@4939 602fd350-edb4-49c9-b593-d223f7449a82
2007-02-25 13:35:16 +00:00
8453685dc9
comment_post_redirect and comment_edit_redirect from Mark J. fixes #2590
...
git-svn-id: https://develop.svn.wordpress.org/trunk@4260 602fd350-edb4-49c9-b593-d223f7449a82
2006-09-28 19:16:15 +00:00
7e82eef627
Use get_option instead of get_settings. Just 'cause.
...
git-svn-id: https://develop.svn.wordpress.org/trunk@4144 602fd350-edb4-49c9-b593-d223f7449a82
2006-08-30 21:46:31 +00:00
4562fd2b74
wp_die() for comment errors. Props filosofo. fixes #1786
...
git-svn-id: https://develop.svn.wordpress.org/trunk@3984 602fd350-edb4-49c9-b593-d223f7449a82
2006-07-05 20:34:19 +00:00
f7ee176581
More comment cookie sanitation.
...
git-svn-id: https://develop.svn.wordpress.org/trunk@3577 602fd350-edb4-49c9-b593-d223f7449a82
2006-02-28 09:49:06 +00:00
e0feeb161a
Strip all html from comment author name, email, and url.
...
git-svn-id: https://develop.svn.wordpress.org/trunk@3574 602fd350-edb4-49c9-b593-d223f7449a82
2006-02-28 04:22:24 +00:00
cd4a8a24c5
current user cleanup
...
git-svn-id: https://develop.svn.wordpress.org/trunk@3566 602fd350-edb4-49c9-b593-d223f7449a82
2006-02-22 19:08:55 +00:00
bac53166c4
clean comment author url. fixes #2454
...
git-svn-id: https://develop.svn.wordpress.org/trunk@3542 602fd350-edb4-49c9-b593-d223f7449a82
2006-02-17 01:31:53 +00:00
be5caf3590
Redirect to permalink instead of referrer. Fixes #1673
...
git-svn-id: https://develop.svn.wordpress.org/trunk@2984 602fd350-edb4-49c9-b593-d223f7449a82
2005-11-05 22:08:56 +00:00
0c4c22f966
Don't set for logged in users.
...
git-svn-id: https://develop.svn.wordpress.org/trunk@2837 602fd350-edb4-49c9-b593-d223f7449a82
2005-09-05 04:14:29 +00:00
b3f7bd726c
Use wpdb->escape instead of addslashes to prepare DB bound data.
...
git-svn-id: https://develop.svn.wordpress.org/trunk@2699 602fd350-edb4-49c9-b593-d223f7449a82
2005-07-05 20:47:22 +00:00
Andrew Nacin
Ryan Boren
Peter Westwood
Mark Jaquith
Andrew Ozz
rob1n
Matt Mullenweg