<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" />
<title>[58069] trunk/src/wp-admin: General: Remove any usage of `wp_reset_vars()`.</title>
</head>
<body>
<style type="text/css"><!--
#msg dl.meta { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dl.meta dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer, #logmsg { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; }
#msg dl a { font-weight: bold}
#msg dl a:link { color:#fc3; }
#msg dl a:active { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { white-space: pre-line; overflow: auto; background: #ffc; border: 1px #fa0 solid; padding: 6px; }
#logmsg { background: #ffc; border: 1px #fa0 solid; padding: 1em 1em 0 1em; }
#logmsg p, #logmsg pre, #logmsg blockquote { margin: 0 0 1em 0; }
#logmsg p, #logmsg li, #logmsg dt, #logmsg dd { line-height: 14pt; }
#logmsg h1, #logmsg h2, #logmsg h3, #logmsg h4, #logmsg h5, #logmsg h6 { margin: .5em 0; }
#logmsg h1:first-child, #logmsg h2:first-child, #logmsg h3:first-child, #logmsg h4:first-child, #logmsg h5:first-child, #logmsg h6:first-child { margin-top: 0; }
#logmsg ul, #logmsg ol { padding: 0; list-style-position: inside; margin: 0 0 0 1em; }
#logmsg ul { text-indent: -1em; padding-left: 1em; }#logmsg ol { text-indent: -1.5em; padding-left: 1.5em; }
#logmsg > ul, #logmsg > ol { margin: 0 0 1em 0; }
#logmsg pre { background: #eee; padding: 1em; }
#logmsg blockquote { border: 1px solid #fa0; border-left-width: 10px; padding: 1em 1em 0 1em; background: white;}
#logmsg dl { margin: 0; }
#logmsg dt { font-weight: bold; }
#logmsg dd { margin: 0; padding: 0 0 0.5em 0; }
#logmsg dd:before { content:'\00bb';}
#logmsg table { border-spacing: 0px; border-collapse: collapse; border-top: 4px solid #fa0; border-bottom: 1px solid #fa0; background: #fff; }
#logmsg table th { text-align: left; font-weight: normal; padding: 0.2em 0.5em; border-top: 1px dotted #fa0; }
#logmsg table td { text-align: right; border-top: 1px dotted #fa0; padding: 0.2em 0.5em; }
#logmsg table thead th { text-align: center; border-bottom: 1px solid #fa0; }
#logmsg table th.Corner { text-align: left; }
#logmsg hr { border: none 0; border-top: 2px dashed #fa0; height: 1px; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<div id="msg">
<dl class="meta" style="font-size: 105%">
<dt style="float: left; width: 6em; font-weight: bold">Revision</dt> <dd><a style="font-weight: bold" href="https://core.trac.wordpress.org/changeset/58069">58069</a><script type="application/ld+json">{"@context":"http://schema.org","@type":"EmailMessage","description":"Review this Commit","action":{"@type":"ViewAction","url":"https://core.trac.wordpress.org/changeset/58069","name":"Review Commit"}}</script></dd>
<dt style="float: left; width: 6em; font-weight: bold">Author</dt> <dd>swissspidy</dd>
<dt style="float: left; width: 6em; font-weight: bold">Date</dt> <dd>2024-05-01 17:59:05 +0000 (Wed, 01 May 2024)</dd>
</dl>
<pre style='padding-left: 1em; margin: 2em 0; border-left: 2px solid #ccc; line-height: 1.25; font-size: 105%; font-family: sans-serif'>General: Remove any usage of `wp_reset_vars()`.
The way `wp_reset_vars()` sets global variables based on `$_POST` and `$_GET` values makes code hard to understand and maintain. It also makes it easy to forget to sanitize input.
This change removes the few places where `wp_reset_vars()` is used in the admin to explicitly use `$_REQUEST` and sanitize any input.
Props swissspidy, audrasjb, davideferre, killua99, weijland, voldemortensen.
