WordPress-C
/
WordPress
mirror of https://github.com/WordPress/WordPress.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

make *_option(), *_transient() functions consistently expect unslashed data. Props Denis-de-Bernardy. see #12416 

git-svn-id: http://svn.automattic.com/wordpress/trunk@13673 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This commit is contained in:
ryan 2010-03-11 21:49:56 +00:00
parent 92edc853a6
commit f91e95f100
3 changed files with 38 additions and 50 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
wp-includes/formatting.php
View File

@ -2441,8 +2441,7 @@ function sanitize_option($option, $value) {
case 'siteurl': case 'siteurl':
case 'home': case 'home':
$value = stripslashes($value); $value = esc_url_raw($value);
$value = esc_url($value);
break; break;
default : default :
$value = apply_filters("sanitize_option_{$option}", $value, $option); $value = apply_filters("sanitize_option_{$option}", $value, $option);

83
wp-includes/functions.php
View File

@ -307,7 +307,7 @@ function is_serialized_string( $data ) {
* @uses apply_filters() Calls 'option_$option', after checking the option, with * @uses apply_filters() Calls 'option_$option', after checking the option, with
* the option value. * the option value.
* *
* @param string $option Name of option to retrieve. Should already be SQL-escaped * @param string $option Name of option to retrieve. Expected to not be SQL-escaped.
* @return mixed Value set for the option. * @return mixed Value set for the option.
*/ */
function get_option( $option, $default = false ) { function get_option( $option, $default = false ) {
@ -339,8 +339,7 @@ function get_option( $option, $default = false ) {
if ( false === $value ) { if ( false === $value ) {
if ( defined( 'WP_INSTALLING' ) ) if ( defined( 'WP_INSTALLING' ) )
$suppress = $wpdb->suppress_errors(); $suppress = $wpdb->suppress_errors();
// expected_slashed ($option) $row = $wpdb->get_row( $wpdb->prepare( "SELECT option_value FROM $wpdb->options WHERE option_name = '%s' LIMIT 1", $option ) );
$row = $wpdb->get_row( "SELECT option_value FROM $wpdb->options WHERE option_name = '$option' LIMIT 1" );
if ( defined( 'WP_INSTALLING' ) ) if ( defined( 'WP_INSTALLING' ) )
$wpdb->suppress_errors( $suppress ); $wpdb->suppress_errors( $suppress );
@ -482,8 +481,8 @@ function wp_load_core_site_options( $site_id = null ) {
* @uses do_action() Calls 'update_option' hook before updating the option. * @uses do_action() Calls 'update_option' hook before updating the option.
* @uses do_action() Calls 'update_option_$option' and 'updated_option' hooks on success. * @uses do_action() Calls 'update_option_$option' and 'updated_option' hooks on success.
* *
* @param string $option Option name. Expected to not be SQL-escaped * @param string $option Option name. Expected to not be SQL-escaped.
* @param mixed $newvalue Option value. * @param mixed $newvalue Option value. Expected to not be SQL-escaped.
* @return bool False if value was not updated and true if value was updated. * @return bool False if value was not updated and true if value was updated.
*/ */
function update_option( $option, $newvalue ) { function update_option( $option, $newvalue ) {
@ -491,9 +490,8 @@ function update_option( $option, $newvalue ) {
wp_protect_special_option( $option ); wp_protect_special_option( $option );
$safe_option = esc_sql( $option );
$newvalue = sanitize_option( $option, $newvalue ); $newvalue = sanitize_option( $option, $newvalue );
$oldvalue = get_option( $safe_option ); $oldvalue = get_option( $option );
$newvalue = apply_filters( 'pre_update_option_' . $option, $newvalue, $oldvalue ); $newvalue = apply_filters( 'pre_update_option_' . $option, $newvalue, $oldvalue );
// If the new and old values are the same, no need to update. // If the new and old values are the same, no need to update.
