Don't double-escape the 'name' param in `get_terms()`.
[32353] changed the way the 'name' param in `get_terms()` is sanitized, by running it through `sanitize_term_field( 'name' )` before performing the SQL query. An unintentional side effect of this change was that the string is double-escaped: once by `wp_filter_kses()`, and once by `esc_sql()`. The double-escaping was causing 'name' queries to fail when the param contained apostrophes or other escaped characters. Fixes #35493. Built from https://develop.svn.wordpress.org/trunk@36348 git-svn-id: http://core.svn.wordpress.org/trunk@36315 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This commit is contained in:
parent
96f0c643e3
commit
60a9f41315
|
@ -1354,7 +1354,8 @@ function get_terms( $taxonomies, $args = '' ) {
|
||||||
if ( ! empty( $args['name'] ) ) {
|
if ( ! empty( $args['name'] ) ) {
|
||||||
$names = (array) $args['name'];
|
$names = (array) $args['name'];
|
||||||
foreach ( $names as &$_name ) {
|
foreach ( $names as &$_name ) {
|
||||||
$_name = sanitize_term_field( 'name', $_name, 0, reset( $taxonomies ), 'db' );
|
// `sanitize_term_field()` returns slashed data.
|
||||||
|
$_name = stripslashes( sanitize_term_field( 'name', $_name, 0, reset( $taxonomies ), 'db' ) );
|
||||||
}
|
}
|
||||||
|
|
||||||
$where .= " AND t.name IN ('" . implode( "', '", array_map( 'esc_sql', $names ) ) . "')";
|
$where .= " AND t.name IN ('" . implode( "', '", array_map( 'esc_sql', $names ) ) . "')";
|
||||||
|
|
|
@ -4,7 +4,7 @@
|
||||||
*
|
*
|
||||||
* @global string $wp_version
|
* @global string $wp_version
|
||||||
*/
|
*/
|
||||||
$wp_version = '4.5-alpha-1453175773216';
|
$wp_version = '4.5-alpha-1453176612026';
|
||||||
|
|
||||||
/**
|
/**
|
||||||
* Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.
|
* Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.
|
||||||
|
|
Loading…
Reference in New Issue