From bc877b4aa218c2b10a3cd39253852a0c5052bd83 Mon Sep 17 00:00:00 2001 From: ryan Date: Thu, 1 Jun 2006 23:38:34 +0000 Subject: [PATCH] Strip extra slashes from _POST when doing nonce AYS. Props MarkJaquith and mdawaffe. fixes #2761 git-svn-id: http://svn.automattic.com/wordpress/trunk@3833 1a063a9b-81f0-0310-95a4-ce76da25c4cd --- wp-includes/pluggable-functions.php | 2 ++ 1 file changed, 2 insertions(+) diff --git a/wp-includes/pluggable-functions.php b/wp-includes/pluggable-functions.php index b6dde6c1e7..97d9339a4a 100644 --- a/wp-includes/pluggable-functions.php +++ b/wp-includes/pluggable-functions.php @@ -238,6 +238,8 @@ function check_admin_referer($action = -1) { $adminurl = $referer; $title = __('WordPress Confirmation'); require_once(ABSPATH . '/wp-admin/admin-header.php'); + // Remove extra layer of slashes. + $_POST = stripslashes_deep($_POST ); if ( $_POST ) { $q = http_build_query($_POST); $q = explode( ini_get('arg_separator.output'), $q);