@ -516,10 +514,10 @@ function update_option( $option, $newvalue ) {
if ( ! defined( 'WP_INSTALLING' ) ) { if ( ! defined( 'WP_INSTALLING' ) ) {
$alloptions = wp_load_alloptions(); $alloptions = wp_load_alloptions();
if ( isset( $alloptions[$option] ) ) { if ( isset( $alloptions[$option] ) ) {
$alloptions[$option] = $newvalue; $alloptions[$option] = $_newvalue;
wp_cache_set( 'alloptions', $alloptions, 'options' ); wp_cache_set( 'alloptions', $_alloptions, 'options' );
} else { } else {
wp_cache_set( $option, $newvalue, 'options' ); wp_cache_set( $option, $_newvalue, 'options' );
} }
} }
@ -554,8 +552,8 @@ function update_option( $option, $newvalue ) {
* @uses do_action() Calls 'add_option' hook before adding the option. * @uses do_action() Calls 'add_option' hook before adding the option.
* @uses do_action() Calls 'add_option_$option' and 'added_option' hooks on success. * @uses do_action() Calls 'add_option_$option' and 'added_option' hooks on success.
* *
* @param string $option Name of option to add. Expects to NOT be SQL escaped. * @param string $option Name of option to add. Expected to not be SQL-escaped.
* @param mixed $value Optional. Option value, can be anything. * @param mixed $value Optional. Option value, can be anything. Expected to not be SQL-escaped.
* @param mixed $deprecated Optional. Description. Not used anymore. * @param mixed $deprecated Optional. Description. Not used anymore.
* @param bool $autoload Optional. Default is enabled. Whether to load the option when WordPress starts up. * @param bool $autoload Optional. Default is enabled. Whether to load the option when WordPress starts up.
* @return null returns when finished. * @return null returns when finished.
@ -567,13 +565,12 @@ function add_option( $option, $value = '', $deprecated = '', $autoload = 'yes' )
global $wpdb; global $wpdb;
wp_protect_special_option( $option ); wp_protect_special_option( $option );
$safe_option = esc_sql( $option );
$value = sanitize_option( $option, $value ); $value = sanitize_option( $option, $value );
// Make sure the option doesn't already exist. We can check the 'notoptions' cache before we ask for a db query // Make sure the option doesn't already exist. We can check the 'notoptions' cache before we ask for a db query
$notoptions = wp_cache_get( 'notoptions', 'options' ); $notoptions = wp_cache_get( 'notoptions', 'options' );
if ( !is_array( $notoptions ) || !isset( $notoptions[$option] ) ) if ( !is_array( $notoptions ) || !isset( $notoptions[$option] ) )
if ( false !== get_option( $safe_option ) ) if ( false !== get_option( $option ) )
return; return;
$_value = $value; $_value = $value;
@ -617,7 +614,7 @@ function add_option( $option, $value = '', $deprecated = '', $autoload = 'yes' )
* @uses do_action() Calls 'delete_option' hook before option is deleted. * @uses do_action() Calls 'delete_option' hook before option is deleted.
* @uses do_action() Calls 'deleted_option' and 'delete_option_$option' hooks on success. * @uses do_action() Calls 'deleted_option' and 'delete_option_$option' hooks on success.
* *
* @param string $option Name of option to remove. * @param string $option Name of option to remove. Expected to not be SQL-escaped.
* @return bool True, if option is successfully deleted. False on failure. * @return bool True, if option is successfully deleted. False on failure.
*/ */
function delete_option( $option ) { function delete_option( $option ) {
@ -626,13 +623,11 @@ function delete_option( $option ) {
wp_protect_special_option( $option ); wp_protect_special_option( $option );
// Get the ID, if no ID then return // Get the ID, if no ID then return
// expected_slashed ($option) $row = $wpdb->get_row( $wpdb->prepare( "SELECT autoload FROM $wpdb->options WHERE option_name = '%s'", $option ) );
$row = $wpdb->get_row( "SELECT autoload FROM $wpdb->options WHERE option_name = '$option'" );
if ( is_null( $row ) ) if ( is_null( $row ) )
return false; return false;
do_action( 'delete_option', $option ); do_action( 'delete_option', $option );
// expected_slashed ($option) $result = $wpdb->query( $wpdb->prepare( "DELETE FROM $wpdb->options WHERE option_name = '%s'", $option) );
$result = $wpdb->query( "DELETE FROM $wpdb->options WHERE option_name = '$option'" );
if ( ! defined( 'WP_INSTALLING' ) ) { if ( ! defined( 'WP_INSTALLING' ) ) {
if ( 'yes' == $row->autoload ) { if ( 'yes' == $row->autoload ) {
$alloptions = wp_load_alloptions(); $alloptions = wp_load_alloptions();
@ -662,7 +657,7 @@ function delete_option( $option ) {
* @uses do_action() Calls 'delete_transient_$transient' hook before transient is deleted. * @uses do_action() Calls 'delete_transient_$transient' hook before transient is deleted.
* @uses do_action() Calls 'deleted_transient' hook on success. * @uses do_action() Calls 'deleted_transient' hook on success.
* *
* @param string $transient Transient name. Expected to not be SQL-escaped * @param string $transient Transient name. Expected to not be SQL-escaped.
* @return bool true if successful, false otherwise * @return bool true if successful, false otherwise
*/ */
function delete_transient( $transient ) { function delete_transient( $transient ) {
@ -673,7 +668,7 @@ function delete_transient( $transient ) {
if ( $_wp_using_ext_object_cache ) { if ( $_wp_using_ext_object_cache ) {
$result = wp_cache_delete( $transient, 'transient' ); $result = wp_cache_delete( $transient, 'transient' );
} else { } else {
$option = '_transient_' . esc_sql( $transient ); $option = '_transient_' . $transient;
$result = delete_option( $option ); $result = delete_option( $option );
} }
@ -711,13 +706,12 @@ function get_transient( $transient ) {
if ( $_wp_using_ext_object_cache ) { if ( $_wp_using_ext_object_cache ) {
$value = wp_cache_get( $transient, 'transient' ); $value = wp_cache_get( $transient, 'transient' );
} else { } else {
$safe_transient = esc_sql( $transient ); $transient_option = '_transient_' . $transient;
$transient_option = '_transient_' . $safe_transient;
if ( ! defined( 'WP_INSTALLING' ) ) { if ( ! defined( 'WP_INSTALLING' ) ) {
// If option is not in alloptions, it is not autoloaded and thus has a timeout // If option is not in alloptions, it is not autoloaded and thus has a timeout
$alloptions = wp_load_alloptions(); $alloptions = wp_load_alloptions();
if ( !isset( $alloptions[$transient_option] ) ) { if ( !isset( $alloptions[$transient_option] ) ) {
$transient_timeout = '_transient_timeout_' . $safe_transient; $transient_timeout = '_transient_timeout_' . $transient;
if ( get_option( $transient_timeout ) < time() ) { if ( get_option( $transient_timeout ) < time() ) {
delete_option( $transient_option ); delete_option( $transient_option );
delete_option( $transient_timeout ); delete_option( $transient_timeout );
@ -746,8 +740,8 @@ function get_transient( $transient ) {
* transient value to be stored. * transient value to be stored.
* @uses do_action() Calls 'set_transient_$transient' and 'setted_transient' hooks on success. * @uses do_action() Calls 'set_transient_$transient' and 'setted_transient' hooks on success.
* *
* @param string $transient Transient name. Expected to not be SQL-escaped * @param string $transient Transient name. Expected to not be SQL-escaped.
* @param mixed $value Transient value. * @param mixed $value Transient value. Expected to not be SQL-escaped.
* @param int $expiration Time until expiration in seconds, default 0 * @param int $expiration Time until expiration in seconds, default 0
* @return bool False if value was not set and true if value was set. * @return bool False if value was not set and true if value was set.
*/ */
@ -761,8 +755,7 @@ function set_transient( $transient, $value, $expiration = 0 ) {
} else { } else {
$transient_timeout = '_transient_timeout_' . $transient; $transient_timeout = '_transient_timeout_' . $transient;
$transient = '_transient_' . $transient; $transient = '_transient_' . $transient;
$safe_transient = esc_sql( $transient ); if ( false === get_option( $transient ) ) {
if ( false === get_option( $safe_transient ) ) {
$autoload = 'yes'; $autoload = 'yes';
if ( $expiration ) { if ( $expiration ) {
$autoload = 'no'; $autoload = 'no';
@ -1000,10 +993,7 @@ function delete_all_user_settings() {
* @return mixed A scalar data * @return mixed A scalar data
*/ */
function maybe_serialize( $data ) { function maybe_serialize( $data ) {
if ( is_array( $data ) || is_object( $data ) ) if ( !is_scalar( $data ) )
return serialize( $data );
if ( is_serialized( $data ) )
return serialize( $data ); return serialize( $data );
return $data; return $data;
@ -3384,7 +3374,7 @@ function wp_suspend_cache_invalidation($suspend = true) {
* @uses apply_filters() Calls 'site_option_$option', after checking the option, with * @uses apply_filters() Calls 'site_option_$option', after checking the option, with
* the option value. * the option value.
