Skip to content

Commit

Permalink
Use wp_unslash() instead of stripslashes() and stripslashes_deep(). U…
Browse files Browse the repository at this point in the history 
…se wp_slash() instead of add_magic_quotes().

see #21767


git-svn-id: http://core.svn.wordpress.org/trunk@23563 1a063a9b-81f0-0310-95a4-ce76da25c4cd
  • Loading branch information
Ryan Boren committed Mar 1, 2013
1 parent 0f3a60a commit 5f809d1
Show file tree
Hide file tree
Showing 28 changed files with 88 additions and 88 deletions.
4 changes: 2 additions & 2 deletions wp-admin/admin.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -43,7 +43,7 @@
do_action('after_db_upgrade');
} elseif ( get_option('db_version') != $wp_db_version && empty($_POST) ) {
if ( !is_multisite() ) {
wp_redirect(admin_url('upgrade.php?_wp_http_referer=' . urlencode(stripslashes($_SERVER['REQUEST_URI']))));
wp_redirect( admin_url( 'upgrade.php?_wp_http_referer=' . urlencode( wp_unslash( $_SERVER['REQUEST_URI'] ) ) ) );
exit;
} elseif ( apply_filters( 'do_mu_upgrade', true ) ) {
/**
Expand Down Expand Up @@ -82,7 +82,7 @@
$editing = false;

if ( isset($_GET['page']) ) {
$plugin_page = stripslashes($_GET['page']);
$plugin_page = wp_unslash( $_GET['page'] );
$plugin_page = plugin_basename($plugin_page);
}

Expand Down
10 changes: 5 additions & 5 deletions wp-admin/edit-comments.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -20,9 +20,9 @@
check_admin_referer( 'bulk-comments' );

if ( 'delete_all' == $doaction && !empty( $_REQUEST['pagegen_timestamp'] ) ) {
$comment_status = $wpdb->escape( $_REQUEST['comment_status'] );
$delete_time = $wpdb->escape( $_REQUEST['pagegen_timestamp'] );
$comment_ids = $wpdb->get_col( "SELECT comment_ID FROM $wpdb->comments WHERE comment_approved = '$comment_status' AND '$delete_time' > comment_date_gmt" );
$comment_status = $_REQUEST['comment_status'];
$delete_time = $_REQUEST['pagegen_timestamp'];
$comment_ids = $wpdb->get_col( $wpdb->prepare( "SELECT comment_ID FROM $wpdb->comments WHERE comment_approved = %s AND %s > comment_date_gmt", $comment_status, $delete_time ) );
$doaction = 'delete';
} elseif ( isset( $_REQUEST['delete_comments'] ) ) {
$comment_ids = $_REQUEST['delete_comments'];
Expand Down Expand Up @@ -95,7 +95,7 @@
wp_safe_redirect( $redirect_to );
exit;
} elseif ( ! empty( $_GET['_wp_http_referer'] ) ) {
wp_redirect( remove_query_arg( array( '_wp_http_referer', '_wpnonce' ), stripslashes( $_SERVER['REQUEST_URI'] ) ) );
wp_redirect( remove_query_arg( array( '_wp_http_referer', '_wpnonce' ), wp_unslash( $_SERVER['REQUEST_URI'] ) ) );
exit;
}

Expand Down Expand Up @@ -153,7 +153,7 @@
echo __('Comments');

if ( isset($_REQUEST['s']) && $_REQUEST['s'] )
printf( '<span class="subtitle">' . sprintf( __( 'Search results for &#8220;%s&#8221;' ), wp_html_excerpt( esc_html( stripslashes( $_REQUEST['s'] ) ), 50 ) ) . '</span>' ); ?>
printf( '<span class="subtitle">' . sprintf( __( 'Search results for &#8220;%s&#8221;' ), wp_html_excerpt( esc_html( wp_unslash( $_REQUEST['s'] ) ), 50 ) ) . '</span>' ); ?>
</h2>

