From f4c9c9ce0de2fb1e8f2e2266fc5f3562cc93897b Mon Sep 17 00:00:00 2001 From: Andrew Nacin Date: Fri, 14 Sep 2012 19:32:53 +0000 Subject: [PATCH] Use the non-slashing variants of kses functions in sanitize_option() to avoid slash ping pong. fixes #21892. git-svn-id: http://core.svn.wordpress.org/trunk@21850 1a063a9b-81f0-0310-95a4-ce76da25c4cd --- wp-includes/formatting.php | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) diff --git a/wp-includes/formatting.php b/wp-includes/formatting.php index 6d78eddeb7..43c5ad00af 100644 --- a/wp-includes/formatting.php +++ b/wp-includes/formatting.php @@ -2789,9 +2789,7 @@ function sanitize_option($option, $value) { case 'blogdescription': case 'blogname': - $value = addslashes($value); - $value = wp_filter_post_kses( $value ); // calls stripslashes then addslashes - $value = stripslashes($value); + $value = wp_kses_post( $value ); $value = esc_html( $value ); break; @@ -2807,9 +2805,7 @@ function sanitize_option($option, $value) { case 'ping_sites': case 'upload_path': $value = strip_tags($value); - $value = addslashes($value); - $value = wp_filter_kses($value); // calls stripslashes then addslashes - $value = stripslashes($value); + $value = wp_kses_data($value); break; case 'gmt_offset':