* *
* @param string $option Name of option to retrieve. Should already be SQL-escaped * @param string $option Name of option to retrieve. Expected to not be SQL-escaped.
* @param mixed $default Optional value to return if option doesn't exist. Default false. * @param mixed $default Optional value to return if option doesn't exist. Default false.
* @param bool $use_cache Whether to use cache. Multisite only. Default true. * @param bool $use_cache Whether to use cache. Multisite only. Default true.
* @return mixed Value set for the option. * @return mixed Value set for the option.
@ -3431,8 +3421,8 @@ function get_site_option( $option, $default = false, $use_cache = true ) {
* option value to be stored. * option value to be stored.
* @uses do_action() Calls 'add_site_option_$option' and 'add_site_option' hooks on success. * @uses do_action() Calls 'add_site_option_$option' and 'add_site_option' hooks on success.
* *
* @param string $option Name of option to add. Expects to not be SQL escaped. * @param string $option Name of option to add. Expected to not be SQL-escaped.
* @param mixed $value Optional. Option value, can be anything. * @param mixed $value Optional. Option value, can be anything. Expected to not be SQL-escaped.
* @return bool False if option was not added and true if option was added. * @return bool False if option was not added and true if option was added.
*/ */
function add_site_option( $option, $value ) { function add_site_option( $option, $value ) {
@ -3475,7 +3465,7 @@ function add_site_option( $option, $value ) {
* @uses do_action() Calls 'delete_site_option' and 'delete_site_option_$option' * @uses do_action() Calls 'delete_site_option' and 'delete_site_option_$option'
* hooks on success. * hooks on success.
* *
* @param string $option Name of option to remove. Expected to be SQL-escaped. * @param string $option Name of option to remove. Expected to not be SQL-escaped.
* @return bool True, if succeed. False, if failure. * @return bool True, if succeed. False, if failure.
*/ */
function delete_site_option( $option ) { function delete_site_option( $option ) {
@ -3517,8 +3507,8 @@ function delete_site_option( $option ) {
* option value to be stored. * option value to be stored.
* @uses do_action() Calls 'update_site_option_$option' and 'update_site_option' hooks on success. * @uses do_action() Calls 'update_site_option_$option' and 'update_site_option' hooks on success.
* *
* @param string $option Name of option. Expected to not be SQL-escaped * @param string $option Name of option. Expected to not be SQL-escaped.
* @param mixed $value Option value. * @param mixed $value Option value. Expected to not be SQL-escaped.
* @return bool False if value was not updated and true if value was updated. * @return bool False if value was not updated and true if value was updated.
*/ */
function update_site_option( $option, $value ) { function update_site_option( $option, $value ) {
@ -3564,7 +3554,7 @@ function update_site_option( $option, $value ) {
* @uses do_action() Calls 'delete_site_transient_$transient' hook before transient is deleted. * @uses do_action() Calls 'delete_site_transient_$transient' hook before transient is deleted.
* @uses do_action() Calls 'deleted_site_transient' hook on success. * @uses do_action() Calls 'deleted_site_transient' hook on success.
* *
* @param string $transient Transient name. Expected to not be SQL-escaped * @param string $transient Transient name. Expected to not be SQL-escaped.