<?php
Expand Down
2 changes: 1 addition & 1 deletion wp-admin/edit-form-advanced.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -314,7 +314,7 @@
<input type="hidden" id="post_author" name="post_author" value="<?php echo esc_attr( $post->post_author ); ?>" />
<input type="hidden" id="post_type" name="post_type" value="<?php echo esc_attr( $post_type ) ?>" />
<input type="hidden" id="original_post_status" name="original_post_status" value="<?php echo esc_attr( $post->post_status) ?>" />
<input type="hidden" id="referredby" name="referredby" value="<?php echo esc_url(stripslashes(wp_get_referer())); ?>" />
<input type="hidden" id="referredby" name="referredby" value="<?php echo esc_url(wp_unslash(wp_get_referer())); ?>" />
<?php if ( ! empty( $active_post_lock ) ) { ?>
<input type="hidden" id="active_post_lock" value="<?php echo esc_attr( implode( ':', $active_post_lock ) ); ?>" />
<?php
Expand Down
2 changes: 1 addition & 1 deletion wp-admin/edit-form-comment.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -132,7 +132,7 @@

<input type="hidden" name="c" value="<?php echo esc_attr($comment->comment_ID) ?>" />
<input type="hidden" name="p" value="<?php echo esc_attr($comment->comment_post_ID) ?>" />
<input name="referredby" type="hidden" id="referredby" value="<?php echo esc_url(stripslashes(wp_get_referer())); ?>" />
<input name="referredby" type="hidden" id="referredby" value="<?php echo esc_url(wp_unslash(wp_get_referer())); ?>" />
<?php wp_original_referer_field(true, 'previous'); ?>
<input type="hidden" name="noredir" value="1" />

Expand Down
4 changes: 2 additions & 2 deletions wp-admin/edit-tags.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -164,7 +164,7 @@

default:
if ( ! empty($_REQUEST['_wp_http_referer']) ) {
$location = remove_query_arg( array('_wp_http_referer', '_wpnonce'), stripslashes($_SERVER['REQUEST_URI']) );
$location = remove_query_arg( array('_wp_http_referer', '_wpnonce'), wp_unslash($_SERVER['REQUEST_URI']) );

if ( ! empty( $_REQUEST['paged'] ) )
$location = add_query_arg( 'paged', (int) $_REQUEST['paged'] );
Expand Down Expand Up @@ -265,7 +265,7 @@
<?php screen_icon(); ?>
<h2><?php echo esc_html( $title );
if ( !empty($_REQUEST['s']) )
printf( '<span class="subtitle">' . __('Search results for &#8220;%s&#8221;') . '</span>', esc_html( stripslashes($_REQUEST['s']) ) ); ?>
printf( '<span class="subtitle">' . __('Search results for &#8220;%s&#8221;') . '</span>', esc_html( wp_unslash($_REQUEST['s']) ) ); ?>
</h2>

<?php if ( isset($_REQUEST['message']) && ( $msg = (int) $_REQUEST['message'] ) ) : ?>
Expand Down
2 changes: 1 addition & 1 deletion wp-admin/edit.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -138,7 +138,7 @@
wp_redirect($sendback);
exit();
} elseif ( ! empty($_REQUEST['_wp_http_referer']) ) {
wp_redirect( remove_query_arg( array('_wp_http_referer', '_wpnonce'), stripslashes($_SERVER['REQUEST_URI']) ) );
wp_redirect( remove_query_arg( array('_wp_http_referer', '_wpnonce'), wp_unslash($_SERVER['REQUEST_URI']) ) );
exit;
}

Expand Down
24 changes: 12 additions & 12 deletions wp-admin/includes/ajax-actions.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -59,7 +59,7 @@ function wp_ajax_ajax_tag_search() {
wp_die( 0 );
}

$s = stripslashes( $_GET['q'] );
$s = wp_unslash( $_GET['q'] );

$comma = _x( ',', 'tag delimiter' );
if ( ',' !== $comma )
Expand Down Expand Up @@ -572,7 +572,7 @@ function wp_ajax_add_link_category( $action ) {
continue;
else if ( is_array( $cat_id ) )
$cat_id = $cat_id['term_id'];
$cat_name = esc_html(stripslashes($cat_name));
$cat_name = esc_html(wp_unslash($cat_name));
$x->add( array(
'what' => 'link-category',
'id' => $cat_id,
Expand Down Expand Up @@ -957,8 +957,8 @@ function wp_ajax_add_meta() {
) );
} else { // Update?
$mid = (int) key( $_POST['meta'] );
$key = stripslashes( $_POST['meta'][$mid]['key'] );
$value = stripslashes( $_POST['meta'][$mid]['value'] );
$key = wp_unslash( $_POST['meta'][$mid]['key'] );
$value = wp_unslash( $_POST['meta'][$mid]['value'] );
if ( '' == trim($key) )
wp_die( __( 'Please provide a custom field name.' ) );
if ( '' == trim($value) )
Expand Down Expand Up @@ -1227,7 +1227,7 @@ function wp_ajax_wp_link_ajax() {
$args = array();