Fixes <a href="https://core.trac.wordpress.org/ticket/38073">#38073</a>.</pre>
<h3>Modified Paths</h3>
<ul>
<li><a href="#trunksrcwpadminadminpostphp">trunk/src/wp-admin/admin-post.php</a></li>
<li><a href="#trunksrcwpadmincommentphp">trunk/src/wp-admin/comment.php</a></li>
<li><a href="#trunksrcwpadmincustomizephp">trunk/src/wp-admin/customize.php</a></li>
<li><a href="#trunksrcwpadminedittagformphp">trunk/src/wp-admin/edit-tag-form.php</a></li>
<li><a href="#trunksrcwpadminincludesclasswplinkslisttablephp">trunk/src/wp-admin/includes/class-wp-links-list-table.php</a></li>
<li><a href="#trunksrcwpadminincludesclasswpmsthemeslisttablephp">trunk/src/wp-admin/includes/class-wp-ms-themes-list-table.php</a></li>
<li><a href="#trunksrcwpadminincludesclasswpplugininstalllisttablephp">trunk/src/wp-admin/includes/class-wp-plugin-install-list-table.php</a></li>
<li><a href="#trunksrcwpadminincludesclasswppluginslisttablephp">trunk/src/wp-admin/includes/class-wp-plugins-list-table.php</a></li>
<li><a href="#trunksrcwpadminincludesclasswpthemeinstalllisttablephp">trunk/src/wp-admin/includes/class-wp-theme-install-list-table.php</a></li>
<li><a href="#trunksrcwpadminincludesmiscphp">trunk/src/wp-admin/includes/misc.php</a></li>
<li><a href="#trunksrcwpadminlinkaddphp">trunk/src/wp-admin/link-add.php</a></li>
<li><a href="#trunksrcwpadminlinkphp">trunk/src/wp-admin/link.php</a></li>
<li><a href="#trunksrcwpadminmediaphp">trunk/src/wp-admin/media.php</a></li>
<li><a href="#trunksrcwpadminoptionsheadphp">trunk/src/wp-admin/options-head.php</a></li>
<li><a href="#trunksrcwpadminoptionsphp">trunk/src/wp-admin/options.php</a></li>
<li><a href="#trunksrcwpadminpostphp">trunk/src/wp-admin/post.php</a></li>
<li><a href="#trunksrcwpadminrevisionphp">trunk/src/wp-admin/revision.php</a></li>
<li><a href="#trunksrcwpadminsitehealthphp">trunk/src/wp-admin/site-health.php</a></li>
<li><a href="#trunksrcwpadminthemeeditorphp">trunk/src/wp-admin/theme-editor.php</a></li>
<li><a href="#trunksrcwpadminthemeinstallphp">trunk/src/wp-admin/theme-install.php</a></li>
<li><a href="#trunksrcwpadminthemesphp">trunk/src/wp-admin/themes.php</a></li>
<li><a href="#trunksrcwpadminusereditphp">trunk/src/wp-admin/user-edit.php</a></li>
</ul>
</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunksrcwpadminadminpostphp"></a>
<div class="modfile"><h4 style="background-color: #eee; color: inherit; margin: 1em 0; padding: 1.3em; font-size: 115%">Modified: trunk/src/wp-admin/admin-post.php</h4>
<pre class="diff"><span>
<span class="info" style="display: block; padding: 0 10px; color: #888">--- trunk/src/wp-admin/admin-post.php 2024-05-01 15:40:02 UTC (rev 58068)
+++ trunk/src/wp-admin/admin-post.php 2024-05-01 17:59:05 UTC (rev 58069)
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -29,7 +29,7 @@
</span><span class="cx" style="display: block; padding: 0 10px"> /** This action is documented in wp-admin/admin.php */
</span><span class="cx" style="display: block; padding: 0 10px"> do_action( 'admin_init' );
</span><span class="cx" style="display: block; padding: 0 10px">
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">-$action = ! empty( $_REQUEST['action'] ) ? $_REQUEST['action'] : '';
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+$action = ! empty( $_REQUEST['action'] ) ? sanitize_text_field( $_REQUEST['action'] ) : '';
</ins><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> // Reject invalid parameters.
</span><span class="cx" style="display: block; padding: 0 10px"> if ( ! is_scalar( $action ) ) {
</span></span></pre></div>
<a id="trunksrcwpadmincommentphp"></a>
<div class="modfile"><h4 style="background-color: #eee; color: inherit; margin: 1em 0; padding: 1.3em; font-size: 115%">Modified: trunk/src/wp-admin/comment.php</h4>
<pre class="diff"><span>
<span class="info" style="display: block; padding: 0 10px; color: #888">--- trunk/src/wp-admin/comment.php 2024-05-01 15:40:02 UTC (rev 58068)
+++ trunk/src/wp-admin/comment.php 2024-05-01 17:59:05 UTC (rev 58069)
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -16,8 +16,9 @@
</span><span class="cx" style="display: block; padding: 0 10px"> * @global string $action
</span><span class="cx" style="display: block; padding: 0 10px"> */
</span><span class="cx" style="display: block; padding: 0 10px"> global $action;
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">-wp_reset_vars( array( 'action' ) );
</del><span class="cx" style="display: block; padding: 0 10px">
</span><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+$action = ! empty( $_REQUEST['action'] ) ? sanitize_text_field( $_REQUEST['action'] ) : '';
