[wp-trac] [WordPress Trac] #27260: Double-unslashing in "nopriv" handler of the Heartbeat API

[WordPress Trac]

#27260: Double-unslashing in "nopriv" handler of the Heartbeat API
------------------------------+------------------
 Reporter:  TobiasBg          |       Owner:
     Type:  defect (bug)      |      Status:  new
 Priority:  normal            |   Milestone:  3.9
Component:  Autosave          |     Version:  3.6
 Severity:  normal            |  Resolution:
 Keywords:  has-patch commit  |     Focuses:
------------------------------+------------------

Comment (by nacin):

 In an ideal world, we should immediately unslash $_POST references with
 wp_unslash(), and then re-slash it with wp_slash() immediately before
 passing it to an API that expects slashed data. The API itself should not
 be reliant on slashed data.

--
Ticket URL: <https://core.trac.wordpress.org/ticket/27260#comment:3>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform