From 60a9f413150bf4488249a0111abe36a617a4a25c Mon Sep 17 00:00:00 2001 From: Boone Gorges Date: Tue, 19 Jan 2016 04:10:25 +0000 Subject: [PATCH] Don't double-escape the 'name' param in `get_terms()`. [32353] changed the way the 'name' param in `get_terms()` is sanitized, by running it through `sanitize_term_field( 'name' )` before performing the SQL query. An unintentional side effect of this change was that the string is double-escaped: once by `wp_filter_kses()`, and once by `esc_sql()`. The double-escaping was causing 'name' queries to fail when the param contained apostrophes or other escaped characters. Fixes #35493. Built from https://develop.svn.wordpress.org/trunk@36348 git-svn-id: http://core.svn.wordpress.org/trunk@36315 1a063a9b-81f0-0310-95a4-ce76da25c4cd --- wp-includes/taxonomy.php | 3 ++- wp-includes/version.php | 2 +- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/wp-includes/taxonomy.php b/wp-includes/taxonomy.php index 1f51ff9cd2..39b5b00423 100644 --- a/wp-includes/taxonomy.php +++ b/wp-includes/taxonomy.php @@ -1354,7 +1354,8 @@ function get_terms( $taxonomies, $args = '' ) { if ( ! empty( $args['name'] ) ) { $names = (array) $args['name']; foreach ( $names as &$_name ) { - $_name = sanitize_term_field( 'name', $_name, 0, reset( $taxonomies ), 'db' ); + // `sanitize_term_field()` returns slashed data. + $_name = stripslashes( sanitize_term_field( 'name', $_name, 0, reset( $taxonomies ), 'db' ) ); } $where .= " AND t.name IN ('" . implode( "', '", array_map( 'esc_sql', $names ) ) . "')"; diff --git a/wp-includes/version.php b/wp-includes/version.php index db10bb14bd..442363c8c2 100644 --- a/wp-includes/version.php +++ b/wp-includes/version.php @@ -4,7 +4,7 @@ * * @global string $wp_version */ -$wp_version = '4.5-alpha-1453175773216'; +$wp_version = '4.5-alpha-1453176612026'; /** * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.