* @return bool True if successful, false otherwise * @return bool True if successful, false otherwise
*/ */
function delete_site_transient( $transient ) { function delete_site_transient( $transient ) {
@ -3574,7 +3564,7 @@ function delete_site_transient( $transient ) {
if ( $_wp_using_ext_object_cache ) { if ( $_wp_using_ext_object_cache ) {
$result = wp_cache_delete( $transient, 'site-transient' ); $result = wp_cache_delete( $transient, 'site-transient' );
} else { } else {
$option = '_site_transient_' . esc_sql( $transient ); $option = '_site_transient_' . $transient;
$result = delete_site_option( $option ); $result = delete_site_option( $option );
} }
if ( $result ) if ( $result )
@ -3599,7 +3589,7 @@ function delete_site_transient( $transient ) {
* @uses apply_filters() Calls 'site_transient_$option' hook, after checking the transient, with * @uses apply_filters() Calls 'site_transient_$option' hook, after checking the transient, with
* the transient value. * the transient value.
* *
* @param string $transient Transient name. Expected to not be SQL-escaped * @param string $transient Transient name. Expected to not be SQL-escaped.
* @return mixed Value of transient * @return mixed Value of transient
*/ */
function get_site_transient( $transient ) { function get_site_transient( $transient ) {
@ -3614,9 +3604,9 @@ function get_site_transient( $transient ) {
} else { } else {
// Core transients that do not have a timeout. Listed here so querying timeouts can be avoided. // Core transients that do not have a timeout. Listed here so querying timeouts can be avoided.
$no_timeout = array('update_core', 'update_plugins', 'update_themes'); $no_timeout = array('update_core', 'update_plugins', 'update_themes');
$transient_option = '_site_transient_' . esc_sql( $transient ); $transient_option = '_site_transient_' . $transient;
if ( ! in_array( $transient, $no_timeout ) ) { if ( ! in_array( $transient, $no_timeout ) ) {
$transient_timeout = '_site_transient_timeout_' . esc_sql( $transient ); $transient_timeout = '_site_transient_timeout_' . $transient;
$timeout = get_site_option( $transient_timeout ); $timeout = get_site_option( $transient_timeout );
if ( false !== $timeout && $timeout < time() ) { if ( false !== $timeout && $timeout < time() ) {
delete_site_option( $transient_option ); delete_site_option( $transient_option );
@ -3646,8 +3636,8 @@ function get_site_transient( $transient ) {
* transient value to be stored. * transient value to be stored.
* @uses do_action() Calls 'set_site_transient_$transient' and 'setted_site_transient' hooks on success. * @uses do_action() Calls 'set_site_transient_$transient' and 'setted_site_transient' hooks on success.
* *
* @param string $transient Transient name. Expected to not be SQL-escaped * @param string $transient Transient name. Expected to not be SQL-escaped.
* @param mixed $value Transient value. * @param mixed $value Transient value. Expected to not be SQL-escaped.
* @param int $expiration Time until expiration in seconds, default 0 * @param int $expiration Time until expiration in seconds, default 0
* @return bool False if value was not set and true if value was set. * @return bool False if value was not set and true if value was set.
*/ */
@ -3661,8 +3651,7 @@ function set_site_transient( $transient, $value, $expiration = 0 ) {
} else { } else {
$transient_timeout = '_site_transient_timeout_' . $transient; $transient_timeout = '_site_transient_timeout_' . $transient;
$transient = '_site_transient_' . $transient; $transient = '_site_transient_' . $transient;
$safe_transient = esc_sql( $transient ); if ( false === get_site_option( $transient ) ) {
if ( false === get_site_option( $safe_transient ) ) {
if ( $expiration ) if ( $expiration )
add_site_option( $transient_timeout, time() + $expiration ); add_site_option( $transient_timeout, time() + $expiration );
$result = add_site_option( $transient, $value ); $result = add_site_option( $transient, $value );

2
wp-includes/theme.php
View File

@ -1200,7 +1200,7 @@ function validate_current_theme() {
function get_theme_mod($name, $default = false) { function get_theme_mod($name, $default = false) {
$theme = get_current_theme(); $theme = get_current_theme();
$mods = get_option( esc_sql( "mods_$theme" ) ); $mods = get_option( "mods_$theme" );
if ( isset($mods[$name]) ) if ( isset($mods[$name]) )
return apply_filters( "theme_mod_$name", $mods[$name] ); return apply_filters( "theme_mod_$name", $mods[$name] );