+
</ins><span class="cx" style="display: block; padding: 0 10px"> if ( isset( $_POST['deletecomment'] ) ) {
</span><span class="cx" style="display: block; padding: 0 10px"> $action = 'deletecomment';
</span><span class="cx" style="display: block; padding: 0 10px"> }
</span></span></pre></div>
<a id="trunksrcwpadmincustomizephp"></a>
<div class="modfile"><h4 style="background-color: #eee; color: inherit; margin: 1em 0; padding: 1.3em; font-size: 115%">Modified: trunk/src/wp-admin/customize.php</h4>
<pre class="diff"><span>
<span class="info" style="display: block; padding: 0 10px; color: #888">--- trunk/src/wp-admin/customize.php 2024-05-01 15:40:02 UTC (rev 58068)
+++ trunk/src/wp-admin/customize.php 2024-05-01 17:59:05 UTC (rev 58069)
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -84,8 +84,10 @@
</span><span class="cx" style="display: block; padding: 0 10px"> }
</span><span class="cx" style="display: block; padding: 0 10px"> }
</span><span class="cx" style="display: block; padding: 0 10px">
</span><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+$url = ! empty( $_REQUEST['url'] ) ? sanitize_text_field( $_REQUEST['url'] ) : '';
+$return = ! empty( $_REQUEST['return'] ) ? sanitize_text_field( $_REQUEST['return'] ) : '';
+$autofocus = ! empty( $_REQUEST['autofocus'] ) ? sanitize_text_field( $_REQUEST['autofocus'] ) : '';
</ins><span class="cx" style="display: block; padding: 0 10px">
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">-wp_reset_vars( array( 'url', 'return', 'autofocus' ) );
</del><span class="cx" style="display: block; padding: 0 10px"> if ( ! empty( $url ) ) {
</span><span class="cx" style="display: block; padding: 0 10px"> $wp_customize->set_preview_url( wp_unslash( $url ) );
</span><span class="cx" style="display: block; padding: 0 10px"> }
</span></span></pre></div>
<a id="trunksrcwpadminedittagformphp"></a>
<div class="modfile"><h4 style="background-color: #eee; color: inherit; margin: 1em 0; padding: 1.3em; font-size: 115%">Modified: trunk/src/wp-admin/edit-tag-form.php</h4>
<pre class="diff"><span>
<span class="info" style="display: block; padding: 0 10px; color: #888">--- trunk/src/wp-admin/edit-tag-form.php 2024-05-01 15:40:02 UTC (rev 58068)
+++ trunk/src/wp-admin/edit-tag-form.php 2024-05-01 17:59:05 UTC (rev 58069)
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -44,11 +44,7 @@
</span><span class="cx" style="display: block; padding: 0 10px"> do_action_deprecated( 'edit_tag_form_pre', array( $tag ), '3.0.0', '{$taxonomy}_pre_edit_form' );
</span><span class="cx" style="display: block; padding: 0 10px"> }
</span><span class="cx" style="display: block; padding: 0 10px">
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">-/**
- * Use with caution, see https://developer.wordpress.org/reference/functions/wp_reset_vars/
- */
-wp_reset_vars( array( 'wp_http_referer' ) );
-
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+$wp_http_referer = ! empty( $_REQUEST['wp_http_referer'] ) ? sanitize_text_field( $_REQUEST['wp_http_referer'] ) : '';
</ins><span class="cx" style="display: block; padding: 0 10px"> $wp_http_referer = remove_query_arg( array( 'action', 'message', 'tag_ID' ), $wp_http_referer );
</span><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> // Also used by Edit Tags.
</span></span></pre></div>
<a id="trunksrcwpadminincludesclasswplinkslisttablephp"></a>
<div class="modfile"><h4 style="background-color: #eee; color: inherit; margin: 1em 0; padding: 1.3em; font-size: 115%">Modified: trunk/src/wp-admin/includes/class-wp-links-list-table.php</h4>
<pre class="diff"><span>
<span class="info" style="display: block; padding: 0 10px; color: #888">--- trunk/src/wp-admin/includes/class-wp-links-list-table.php 2024-05-01 15:40:02 UTC (rev 58068)
+++ trunk/src/wp-admin/includes/class-wp-links-list-table.php 2024-05-01 17:59:05 UTC (rev 58069)
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -50,7 +50,10 @@
</span><span class="cx" style="display: block; padding: 0 10px"> public function prepare_items() {
</span><span class="cx" style="display: block; padding: 0 10px"> global $cat_id, $s, $orderby, $order;
</span><span class="cx" style="display: block; padding: 0 10px">
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- wp_reset_vars( array( 'action', 'cat_id', 'link_id', 'orderby', 'order', 's' ) );
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ $cat_id = ! empty( $_REQUEST['cat_id'] ) ? absint( $_REQUEST['cat_id'] ) : 0;
+ $orderby = ! empty( $_REQUEST['orderby'] ) ? sanitize_text_field( $_REQUEST['orderby'] ) : '';
