The exceptions to this are update_post_meta() and add_post_meta() which are often used by plugins in POST handlers and will continue accepting slashed data for now.
Introduce wp_upate_post_meta() and wp_add_post_meta() as unslashed alternatives to update_post_meta() and add_post_meta(). These functions could become methods in WP_Post so don't use them too heavily yet.
Remove all escape() calls from wp_xmlrpc_server. Now that core expects unslashed data this is no longer needed.
Remove addslashes(), addslashes_gpc(), add_magic_quotes() calls on data being prepared for handoff to core functions that until now expected slashed data. Adding slashes in no longer necessary.
Introduce wp_unslash() and use to it remove slashes from GPCS data before using it in core API. Almost every instance of stripslashes() in core should now be wp_unslash(). In the future (a release or three) when GPCS is no longer slashed, wp_unslash() will stop stripping slashes and simply return what is passed. At this point wp_unslash() calls can be removed from core.
Introduce wp_slash() for slashing GPCS data. This will also turn into a noop once GPCS is no longer slashed. wp_slash() should almost never be used. It is mainly of use in unit tests.
Plugins should use wp_unslash() on data being passed to core API.
Plugins should no longer slash data being passed to core. So when you get_post() and then wp_insert_post() the post data from get_post() no longer needs addslashes(). Most plugins were not bothering with this. They will magically start doing the right thing. Unfortunately, those few souls who did it properly will now have to avoid calling addslashes() for 3.6 and newer.
Use wp_kses_post() and wp_kses_data(), which expect unslashed data, instead of wp_filter_post_kses() and wp_filter_kses(), which expect slashed data. Filters are no longer passed slashed data.
Remove many no longer necessary calls to $wpdb->escape() and esc_sql().
In wp_get_referer() and wp_get_original_referer(), return unslashed data.
Remove old stripslashes() calls from WP_Widget::update() handlers. These haven't been necessary since WP_Widget.
Switch several queries over to prepare().
Expect something to break.
Props alexkingorg
see #21767
git-svn-id: http://core.svn.wordpress.org/trunk@23416 1a063a9b-81f0-0310-95a4-ce76da25c4cd
In get_post_type_capabilities(), make sure create_posts reflects customizations to the edit_posts capability when create_posts is not specifically set.
git-svn-id: http://core.svn.wordpress.org/trunk@22291 1a063a9b-81f0-0310-95a4-ce76da25c4cd
Declare the core properties of WP_Pist as proper public properties and provide them with defaults.
Props wonderboymusic
fixes#22223
git-svn-id: http://core.svn.wordpress.org/trunk@22264 1a063a9b-81f0-0310-95a4-ce76da25c4cd
We need to remove post_ancestors non-persistent caching for this. get_post_ancestors() can simply rely on the caching of get_post() instead. Previously, it was a direct query, hence the extra layers of caching and clearing.
Child cache clearing stays in wp_delete_post() as children get a new parent.
fixes#11399.
git-svn-id: http://core.svn.wordpress.org/trunk@21952 1a063a9b-81f0-0310-95a4-ce76da25c4cd
* Attachments now go through post.php, edit_post(), the like, and have show_ui set to true.
* Taxonomies attached to the media library now appear in the admin menu (if show_ui).
* Editing, cropping, uploading, etc. is still very rough, but mostly functional.
API-wise:
* New function: get_taxonomies_for_attachments(). Like get_taxonomies(), for taxonomies specifically registered against attachments.
* Brings taxonomy support from the posts list table to the media list table. Expect them to converge soon.
* wp_insert_attachment() now handles taxonomies like wp_insert_post(). Also expect them to converge soon.
* New edit_form_after_title hook.
props helenyhou, ocean90. see #21391.
git-svn-id: http://core.svn.wordpress.org/trunk@21948 1a063a9b-81f0-0310-95a4-ce76da25c4cd
* Introduce a wp_checkdate() function with a single filter to centralise the code that validates dates.
* Improve the error message
* Correctly handle the return value of wp_insert_post which is not always a WP_Error on failure
Fixes#17180
git-svn-id: http://core.svn.wordpress.org/trunk@21922 1a063a9b-81f0-0310-95a4-ce76da25c4cd
Previously you could quite easily send a new post into the back of beyond by specifying an invalid date like the 30th Feb and this was very confusing.
Sometimes it would seem to work and sometimes the post would end up very far in the past - depending on the mysql version and other factors.
Fixes#17180 props jkudish.
git-svn-id: http://core.svn.wordpress.org/trunk@21921 1a063a9b-81f0-0310-95a4-ce76da25c4cd
An empty array may also disable all default features in the future.
Do not rely on this behavior: always specify title and editor if you want them.
props sc0ttkclark.
fixes#21586.
git-svn-id: http://core.svn.wordpress.org/trunk@21831 1a063a9b-81f0-0310-95a4-ce76da25c4cd
