Ticket #2591: TAKE_5.diff

wp-includes/post.php

@@ -229 +229 @@
-                }
-        }
-
-
-
-
+
-
+        $value = prepare_data($value);
+        $value = $wpdb->escape($value);
+
-        $wpdb->query("INSERT INTO $wpdb->postmeta (post_id,meta_key,meta_value) VALUES ('$post_id','$key','$value')");
-
-        $post_meta_cache[$post_id][$key][] = $original;
-
-        return true;
-}
-
@@ -311 +310 @@
-        $post_id = (int) $post_id;
-
-        $original_value = $value;
-if ( is_array($value) || is_object($value) )
-       $value = $wpdb->escape(serialize($value)
+$value = prepare_data($value);
+$value = $wpdb->escape($value
-
-        $original_prev = $prev_value;
-if ( is_array($prev_value) || is_object($prev_value) )
-       $prev_value = $wpdb->escape(serialize($prev_value)
+$prev_value = prepare_data($prev_value);
+$prev_value = $wpdb->escape($prev_value
-
-        if (! $wpdb->get_var("SELECT meta_key FROM $wpdb->postmeta WHERE meta_key = '$key' AND post_id = '$post_id'") ) {
-                return false;

wp-includes/pluggable.php

@@ -78 +78 @@
-
-        if ($metavalues) {
-                foreach ( $metavalues as $meta ) {
-
-
-
+
-                        $user->{$meta->meta_key} = $value;
-
-                        // We need to set user_level from meta, not row
@@ -131 +129 @@
-
-        if ($metavalues) {
-                foreach ( $metavalues as $meta ) {
-
-
-
+
-                        $user->{$meta->meta_key} = $value;
-
-                        // We need to set user_level from meta, not row

wp-includes/functions.php

@@ -156 +156 @@
-}
-
-function maybe_unserialize($original) {
-false !== $gm = @ unserialize($original) )
-return $gm;
-else
-       
+is_serialized($original) ) // don't attempt to unserialize data that wasn't serialized going in
+if ( false !== $gm = @ unserialize($original) )
+               return $gm;
+
-}
-
+function is_serialized($data) {
+        if ( !is_string($data) ) // if it isn't a string, it isn't serialized
+                return false;
+        $data = trim($data);
+        if ( preg_match("/^[adobis]:[0-9]+:.*[;}]/si",$data) ) // this should fetch all legitimately serialized data
+                return true;
+        return false;
+}
+
+function is_serialized_string($data) {
+        if ( !is_string($data) ) // if it isn't a string, it isn't a serialized string
+                return false;
+        $data = trim($data);
+        if ( preg_match("/^s:[0-9]+:.*[;}]/si",$data) ) // this should fetch all serialized strings
+                return true;
+        return false;
+}
+
-/* Options functions */
-
-function get_option($setting) {
@@ -239 +257 @@
-        }
-
-        $_newvalue = $newvalue;
-
-
+
-
-        wp_cache_set($option_name, $newvalue, 'options');
-
@@ -262 +279 @@
-        if ( false !== get_option($name) )
-                return;
-
-
-
+
-
-        wp_cache_set($name, $value, 'options');
-
@@ -285 +301 @@
-        return true;
-}
-
+function prepare_data($data) {
+        if ( is_string($data) )
+                $data = trim($data);
+        elseif ( is_array($data) || is_object($data) )
+                return serialize($data);
+        if ( is_serialized($data) )
+                return serialize($data);
+        return $data;
+}
+
-function gzip_compression() {
-        if ( !get_option('gzipcompression') ) return false;
-

wp-includes/user.php

@@ -114 +114 @@
-                return false;
-        $meta_key = preg_replace('|[^a-z0-9_]|i', '', $meta_key);
-
-
-
-
+
+
+
+
-
-        if (empty($meta_value)) {
-                return delete_usermeta($user_id, $meta_key);

wp-admin/wp-admin.css

@@ -445 +445 @@
-        width: 250px;
-}
-
+input.disabled, textarea.disabled {
+        background: #ccc;
+}
+
-#adminmenu {
-        background: #83B4D8;
-        border-top: 3px solid #448abd;

wp-admin/admin-functions.php

@@ -981 +981 @@
-                        $style = '';
-                if ('_' == $entry['meta_key'] { 0 })
-                        $style .= ' hidden';
+
+                if ( is_serialized($entry['meta_value']) ) {
+                        if ( 's' == $entry['meta_value']{0} ) {
+                                // this is a serialized string, so we should display it
+                                $entry['meta_value'] = maybe_unserialize($entry['meta_value']);
+                        } else {
+                                // this is a serialized array/object so we should NOT display it
+                                --$count;
+                                continue;
+                        }
+                }
+
-                $key_js = js_escape($entry['meta_key']);
-                $entry['meta_key'] = wp_specialchars( $entry['meta_key'], true );
-                $entry['meta_value'] = wp_specialchars( $entry['meta_value'], true );
@@ -1056 +1068 @@
-
-        $metakeyselect = $wpdb->escape(stripslashes(trim($_POST['metakeyselect'])));
-        $metakeyinput = $wpdb->escape(stripslashes(trim($_POST['metakeyinput'])));
-
+
+
-
-        if ( ('0' === $metavalue || !empty ($metavalue)) && ((('#NONE#' != $metakeyselect) && !empty ($metakeyselect)) || !empty ($metakeyinput)) ) {
-                // We have a key/value pair. If both the select and the 
@@ -1087 +1100 @@
-
-function update_meta($mid, $mkey, $mvalue) {
-        global $wpdb;
+        if ( is_serialized(stripslashes($mvalue)) ) // $mvalue looks to be already serialized, so we should serialize it again to prevent the data from coming out in a different form than it came in
+                $mvalue = serialize($mvalue);
-        $mid = (int) $mid;
-
-        return $wpdb->query("UPDATE $wpdb->postmeta SET meta_key = '$mkey', meta_value = '$mvalue' WHERE meta_id = '$mid'");
-}
-

wp-admin/options.php

@@ -124 +124 @@
-  <table width="98%">
-<?php
-$options = $wpdb->get_results("SELECT * FROM $wpdb->options ORDER BY option_name");
-foreach ( (array) $options as $option )
-        $options_to_update[] = $option->option_name;
-$options_to_update = implode(',', $options_to_update);
-?>
-
-<input type="hidden" name="page_options" value="<?php echo $options_to_update; ?>" /> 
-
-<?php
-foreach ( (array) $options as $option) :
-
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-        echo "
-<tr>
-        <th scope='row'><label for='$option->option_name'>$option->option_name</label></th>
-<td>";
-
-all-option
-all-options' type='text' name='$option->option_name' id='$option->option_name' size='30' value='" . $value . "'
+$clas
+$class' type='text' name='$option->option_name' id='$option->option_name' size='30' value='" . $value . "'$disabled
-        
-        echo "</td>
-        <td>$option->option_description</td>
@@ -148 +157 @@
-endforeach;
-?>
-  </table>
-
+
+
-  </form>
-</div>
-