Upstream/WordPress
1
0
Fork 0
mirror of https://github.com/WordPress/WordPress.git synced 2025-12-05 11:24:25 +01:00
Code Issues Projects Releases Wiki Activity

Coding Standards: Sanitize input values in wp-trackback.php.

Browse Source 
Follow-up to [4676], [12284], [23594], [53719].

Props utsav72640, mukesh27, ankitmaru, dhruvang21, SergeyBiryukov.
Fixes #58511.
Built from https://develop.svn.wordpress.org/trunk@60646


git-svn-id: http://core.svn.wordpress.org/trunk@59982 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This commit is contained in:
Sergey Biryukov 2025-08-19 12:30:31 +00:00
parent 304382e37d
commit 69f8f6ecf6
2 changed files with 6 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
wp-includes/version.php
View File

@ -16,7 +16,7 @@
*
* @global string $wp_version
*/
$wp_version = '6.9-alpha-60645';
$wp_version = '6.9-alpha-60646';
/**
* Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.

10
wp-trackback.php
View File

@ -50,13 +50,13 @@ if ( ! isset( $_GET['tb_id'] ) || ! $_GET['tb_id'] ) {
$post_id = (int) $post_id[ count( $post_id ) - 1 ];
}
$trackback_url = isset( $_POST['url'] ) ? $_POST['url'] : '';
$charset = isset( $_POST['charset'] ) ? $_POST['charset'] : '';
$trackback_url = isset( $_POST['url'] ) ? sanitize_url( $_POST['url'] ) : '';
$charset = isset( $_POST['charset'] ) ? sanitize_text_field( $_POST['charset'] ) : '';
// These three are stripslashed here so they can be properly escaped after mb_convert_encoding().
$title = isset( $_POST['title'] ) ? wp_unslash( $_POST['title'] ) : '';
$excerpt = isset( $_POST['excerpt'] ) ? wp_unslash( $_POST['excerpt'] ) : '';
$blog_name = isset( $_POST['blog_name'] ) ? wp_unslash( $_POST['blog_name'] ) : '';
$title = isset( $_POST['title'] ) ? sanitize_text_field( wp_unslash( $_POST['title'] ) ) : '';
$excerpt = isset( $_POST['excerpt'] ) ? sanitize_textarea_field( wp_unslash( $_POST['excerpt'] ) ) : '';
$blog_name = isset( $_POST['blog_name'] ) ? sanitize_text_field( wp_unslash( $_POST['blog_name'] ) ) : '';
if ( $charset ) {
$charset = str_replace( array( ',', ' ' ), '', strtoupper( trim( $charset ) ) );