+ $order = ! empty( $_REQUEST['order'] ) ? sanitize_text_field( $_REQUEST['order'] ) : '';
+ $s = ! empty( $_REQUEST['s'] ) ? sanitize_text_field( $_REQUEST['s'] ) : '';
</ins><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> $args = array(
</span><span class="cx" style="display: block; padding: 0 10px"> 'hide_invisible' => 0,
</span></span></pre></div>
<a id="trunksrcwpadminincludesclasswpmsthemeslisttablephp"></a>
<div class="modfile"><h4 style="background-color: #eee; color: inherit; margin: 1em 0; padding: 1.3em; font-size: 115%">Modified: trunk/src/wp-admin/includes/class-wp-ms-themes-list-table.php</h4>
<pre class="diff"><span>
<span class="info" style="display: block; padding: 0 10px; color: #888">--- trunk/src/wp-admin/includes/class-wp-ms-themes-list-table.php 2024-05-01 15:40:02 UTC (rev 58068)
+++ trunk/src/wp-admin/includes/class-wp-ms-themes-list-table.php 2024-05-01 17:59:05 UTC (rev 58069)
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -99,7 +99,9 @@
</span><span class="cx" style="display: block; padding: 0 10px"> public function prepare_items() {
</span><span class="cx" style="display: block; padding: 0 10px"> global $status, $totals, $page, $orderby, $order, $s;
</span><span class="cx" style="display: block; padding: 0 10px">
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- wp_reset_vars( array( 'orderby', 'order', 's' ) );
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ $orderby = ! empty( $_REQUEST['orderby'] ) ? sanitize_text_field( $_REQUEST['orderby'] ) : '';
+ $order = ! empty( $_REQUEST['order'] ) ? sanitize_text_field( $_REQUEST['order'] ) : '';
+ $s = ! empty( $_REQUEST['s'] ) ? sanitize_text_field( $_REQUEST['s'] ) : '';
</ins><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> $themes = array(
</span><span class="cx" style="display: block; padding: 0 10px"> /**
</span></span></pre></div>
<a id="trunksrcwpadminincludesclasswpplugininstalllisttablephp"></a>
<div class="modfile"><h4 style="background-color: #eee; color: inherit; margin: 1em 0; padding: 1.3em; font-size: 115%">Modified: trunk/src/wp-admin/includes/class-wp-plugin-install-list-table.php</h4>
<pre class="diff"><span>
<span class="info" style="display: block; padding: 0 10px; color: #888">--- trunk/src/wp-admin/includes/class-wp-plugin-install-list-table.php 2024-05-01 15:40:02 UTC (rev 58068)
+++ trunk/src/wp-admin/includes/class-wp-plugin-install-list-table.php 2024-05-01 17:59:05 UTC (rev 58069)
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -92,7 +92,7 @@
</span><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> global $tabs, $tab, $paged, $type, $term;
</span><span class="cx" style="display: block; padding: 0 10px">
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- wp_reset_vars( array( 'tab' ) );
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ $tab = ! empty( $_REQUEST['tab'] ) ? sanitize_text_field( $_REQUEST['tab'] ) : '';
</ins><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> $paged = $this->get_pagenum();
</span><span class="cx" style="display: block; padding: 0 10px">
</span></span></pre></div>
<a id="trunksrcwpadminincludesclasswppluginslisttablephp"></a>
<div class="modfile"><h4 style="background-color: #eee; color: inherit; margin: 1em 0; padding: 1.3em; font-size: 115%">Modified: trunk/src/wp-admin/includes/class-wp-plugins-list-table.php</h4>
<pre class="diff"><span>
<span class="info" style="display: block; padding: 0 10px; color: #888">--- trunk/src/wp-admin/includes/class-wp-plugins-list-table.php 2024-05-01 15:40:02 UTC (rev 58068)
+++ trunk/src/wp-admin/includes/class-wp-plugins-list-table.php 2024-05-01 17:59:05 UTC (rev 58069)
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -90,7 +90,8 @@
</span><span class="cx" style="display: block; padding: 0 10px"> public function prepare_items() {
</span><span class="cx" style="display: block; padding: 0 10px"> global $status, $plugins, $totals, $page, $orderby, $order, $s;
</span><span class="cx" style="display: block; padding: 0 10px">
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- wp_reset_vars( array( 'orderby', 'order' ) );
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ $orderby = ! empty( $_REQUEST['orderby'] ) ? sanitize_text_field( $_REQUEST['orderby'] ) : '';
+ $order = ! empty( $_REQUEST['order'] ) ? sanitize_text_field( $_REQUEST['order'] ) : '';
</ins><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> /**
</span><span class="cx" style="display: block; padding: 0 10px"> * Filters the full array of plugins to list in the Plugins list table.