if ( isset( $_POST['search'] ) )
$args['s'] = stripslashes( $_POST['search'] );
$args['s'] = wp_unslash( $_POST['search'] );
$args['pagenum'] = ! empty( $_POST['page'] ) ? absint( $_POST['page'] ) : 1;

require(ABSPATH . WPINC . '/class-wp-editor.php');
Expand Down Expand Up @@ -1328,7 +1328,7 @@ function wp_ajax_inline_save() {
$data = &$_POST;

$post = get_post( $post_ID, ARRAY_A );
$post = add_magic_quotes($post); //since it is from db
$post = wp_slash($post); //since it is from db

$data['content'] = $post['post_content'];
$data['excerpt'] = $post['post_excerpt'];
Expand Down Expand Up @@ -1425,7 +1425,7 @@ function wp_ajax_find_posts() {
$post_types = get_post_types( array( 'public' => true ), 'objects' );
unset( $post_types['attachment'] );

$s = stripslashes( $_POST['ps'] );
$s = wp_unslash( $_POST['ps'] );
$searchand = $search = '';
$args = array(
'post_type' => array_keys( $post_types ),
Expand Down Expand Up @@ -1890,7 +1890,7 @@ function wp_ajax_save_attachment() {

if ( isset( $changes['alt'] ) ) {
$alt = get_post_meta( $id, '_wp_attachment_image_alt', true );
$new_alt = stripslashes( $changes['alt'] );
$new_alt = wp_unslash( $changes['alt'] );
if ( $alt != $new_alt ) {
$new_alt = wp_strip_all_tags( $new_alt, true );
update_post_meta( $id, '_wp_attachment_image_alt', addslashes( $new_alt ) );
Expand Down Expand Up @@ -1990,7 +1990,7 @@ function wp_ajax_save_attachment_order() {
function wp_ajax_send_attachment_to_editor() {
check_ajax_referer( 'media-send-to-editor', 'nonce' );

$attachment = stripslashes_deep( $_POST['attachment'] );
$attachment = wp_unslash( $_POST['attachment'] );

$id = intval( $attachment['id'] );

Expand Down Expand Up @@ -2045,7 +2045,7 @@ function wp_ajax_send_attachment_to_editor() {
function wp_ajax_send_link_to_editor() {
check_ajax_referer( 'media-send-to-editor', 'nonce' );

if ( ! $src = stripslashes( $_POST['src'] ) )
if ( ! $src = wp_unslash( $_POST['src'] ) )
wp_send_json_error();

if ( ! strpos( $src, '://' ) )
Expand All @@ -2054,7 +2054,7 @@ function wp_ajax_send_link_to_editor() {
if ( ! $src = esc_url_raw( $src ) )
wp_send_json_error();

if ( ! $title = trim( stripslashes( $_POST['title'] ) ) )
if ( ! $title = trim( wp_unslash( $_POST['title'] ) ) )
$title = wp_basename( $src );

$html = '';
Expand Down Expand Up @@ -2114,7 +2114,7 @@ function wp_ajax_nopriv_heartbeat() {
$screen_id = 'site';

if ( ! empty($_POST['data']) ) {
$data = stripslashes_deep( (array) $_POST['data'] );
$data = wp_unslash( (array) $_POST['data'] );
$response = apply_filters( 'heartbeat_nopriv_received', $response, $data, $screen_id );
}

Expand Down
8 changes: 4 additions & 4 deletions wp-admin/includes/bookmark.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -55,12 +55,12 @@ function edit_link( $link_id = 0 ) {
function get_default_link_to_edit() {
$link = new stdClass;
if ( isset( $_GET['linkurl'] ) )
$link->link_url = esc_url( $_GET['linkurl'] );
$link->link_url = esc_url( wp_unslash( $_GET['linkurl'] ) );
else
$link->link_url = '';

if ( isset( $_GET['name'] ) )
$link->link_name = esc_attr( $_GET['name'] );
$link->link_name = esc_attr( wp_unslash( $_GET['name'] ) );
else
$link->link_name = '';

