IntenseWebs/WordPress
3
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Sanitize guid on save and display. Sanitize mime type on save. Don't allow changing mime type via edit form handlers. Protect hidden meta.

Browse Source 
git-svn-id: http://svn.automattic.com/wordpress/trunk@17994 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This commit is contained in:
ryan
2011-05-22 23:19:42 +00:00
parent 117d081812
commit 81a5f821fb
8 changed files with 69 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
wp-admin/includes/media.php
View File

@@ -1201,7 +1201,7 @@ function get_media_item( $attachment_id, $args = null ) {
$toggle_on = __( 'Show' );
$toggle_off = __( 'Hide' );
$filename = basename( $post->guid );
$filename = esc_html( basename( $post->guid ) );
$title = esc_attr( $post->post_title );
if ( $_tags = get_the_tags( $attachment_id ) ) {

15
wp-admin/includes/post.php
View File

@@ -138,6 +138,7 @@ function edit_post( $post_data = null ) {
$post_ID = (int) $post_data['post_ID'];
$post = get_post( $post_ID );
$post_data['post_type'] = $post->post_type;
$post_data['post_mime_type'] = $post->post_mime_type;
$ptype = get_post_type_object($post_data['post_type']);
if ( !current_user_can( $ptype->cap->edit_post, $post_ID ) ) {
@@ -199,6 +200,8 @@ function edit_post( $post_data = null ) {
continue;
if ( $meta->post_id != $post_ID )
continue;
if ( is_protected_meta( $key ) )
continue;
update_meta( $key, $value['key'], $value['value'] );
}
}
@@ -209,6 +212,8 @@ function edit_post( $post_data = null ) {
continue;
if ( $meta->post_id != $post_ID )
continue;
if ( is_protected_meta( $key ) )
continue;
delete_meta( $key );
}
}
@@ -527,6 +532,8 @@ function wp_write_post() {
return new WP_Error( 'edit_posts', __( 'You are not allowed to create posts or drafts on this site.' ) );
}
$_POST['post_mime_type'] = '';
// Check for autosave collisions
// Does this need to be updated? ~ Mark
$temp_id = false;
@@ -632,8 +639,6 @@ function add_meta( $post_ID ) {
global $wpdb;
$post_ID = (int) $post_ID;
$protected = array( '_wp_attached_file', '_wp_attachment_metadata', '_wp_old_slug', '_wp_page_template' );
$metakeyselect = isset($_POST['metakeyselect']) ? stripslashes( trim( $_POST['metakeyselect'] ) ) : '';
$metakeyinput = isset($_POST['metakeyinput']) ? stripslashes( trim( $_POST['metakeyinput'] ) ) : '';
$metavalue = isset($_POST['metavalue']) ? maybe_serialize( stripslashes_deep( $_POST['metavalue'] ) ) : '';
@@ -650,7 +655,7 @@ function add_meta( $post_ID ) {
if ( $metakeyinput)
$metakey = $metakeyinput; // default
if ( in_array($metakey, $protected) )
if ( is_protected_meta( $metakey ) )
return false;
wp_cache_delete($post_ID, 'post_meta');
@@ -756,11 +761,9 @@ function has_meta( $postid ) {
function update_meta( $meta_id, $meta_key, $meta_value ) {
global $wpdb;
$protected = array( '_wp_attached_file', '_wp_attachment_metadata', '_wp_old_slug', '_wp_page_template' );
$meta_key = stripslashes($meta_key);
if ( in_array($meta_key, $protected) )
if ( is_protected_meta( $meta_key ) )
return false;
if ( '' === trim( $meta_value ) )

4
wp-admin/includes/template.php
View File

@@ -465,6 +465,10 @@ function list_meta( $meta ) {
*/
function _list_meta_row( $entry, &$count ) {
static $update_nonce = false;
if ( is_protected_meta( $entry['meta_key'] ) )
return;
if ( !$update_nonce )
$update_nonce = wp_create_nonce( 'add-meta' );