HostForge-Systems/wordpress
Template
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Coding Standards: Sanitize input values in wp-trackback.php.

Browse Source 
Follow-up to [4676], [12284], [23594], [53719].

Props utsav72640, mukesh27, ankitmaru, dhruvang21, SergeyBiryukov.
Fixes #58511.
Built from https://develop.svn.wordpress.org/trunk@60646


git-svn-id: http://core.svn.wordpress.org/trunk@59982 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This commit is contained in:
Sergey Biryukov
2025-08-19 12:30:31 +00:00
parent 304382e37d
commit 69f8f6ecf6
2 changed files with 6 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
wp-includes/version.php
View File

@@ -16,7 +16,7 @@
* *
* @global string $wp_version * @global string $wp_version
*/ */
$wp_version = '6.9-alpha-60645'; $wp_version = '6.9-alpha-60646';
/** /**
* Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema. * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.

10
wp-trackback.php
View File

@@ -50,13 +50,13 @@ if ( ! isset( $_GET['tb_id'] ) || ! $_GET['tb_id'] ) {
$post_id = (int) $post_id[ count( $post_id ) - 1 ]; $post_id = (int) $post_id[ count( $post_id ) - 1 ];
} }
$trackback_url = isset( $_POST['url'] ) ? $_POST['url'] : ''; $trackback_url = isset( $_POST['url'] ) ? sanitize_url( $_POST['url'] ) : '';
$charset = isset( $_POST['charset'] ) ? $_POST['charset'] : ''; $charset = isset( $_POST['charset'] ) ? sanitize_text_field( $_POST['charset'] ) : '';
// These three are stripslashed here so they can be properly escaped after mb_convert_encoding(). // These three are stripslashed here so they can be properly escaped after mb_convert_encoding().
$title = isset( $_POST['title'] ) ? wp_unslash( $_POST['title'] ) : ''; $title = isset( $_POST['title'] ) ? sanitize_text_field( wp_unslash( $_POST['title'] ) ) : '';
$excerpt = isset( $_POST['excerpt'] ) ? wp_unslash( $_POST['excerpt'] ) : ''; $excerpt = isset( $_POST['excerpt'] ) ? sanitize_textarea_field( wp_unslash( $_POST['excerpt'] ) ) : '';
$blog_name = isset( $_POST['blog_name'] ) ? wp_unslash( $_POST['blog_name'] ) : ''; $blog_name = isset( $_POST['blog_name'] ) ? sanitize_text_field( wp_unslash( $_POST['blog_name'] ) ) : '';
if ( $charset ) { if ( $charset ) {
$charset = str_replace( array( ',', ' ' ), '', strtoupper( trim( $charset ) ) ); $charset = str_replace( array( ',', ' ' ), '', strtoupper( trim( $charset ) ) );