Expand Down Expand Up @@ -137,7 +137,7 @@ function wp_insert_link( $linkdata, $wp_error = false ) {
$linkdata = wp_parse_args( $linkdata, $defaults );
$linkdata = sanitize_bookmark( $linkdata, 'db' );

extract( stripslashes_deep( $linkdata ), EXTR_SKIP );
extract( wp_unslash( $linkdata ), EXTR_SKIP );

$update = false;

Expand Down Expand Up @@ -251,7 +251,7 @@ function wp_update_link( $linkdata ) {
$link = get_bookmark( $link_id, ARRAY_A );

// Escape data pulled from DB.
$link = add_magic_quotes( $link );
$link = wp_slash( $link );

// Passed link category list overwrites existing category list if not empty.
if ( isset( $linkdata['link_category'] ) && is_array( $linkdata['link_category'] )
Expand Down
2 changes: 1 addition & 1 deletion wp-admin/includes/class-wp-comments-list-table.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -170,7 +170,7 @@ function get_views() {
/*
// I toyed with this, but decided against it. Leaving it in here in case anyone thinks it is a good idea. ~ Mark
if ( !empty( $_REQUEST['s'] ) )
$link = add_query_arg( 's', esc_attr( stripslashes( $_REQUEST['s'] ) ), $link );
$link = add_query_arg( 's', esc_attr( wp_unslash( $_REQUEST['s'] ) ), $link );
*/
$status_links[$status] = "<a href='$link'$class>" . sprintf(
translate_nooped_plural( $label, $num_comments->$status ),
Expand Down
2 changes: 1 addition & 1 deletion wp-admin/includes/class-wp-ms-sites-list-table.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -29,7 +29,7 @@ function prepare_items() {

$pagenum = $this->get_pagenum();

$s = isset( $_REQUEST['s'] ) ? stripslashes( trim( $_REQUEST[ 's' ] ) ) : '';
$s = isset( $_REQUEST['s'] ) ? wp_unslash( trim( $_REQUEST[ 's' ] ) ) : '';
$wild = '';
if ( false !== strpos($s, '*') ) {
$wild = '%';
Expand Down
2 changes: 1 addition & 1 deletion wp-admin/includes/class-wp-ms-themes-list-table.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -126,7 +126,7 @@ function prepare_items() {
function _search_callback( $theme ) {
static $term;
if ( is_null( $term ) )
$term = stripslashes( $_REQUEST['s'] );
$term = wp_unslash( $_REQUEST['s'] );

foreach ( array( 'Name', 'Description', 'Author', 'Author', 'AuthorURI' ) as $field ) {
// Don't mark up; Do translate.
Expand Down
6 changes: 3 additions & 3 deletions wp-admin/includes/class-wp-ms-users-list-table.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -173,10 +173,10 @@ function display_rows() {

case 'username':
$avatar = get_avatar( $user->user_email, 32 );
$edit_link = esc_url( add_query_arg( 'wp_http_referer', urlencode( stripslashes( $_SERVER['REQUEST_URI'] ) ), get_edit_user_link( $user->ID ) ) );
$edit_link = esc_url( add_query_arg( 'wp_http_referer', urlencode( wp_unslash( $_SERVER['REQUEST_URI'] ) ), get_edit_user_link( $user->ID ) ) );

echo "<td $attributes>"; ?>
<?php echo $avatar; ?><strong><a href="<?php echo $edit_link; ?>" class="edit"><?php echo stripslashes( $user->user_login ); ?></a><?php
<?php echo $avatar; ?><strong><a href="<?php echo $edit_link; ?>" class="edit"><?php echo $user->user_login; ?></a><?php
if ( in_array( $user->user_login, $super_admins ) )
echo ' - ' . __( 'Super Admin' );
?></strong>
Expand All @@ -186,7 +186,7 @@ function display_rows() {
$actions['edit'] = '<a href="' . $edit_link . '">' . __( 'Edit' ) . '</a>';

if ( current_user_can( 'delete_user', $user->ID ) && ! in_array( $user->user_login, $super_admins ) ) {
$actions['delete'] = '<a href="' . $delete = esc_url( network_admin_url( add_query_arg( '_wp_http_referer', urlencode( stripslashes( $_SERVER['REQUEST_URI'] ) ), wp_nonce_url( 'users.php', 'deleteuser' ) . '&amp;action=deleteuser&amp;id=' . $user->ID ) ) ) . '" class="delete">' . __( 'Delete' ) . '</a>';
$actions['delete'] = '<a href="' . $delete = esc_url( network_admin_url( add_query_arg( '_wp_http_referer', urlencode( wp_unslash( $_SERVER['REQUEST_URI'] ) ), wp_nonce_url( 'users.php', 'deleteuser' ) . '&amp;action=deleteuser&amp;id=' . $user->ID ) ) ) . '" class="delete">' . __( 'Delete' ) . '</a>';
}

$actions = apply_filters( 'ms_user_row_actions', $actions, $user );
Expand Down
6 changes: 3 additions & 3 deletions wp-admin/includes/class-wp-plugin-install-list-table.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -48,8 +48,8 @@ function prepare_items() {

switch ( $tab ) {
case 'search':
$type = isset( $_REQUEST['type'] ) ? stripslashes( $_REQUEST['type'] ) : 'term';
$term = isset( $_REQUEST['s'] ) ? stripslashes( $_REQUEST['s'] ) : '';
$type = isset( $_REQUEST['type'] ) ? wp_unslash( $_REQUEST['type'] ) : 'term';
$term = isset( $_REQUEST['s'] ) ? wp_unslash( $_REQUEST['s'] ) : '';

switch ( $type ) {
case 'tag':
Expand All @@ -73,7 +73,7 @@ function prepare_items() {
break;

case 'favorites':
$user = isset( $_GET['user'] ) ? stripslashes( $_GET['user'] ) : get_user_option( 'wporg_favorites' );
$user = isset( $_GET['user'] ) ? wp_unslash( $_GET['user'] ) : get_user_option( 'wporg_favorites' );
update_user_meta( get_current_user_id(), 'wporg_favorites', $user );
if ( $user )
$args['user'] = $user;
Expand Down
4 changes: 2 additions & 2 deletions wp-admin/includes/class-wp-plugins-list-table.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -22,7 +22,7 @@ function __construct( $args = array() ) {
$status = $_REQUEST['plugin_status'];

if ( isset($_REQUEST['s']) )
$_SERVER['REQUEST_URI'] = add_query_arg('s', stripslashes($_REQUEST['s']) );
$_SERVER['REQUEST_URI'] = add_query_arg('s', wp_unslash($_REQUEST['s']) );

$page = $this->get_pagenum();
}
Expand Down Expand Up @@ -140,7 +140,7 @@ function prepare_items() {
function _search_callback( $plugin ) {
static $term;
if ( is_null( $term ) )
$term = stripslashes( $_REQUEST['s'] );
$term = wp_unslash( $_REQUEST['s'] );

foreach ( $plugin as $value )
if ( stripos( $value, $term ) !== false )
Expand Down
6 changes: 3 additions & 3 deletions wp-admin/includes/class-wp-terms-list-table.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -52,7 +52,7 @@ function prepare_items() {
$tags_per_page = apply_filters( 'edit_categories_per_page', $tags_per_page ); // Old filter
}

$search = !empty( $_REQUEST['s'] ) ? trim( stripslashes( $_REQUEST['s'] ) ) : '';
$search = !empty( $_REQUEST['s'] ) ? trim( wp_unslash( $_REQUEST['s'] ) ) : '';

$args = array(
'search' => $search,
Expand All @@ -61,10 +61,10 @@ function prepare_items() {
);

if ( !empty( $_REQUEST['orderby'] ) )
$args['orderby'] = trim( stripslashes( $_REQUEST['orderby'] ) );
$args['orderby'] = trim( wp_unslash( $_REQUEST['orderby'] ) );

if ( !empty( $_REQUEST['order'] ) )
$args['order'] = trim( stripslashes( $_REQUEST['order'] ) );
$args['order'] = trim( wp_unslash( $_REQUEST['order'] ) );

$this->callback_args = $args;

Expand Down
4 changes: 2 additions & 2 deletions wp-admin/includes/class-wp-theme-install-list-table.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -24,7 +24,7 @@ function prepare_items() {
$search_terms = array();
$search_string = '';
if ( ! empty( $_REQUEST['s'] ) ){
$search_string = strtolower( stripslashes( $_REQUEST['s'] ) );
$search_string = strtolower( wp_unslash( $_REQUEST['s'] ) );
$search_terms = array_unique( array_filter( array_map( 'trim', explode( ',', $search_string ) ) ) );
}

