Ticket #2591: serialization.diff

wp-includes/functions.php

@@ -261 +261 @@
-        return 0;
-}
-
-
+
-function maybe_unserialize($original) {
-        if ( false !== $gm = @ unserialize($original) )
-                return $gm;
-        else
-                return $original;
-}
+*/
-
+function maybe_unserialize($original) {
+        if ( is_serialized($original) )
+                if ( false !== $gm = @ unserialize($original) )
+                        return $gm;
+        return $original;
+}
+
+function is_serialized($data) {
+        if ( !is_string($data) ) {
+                // if it isn't a string, it isn't serialized
+                return false;
+        }
+        $data = trim($data);
+        if ( preg_match("/^(a|d|o|b|i|s):[0-9]+:(.*)[;}]/si",$data) )
+                return true;
+        return false;
+}
+
+function throw_serialization_error($data) {
+        die(__('<strong>Error:</strong> serialized data was detected!'));
+}
+
-/* Options functions */
-
-function get_settings($setting) {
@@ -348 +371 @@
-        return apply_filters('all_options', $all_options);
-}
-
-
+, $accept_serialized=false
-        global $wpdb;
-
-        if ( is_string($newvalue) )
@@ -365 +388 @@
-                return true;
-        }
-
-
-
+
-
-        wp_cache_set($option_name, $newvalue, 'options');
-
@@ -395 +417 @@
-        if ( false !== get_option($name) )
-                return;
-
-
-
+
-
-        wp_cache_set($name, $value, 'options');
-
@@ -418 +439 @@
-        return true;
-}
-
+function prepare_data($data, $accept_serialized=false) {
+        if ( is_string($data) )
+                $data = trim($data);
+        elseif ( is_array($data) || is_object($data) )
+                return serialize($data);
+        if ( !$accept_serialized && is_serialized($data) )
+                throw_serialization_error($data);
+        return $data;
+}
+
-function add_post_meta($post_id, $key, $value, $unique = false) {
-        global $wpdb, $post_meta_cache;
-
@@ -431 +462 @@
-        $original = $value;
-        if ( is_array($value) || is_object($value) )
-                $value = $wpdb->escape(serialize($value));
+        else
+                $value = prepare_data($value);
-
-        $wpdb->query("INSERT INTO $wpdb->postmeta (post_id,meta_key,meta_value) VALUES ('$post_id','$key','$value')");
-
@@ -510 +543 @@
-        $original_value = $value;
-        if ( is_array($value) || is_object($value) )
-                $value = $wpdb->escape(serialize($value));
+        else
+                $value = prepare_data($value);
-
-        $original_prev = $prev_value;
-        if ( is_array($prev_value) || is_object($prev_value) )
@@ -2165 +2200 @@
-                return false;
-        $meta_key = preg_replace('|[^a-z0-9_]|i', '', $meta_key);
-
-
-
-
+
-
-        if (empty($meta_value)) {
-                delete_usermeta($user_id, $meta_key);
@@ -2197 +2230 @@
-                return false;
-        $meta_key = preg_replace('|[^a-z0-9_]|i', '', $meta_key);
-
-
-
-
+
-
-        if ( ! empty($meta_value) )
-                $wpdb->query("DELETE FROM $wpdb->usermeta WHERE user_id = '$user_id' AND meta_key = '$meta_key' AND meta_value = '$meta_value'");

wp-admin/admin-functions.php

@@ -226 +226 @@
-        // Meta Stuff
-        if ($_POST['meta']) {
-                foreach ($_POST['meta'] as $key => $value)
-
+
+
-        }
-
-        if ($_POST['deletemeta']) {
@@ -849 +850 @@
-                        $style = '';
-                if ('_' == $entry['meta_key'] { 0 })
-                        $style .= ' hidden';
+                if ( is_serialized($entry['meta_value']) ) {
+                        -- $count;
+                        continue;
+                }
-                echo "
-                        <tr class='$style'>
-                                <td valign='top'><input name='meta[{$entry['meta_id']}][key]' tabindex='6' type='text' size='20' value='{$entry['meta_key']}' /></td>
@@ -920 +925 @@
-
-        $metakeyselect = $wpdb->escape(stripslashes(trim($_POST['metakeyselect'])));
-        $metakeyinput = $wpdb->escape(stripslashes(trim($_POST['metakeyinput'])));
-
+
+
+
+
-
-        if ( ('0' === $metavalue || !empty ($metavalue)) && ((('#NONE#' != $metakeyselect) && !empty ($metakeyselect)) || !empty ($metakeyinput)) ) {
-                // We have a key/value pair. If both the select and the 
@@ -948 +956 @@
-
-function update_meta($mid, $mkey, $mvalue) {
-        global $wpdb;
-
+
+
-        return $wpdb->query("UPDATE $wpdb->postmeta SET meta_key = '$mkey', meta_value = '$mvalue' WHERE meta_id = '$mid'");
-}
-

wp-admin/options.php

@@ -33 +33 @@
-
-        if (!$_POST['page_options']) {
-                foreach ($_POST as $key => $value) {
-
+
+
-                }
-        } else {
-                $options = explode(',', stripslashes($_POST['page_options']));
@@ -95 +96 @@
-$options = $wpdb->get_results("SELECT * FROM $wpdb->options ORDER BY option_name");
-
-foreach ($options as $option) :
-
+
+
+
+
+
+
+
-        echo "
-<tr>
-        <th scope='row'><label for='$option->option_name'>$option->option_name</label></th>
-
+$disabled
-        <td>$option->option_description</td>
-</tr>";
-endforeach;