</span></span></pre></div>
<a id="trunksrcwpadminincludesclasswpthemeinstalllisttablephp"></a>
<div class="modfile"><h4 style="background-color: #eee; color: inherit; margin: 1em 0; padding: 1.3em; font-size: 115%">Modified: trunk/src/wp-admin/includes/class-wp-theme-install-list-table.php</h4>
<pre class="diff"><span>
<span class="info" style="display: block; padding: 0 10px; color: #888">--- trunk/src/wp-admin/includes/class-wp-theme-install-list-table.php 2024-05-01 15:40:02 UTC (rev 58068)
+++ trunk/src/wp-admin/includes/class-wp-theme-install-list-table.php 2024-05-01 17:59:05 UTC (rev 58069)
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -36,8 +36,9 @@
</span><span class="cx" style="display: block; padding: 0 10px"> require ABSPATH . 'wp-admin/includes/theme-install.php';
</span><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> global $tabs, $tab, $paged, $type, $theme_field_defaults;
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- wp_reset_vars( array( 'tab' ) );
</del><span class="cx" style="display: block; padding: 0 10px">
</span><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ $tab = ! empty( $_REQUEST['tab'] ) ? sanitize_text_field( $_REQUEST['tab'] ) : '';
+
</ins><span class="cx" style="display: block; padding: 0 10px"> $search_terms = array();
</span><span class="cx" style="display: block; padding: 0 10px"> $search_string = '';
</span><span class="cx" style="display: block; padding: 0 10px"> if ( ! empty( $_REQUEST['s'] ) ) {
</span></span></pre></div>
<a id="trunksrcwpadminincludesmiscphp"></a>
<div class="modfile"><h4 style="background-color: #eee; color: inherit; margin: 1em 0; padding: 1.3em; font-size: 115%">Modified: trunk/src/wp-admin/includes/misc.php</h4>
<pre class="diff"><span>
<span class="info" style="display: block; padding: 0 10px; color: #888">--- trunk/src/wp-admin/includes/misc.php 2024-05-01 15:40:02 UTC (rev 58068)
+++ trunk/src/wp-admin/includes/misc.php 2024-05-01 17:59:05 UTC (rev 58069)
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -575,7 +575,6 @@
</span><span class="cx" style="display: block; padding: 0 10px"> }
</span><span class="cx" style="display: block; padding: 0 10px"> }
</span><span class="cx" style="display: block; padding: 0 10px">
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">-
</del><span class="cx" style="display: block; padding: 0 10px"> /**
</span><span class="cx" style="display: block; padding: 0 10px"> * Resets global variables based on $_GET and $_POST.
</span><span class="cx" style="display: block; padding: 0 10px"> *
</span></span></pre></div>
<a id="trunksrcwpadminlinkaddphp"></a>
<div class="modfile"><h4 style="background-color: #eee; color: inherit; margin: 1em 0; padding: 1.3em; font-size: 115%">Modified: trunk/src/wp-admin/link-add.php</h4>
<pre class="diff"><span>
<span class="info" style="display: block; padding: 0 10px; color: #888">--- trunk/src/wp-admin/link-add.php 2024-05-01 15:40:02 UTC (rev 58068)
+++ trunk/src/wp-admin/link-add.php 2024-05-01 17:59:05 UTC (rev 58069)
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -17,7 +17,9 @@
</span><span class="cx" style="display: block; padding: 0 10px"> $title = __( 'Add New Link' );
</span><span class="cx" style="display: block; padding: 0 10px"> $parent_file = 'link-manager.php';
</span><span class="cx" style="display: block; padding: 0 10px">
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">-wp_reset_vars( array( 'action', 'cat_id', 'link_id' ) );
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+$action = ! empty( $_REQUEST['action'] ) ? sanitize_text_field( $_REQUEST['action'] ) : '';
+$cat_id = ! empty( $_REQUEST['cat_id'] ) ? absint( $_REQUEST['cat_id'] ) : 0;
+$link_id = ! empty( $_REQUEST['link_id'] ) ? absint( $_REQUEST['link_id'] ) : 0;
</ins><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> wp_enqueue_script( 'link' );
</span><span class="cx" style="display: block; padding: 0 10px"> wp_enqueue_script( 'xfn' );
</span></span></pre></div>
<a id="trunksrcwpadminlinkphp"></a>
<div class="modfile"><h4 style="background-color: #eee; color: inherit; margin: 1em 0; padding: 1.3em; font-size: 115%">Modified: trunk/src/wp-admin/link.php</h4>
<pre class="diff"><span>
<span class="info" style="display: block; padding: 0 10px; color: #888">--- trunk/src/wp-admin/link.php 2024-05-01 15:40:02 UTC (rev 58068)
+++ trunk/src/wp-admin/link.php 2024-05-01 17:59:05 UTC (rev 58069)
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -12,7 +12,9 @@
</span><span class="cx" style="display: block; padding: 0 10px"> /** Load WordPress Administration Bootstrap */
</span><span class="cx" style="display: block; padding: 0 10px"> require_once __DIR__ . '/admin.php';
</span><span class="cx" style="display: block; padding: 0 10px">
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">-wp_reset_vars( array( 'action', 'cat_id', 'link_id' ) );
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+$action = ! empty( $_REQUEST['action'] ) ? sanitize_text_field( $_REQUEST['action'] ) : '';
+$cat_id = ! empty( $_REQUEST['cat_id'] ) ? absint( $_REQUEST['cat_id'] ) : 0;
+$link_id = ! empty( $_REQUEST['link_id'] ) ? absint( $_REQUEST['link_id'] ) : 0;
</ins><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> if ( ! current_user_can( 'manage_links' ) ) {
</span><span class="cx" style="display: block; padding: 0 10px"> wp_link_manager_disabled_message();
</span></span></pre></div>
<a id="trunksrcwpadminmediaphp"></a>
<div class="modfile"><h4 style="background-color: #eee; color: inherit; margin: 1em 0; padding: 1.3em; font-size: 115%">Modified: trunk/src/wp-admin/media.php</h4>