Expand Down Expand Up @@ -59,7 +59,7 @@ function prepare_items() {

switch ( $tab ) {
case 'search':
$type = isset( $_REQUEST['type'] ) ? stripslashes( $_REQUEST['type'] ) : 'term';
$type = isset( $_REQUEST['type'] ) ? wp_unslash( $_REQUEST['type'] ) : 'term';
switch ( $type ) {
case 'tag':
$args['tag'] = array_map( 'sanitize_key', $search_terms );
Expand Down
4 changes: 2 additions & 2 deletions wp-admin/includes/class-wp-themes-list-table.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -28,7 +28,7 @@ function prepare_items() {
$themes = wp_get_themes( array( 'allowed' => true ) );

if ( ! empty( $_REQUEST['s'] ) )
$this->search_terms = array_unique( array_filter( array_map( 'trim', explode( ',', strtolower( stripslashes( $_REQUEST['s'] ) ) ) ) ) );
$this->search_terms = array_unique( array_filter( array_map( 'trim', explode( ',', strtolower( wp_unslash( $_REQUEST['s'] ) ) ) ) ) );

if ( ! empty( $_REQUEST['features'] ) )
$this->features = $_REQUEST['features'];
Expand Down Expand Up @@ -235,7 +235,7 @@ function search_theme( $theme ) {
* @uses _pagination_args['total_pages']
*/
function _js_vars( $extra_args = array() ) {
$search_string = isset( $_REQUEST['s'] ) ? esc_attr( stripslashes( $_REQUEST['s'] ) ) : '';
$search_string = isset( $_REQUEST['s'] ) ? esc_attr( wp_unslash( $_REQUEST['s'] ) ) : '';

$args = array(
'search' => $search_string,
Expand Down
2 changes: 1 addition & 1 deletion wp-admin/includes/class-wp-upgrader.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -1427,7 +1427,7 @@ function after() {

$install_actions = array();

$from = isset($_GET['from']) ? stripslashes($_GET['from']) : 'plugins';
$from = isset($_GET['from']) ? wp_unslash( $_GET['from'] ) : 'plugins';

if ( 'import' == $from )
$install_actions['activate_plugin'] = '<a href="' . wp_nonce_url('plugins.php?action=activate&amp;from=import&amp;plugin=' . $plugin_file, 'activate-plugin_' . $plugin_file) . '" title="' . esc_attr__('Activate this plugin') . '" target="_parent">' . __('Activate Plugin &amp; Run Importer') . '</a>';
Expand Down
2 changes: 1 addition & 1 deletion wp-admin/includes/class-wp-users-list-table.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -241,7 +241,7 @@ function single_row( $user_object, $style = '', $role = '', $numposts = 0 ) {
// Check if the user for this row is editable
if ( current_user_can( 'list_users' ) ) {
// Set up the user editing link
$edit_link = esc_url( add_query_arg( 'wp_http_referer', urlencode( stripslashes( $_SERVER['REQUEST_URI'] ) ), get_edit_user_link( $user_object->ID ) ) );
$edit_link = esc_url( add_query_arg( 'wp_http_referer', urlencode( wp_unslash( $_SERVER['REQUEST_URI'] ) ), get_edit_user_link( $user_object->ID ) ) );

// Set up the hover actions for this user
$actions = array();
Expand Down
2 changes: 1 addition & 1 deletion wp-admin/includes/dashboard.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -1093,7 +1093,7 @@ function wp_dashboard_rss_control( $widget_id, $form_inputs = array() ) {
$widget_options[$widget_id]['number'] = $number;

if ( 'POST' == $_SERVER['REQUEST_METHOD'] && isset($_POST['widget-rss'][$number]) ) {
$_POST['widget-rss'][$number] = stripslashes_deep( $_POST['widget-rss'][$number] );
$_POST['widget-rss'][$number] = wp_unslash( $_POST['widget-rss'][$number] );
$widget_options[$widget_id] = wp_widget_rss_process( $_POST['widget-rss'][$number] );
// title is optional. If black, fill it if possible
if ( !$widget_options[$widget_id]['title'] && isset($_POST['widget-rss'][$number]['title']) ) {
Expand Down
Loading

0 comments on commit 5f809d1

Please sign in to comment.