From 7cdda656cc21b7fffa0593d744e402bdc4efdaa9 Mon Sep 17 00:00:00 2001 From: ryan Date: Tue, 11 Sep 2007 20:24:42 +0000 Subject: [PATCH] Fix option sanitization slashing. fixes #4949 for 2.2 git-svn-id: http://svn.automattic.com/wordpress/branches/2.2@6083 1a063a9b-81f0-0310-95a4-ce76da25c4cd --- wp-admin/options.php | 5 +++-- wp-includes/functions.php | 1 + 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/wp-admin/options.php b/wp-admin/options.php index 480b6da64e..df644dcfde 100644 --- a/wp-admin/options.php +++ b/wp-admin/options.php @@ -29,8 +29,9 @@ case 'update': if ($options) { foreach ($options as $option) { $option = trim($option); - $value = trim($_POST[$option]); - $value = sanitize_option($option, $value); // This does stripslashes on those that need it + $value = $_POST[$option]; + if(!is_array($value)) $value = trim($value); + $value = stripslashes_deep($value); update_option($option, $value); } } diff --git a/wp-includes/functions.php b/wp-includes/functions.php index a5f7db52c1..5e87b1f1a1 100644 --- a/wp-includes/functions.php +++ b/wp-includes/functions.php @@ -310,6 +310,7 @@ function update_option($option_name, $newvalue) { wp_protect_special_option($option_name); $safe_option_name = $wpdb->escape($option_name); + $newvalue = sanitize_option($option_name, $newvalue); if ( is_string($newvalue) ) $newvalue = trim($newvalue);