<pre class="diff"><span>
<span class="info" style="display: block; padding: 0 10px; color: #888">--- trunk/src/wp-admin/media.php 2024-05-01 15:40:02 UTC (rev 58068)
+++ trunk/src/wp-admin/media.php 2024-05-01 17:59:05 UTC (rev 58069)
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -15,7 +15,7 @@
</span><span class="cx" style="display: block; padding: 0 10px"> $parent_file = 'upload.php';
</span><span class="cx" style="display: block; padding: 0 10px"> $submenu_file = 'upload.php';
</span><span class="cx" style="display: block; padding: 0 10px">
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">-wp_reset_vars( array( 'action' ) );
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+$action = ! empty( $_REQUEST['action'] ) ? sanitize_text_field( $_REQUEST['action'] ) : '';
</ins><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> switch ( $action ) {
</span><span class="cx" style="display: block; padding: 0 10px"> case 'editattachment':
</span></span></pre></div>
<a id="trunksrcwpadminoptionsheadphp"></a>
<div class="modfile"><h4 style="background-color: #eee; color: inherit; margin: 1em 0; padding: 1.3em; font-size: 115%">Modified: trunk/src/wp-admin/options-head.php</h4>
<pre class="diff"><span>
<span class="info" style="display: block; padding: 0 10px; color: #888">--- trunk/src/wp-admin/options-head.php 2024-05-01 15:40:02 UTC (rev 58068)
+++ trunk/src/wp-admin/options-head.php 2024-05-01 17:59:05 UTC (rev 58069)
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -8,7 +8,7 @@
</span><span class="cx" style="display: block; padding: 0 10px"> * @subpackage Administration
</span><span class="cx" style="display: block; padding: 0 10px"> */
</span><span class="cx" style="display: block; padding: 0 10px">
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">-wp_reset_vars( array( 'action' ) );
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+$action = ! empty( $_REQUEST['action'] ) ? sanitize_text_field( $_REQUEST['action'] ) : '';
</ins><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> if ( isset( $_GET['updated'] ) && isset( $_GET['page'] ) ) {
</span><span class="cx" style="display: block; padding: 0 10px"> // For back-compat with plugins that don't use the Settings API and just set updated=1 in the redirect.
</span></span></pre></div>
<a id="trunksrcwpadminoptionsphp"></a>
<div class="modfile"><h4 style="background-color: #eee; color: inherit; margin: 1em 0; padding: 1.3em; font-size: 115%">Modified: trunk/src/wp-admin/options.php</h4>
<pre class="diff"><span>
<span class="info" style="display: block; padding: 0 10px; color: #888">--- trunk/src/wp-admin/options.php 2024-05-01 15:40:02 UTC (rev 58068)
+++ trunk/src/wp-admin/options.php 2024-05-01 17:59:05 UTC (rev 58069)
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -23,7 +23,8 @@
</span><span class="cx" style="display: block; padding: 0 10px"> $this_file = 'options.php';
</span><span class="cx" style="display: block; padding: 0 10px"> $parent_file = 'options-general.php';
</span><span class="cx" style="display: block; padding: 0 10px">
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">-wp_reset_vars( array( 'action', 'option_page' ) );
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+$action = ! empty( $_REQUEST['action'] ) ? sanitize_text_field( $_REQUEST['action'] ) : '';
+$option_page = ! empty( $_REQUEST['option_page'] ) ? sanitize_text_field( $_REQUEST['option_page'] ) : '';
</ins><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> $capability = 'manage_options';
</span><span class="cx" style="display: block; padding: 0 10px">
</span></span></pre></div>
<a id="trunksrcwpadminpostphp"></a>
<div class="modfile"><h4 style="background-color: #eee; color: inherit; margin: 1em 0; padding: 1.3em; font-size: 115%">Modified: trunk/src/wp-admin/post.php</h4>
<pre class="diff"><span>
<span class="info" style="display: block; padding: 0 10px; color: #888">--- trunk/src/wp-admin/post.php 2024-05-01 15:40:02 UTC (rev 58068)
+++ trunk/src/wp-admin/post.php 2024-05-01 17:59:05 UTC (rev 58069)
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -14,7 +14,7 @@
</span><span class="cx" style="display: block; padding: 0 10px"> $parent_file = 'edit.php';
</span><span class="cx" style="display: block; padding: 0 10px"> $submenu_file = 'edit.php';
</span><span class="cx" style="display: block; padding: 0 10px">
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">-wp_reset_vars( array( 'action' ) );
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+$action = ! empty( $_REQUEST['action'] ) ? sanitize_text_field( $_REQUEST['action'] ) : '';
</ins><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> if ( isset( $_GET['post'] ) && isset( $_POST['post_ID'] ) && (int) $_GET['post'] !== (int) $_POST['post_ID'] ) {
</span><span class="cx" style="display: block; padding: 0 10px"> wp_die( __( 'A post ID mismatch has been detected.' ), __( 'Sorry, you are not allowed to edit this item.' ), 400 );
</span></span></pre></div>
<a id="trunksrcwpadminrevisionphp"></a>
<div class="modfile"><h4 style="background-color: #eee; color: inherit; margin: 1em 0; padding: 1.3em; font-size: 115%">Modified: trunk/src/wp-admin/revision.php</h4>
<pre class="diff"><span>
<span class="info" style="display: block; padding: 0 10px; color: #888">--- trunk/src/wp-admin/revision.php 2024-05-01 15:40:02 UTC (rev 58068)
+++ trunk/src/wp-admin/revision.php 2024-05-01 17:59:05 UTC (rev 58069)
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -21,14 +21,16 @@
</span><span class="cx" style="display: block; padding: 0 10px"> * @global int $from The revision to compare from.
</span><span class="cx" style="display: block; padding: 0 10px"> * @global int $to Optional, required if revision missing. The revision to compare to.
</span><span class="cx" style="display: block; padding: 0 10px"> */
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">-wp_reset_vars( array( 'revision', 'action', 'from', 'to' ) );
</del><span class="cx" style="display: block; padding: 0 10px">
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">-$revision_id = absint( $revision );
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+$revision_id = ! empty( $_REQUEST['revision'] ) ? absint( $_REQUEST['revision'] ) : 0;
+$action = ! empty( $_REQUEST['action'] ) ? sanitize_text_field( $_REQUEST['action'] ) : '';
+$from = ! empty( $_REQUEST['from'] ) && is_numeric( $_REQUEST['from'] ) ? absint( $_REQUEST['from'] ) : null;
+$to = ! empty( $_REQUEST['to'] ) && is_numeric( $_REQUEST['to'] ) ? absint( $_REQUEST['to'] ) : null;
</ins><span class="cx" style="display: block; padding: 0 10px">
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">-$from = is_numeric( $from ) ? absint( $from ) : null;
</del><span class="cx" style="display: block; padding: 0 10px"> if ( ! $revision_id ) {
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">- $revision_id = absint( $to );
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+ $revision_id = $to;
</ins><span class="cx" style="display: block; padding: 0 10px"> }
</span><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+
</ins><span class="cx" style="display: block; padding: 0 10px"> $redirect = 'edit.php';
</span><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> switch ( $action ) {
</span></span></pre></div>
<a id="trunksrcwpadminsitehealthphp"></a>
<div class="modfile"><h4 style="background-color: #eee; color: inherit; margin: 1em 0; padding: 1.3em; font-size: 115%">Modified: trunk/src/wp-admin/site-health.php</h4>
<pre class="diff"><span>
<span class="info" style="display: block; padding: 0 10px; color: #888">--- trunk/src/wp-admin/site-health.php 2024-05-01 15:40:02 UTC (rev 58068)
+++ trunk/src/wp-admin/site-health.php 2024-05-01 17:59:05 UTC (rev 58069)
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -9,7 +9,7 @@
</span><span class="cx" style="display: block; padding: 0 10px"> /** WordPress Administration Bootstrap */
</span><span class="cx" style="display: block; padding: 0 10px"> require_once __DIR__ . '/admin.php';
</span><span class="cx" style="display: block; padding: 0 10px">
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">-wp_reset_vars( array( 'action' ) );
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+$action = ! empty( $_REQUEST['action'] ) ? sanitize_text_field( $_REQUEST['action'] ) : '';
</ins><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> $tabs = array(
</span><span class="cx" style="display: block; padding: 0 10px"> /* translators: Tab heading for Site Health Status page. */
</span></span></pre></div>
<a id="trunksrcwpadminthemeeditorphp"></a>
<div class="modfile"><h4 style="background-color: #eee; color: inherit; margin: 1em 0; padding: 1.3em; font-size: 115%">Modified: trunk/src/wp-admin/theme-editor.php</h4>
<pre class="diff"><span>
<span class="info" style="display: block; padding: 0 10px; color: #888">--- trunk/src/wp-admin/theme-editor.php 2024-05-01 15:40:02 UTC (rev 58068)
+++ trunk/src/wp-admin/theme-editor.php 2024-05-01 17:59:05 UTC (rev 58069)
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -56,7 +56,10 @@
</span><span class="cx" style="display: block; padding: 0 10px"> '<p>' . __( '<a href="https://wordpress.org/support/forums/">Support forums</a>' ) . '</p>'
</span><span class="cx" style="display: block; padding: 0 10px"> );
</span><span class="cx" style="display: block; padding: 0 10px">
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">-wp_reset_vars( array( 'action', 'error', 'file', 'theme' ) );
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+$action = ! empty( $_REQUEST['action'] ) ? sanitize_text_field( $_REQUEST['action'] ) : '';
+$theme = ! empty( $_REQUEST['theme'] ) ? sanitize_text_field( $_REQUEST['theme'] ) : '';
+$file = ! empty( $_REQUEST['file'] ) ? sanitize_text_field( $_REQUEST['file'] ) : '';
+$error = ! empty( $_REQUEST['error'] );
</ins><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> if ( $theme ) {
</span><span class="cx" style="display: block; padding: 0 10px"> $stylesheet = $theme;
</span></span></pre></div>
<a id="trunksrcwpadminthemeinstallphp"></a>
<div class="modfile"><h4 style="background-color: #eee; color: inherit; margin: 1em 0; padding: 1.3em; font-size: 115%">Modified: trunk/src/wp-admin/theme-install.php</h4>
<pre class="diff"><span>
<span class="info" style="display: block; padding: 0 10px; color: #888">--- trunk/src/wp-admin/theme-install.php 2024-05-01 15:40:02 UTC (rev 58068)
+++ trunk/src/wp-admin/theme-install.php 2024-05-01 17:59:05 UTC (rev 58069)
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -10,7 +10,7 @@
</span><span class="cx" style="display: block; padding: 0 10px"> require_once __DIR__ . '/admin.php';
</span><span class="cx" style="display: block; padding: 0 10px"> require ABSPATH . 'wp-admin/includes/theme-install.php';
</span><span class="cx" style="display: block; padding: 0 10px">
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">-wp_reset_vars( array( 'tab' ) );
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+$tab = ! empty( $_REQUEST['tab'] ) ? sanitize_text_field( $_REQUEST['tab'] ) : '';
</ins><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> if ( ! current_user_can( 'install_themes' ) ) {
</span><span class="cx" style="display: block; padding: 0 10px"> wp_die( __( 'Sorry, you are not allowed to install themes on this site.' ) );
</span></span></pre></div>
<a id="trunksrcwpadminthemesphp"></a>
<div class="modfile"><h4 style="background-color: #eee; color: inherit; margin: 1em 0; padding: 1.3em; font-size: 115%">Modified: trunk/src/wp-admin/themes.php</h4>
<pre class="diff"><span>
<span class="info" style="display: block; padding: 0 10px; color: #888">--- trunk/src/wp-admin/themes.php 2024-05-01 15:40:02 UTC (rev 58068)
+++ trunk/src/wp-admin/themes.php 2024-05-01 17:59:05 UTC (rev 58069)
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -215,8 +215,10 @@
</span><span class="cx" style="display: block; padding: 0 10px"> } else {
</span><span class="cx" style="display: block; padding: 0 10px"> $themes = wp_prepare_themes_for_js( array( wp_get_theme() ) );
</span><span class="cx" style="display: block; padding: 0 10px"> }
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">-wp_reset_vars( array( 'theme', 'search' ) );
</del><span class="cx" style="display: block; padding: 0 10px">
</span><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+$theme = ! empty( $_REQUEST['theme'] ) ? sanitize_text_field( $_REQUEST['theme'] ) : '';
+$search = ! empty( $_REQUEST['search'] ) ? sanitize_text_field( $_REQUEST['search'] ) : '';
+
</ins><span class="cx" style="display: block; padding: 0 10px"> wp_localize_script(
</span><span class="cx" style="display: block; padding: 0 10px"> 'theme',
</span><span class="cx" style="display: block; padding: 0 10px"> '_wpThemeSettings',
</span></span></pre></div>
<a id="trunksrcwpadminusereditphp"></a>
<div class="modfile"><h4 style="background-color: #eee; color: inherit; margin: 1em 0; padding: 1.3em; font-size: 115%">Modified: trunk/src/wp-admin/user-edit.php</h4>
<pre class="diff"><span>
<span class="info" style="display: block; padding: 0 10px; color: #888">--- trunk/src/wp-admin/user-edit.php 2024-05-01 15:40:02 UTC (rev 58068)
+++ trunk/src/wp-admin/user-edit.php 2024-05-01 17:59:05 UTC (rev 58069)
</span><span class="lines" style="display: block; padding: 0 10px; color: #888">@@ -12,9 +12,10 @@
</span><span class="cx" style="display: block; padding: 0 10px"> /** WordPress Translation Installation API */
</span><span class="cx" style="display: block; padding: 0 10px"> require_once ABSPATH . 'wp-admin/includes/translation-install.php';
</span><span class="cx" style="display: block; padding: 0 10px">
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">-wp_reset_vars( array( 'action', 'user_id', 'wp_http_referer' ) );
</del><ins style="background-color: #dfd; text-decoration:none; display:block; padding: 0 10px">+$action = ! empty( $_REQUEST['action'] ) ? sanitize_text_field( $_REQUEST['action'] ) : '';
+$user_id = ! empty( $_REQUEST['user_id'] ) ? absint( $_REQUEST['user_id'] ) : 0;
+$wp_http_referer = ! empty( $_REQUEST['wp_http_referer'] ) ? sanitize_text_field( $_REQUEST['wp_http_referer'] ) : '';
</ins><span class="cx" style="display: block; padding: 0 10px">
</span><del style="background-color: #fdd; text-decoration:none; display:block; padding: 0 10px">-$user_id = (int) $user_id;
</del><span class="cx" style="display: block; padding: 0 10px"> $current_user = wp_get_current_user();
</span><span class="cx" style="display: block; padding: 0 10px">
</span><span class="cx" style="display: block; padding: 0 10px"> if ( ! defined( 'IS_PROFILE_PAGE' ) ) {
</span></span></pre>
</div>
</div>
</body>
</html>