[wp-trac] [WordPress Trac] #48605: add_magic_quotes() inappropriately recasts data types
WordPress Trac
noreply at wordpress.org
Thu Nov 14 10:07:56 UTC 2019
#48605: add_magic_quotes() inappropriately recasts data types
--------------------------+------------------------------
Reporter: Veraxus | Owner: (none)
Type: defect (bug) | Status: new
Priority: normal | Milestone: Awaiting Review
Component: General | Version: trunk
Severity: major | Resolution:
Keywords: needs-patch | Focuses:
--------------------------+------------------------------
Old description:
> Discovered as a result of: https://github.com/sebastianbergmann/php-code-
> coverage/issues/708
>
> wp_magic_quotes() applies add_magic_quotes() to a wide variety of
> globals, including $_SERVER. Unfortunately, add_magic_quotes()
> indiscriminately calls addslashes() on ''every single non-array value'',
> effectively recasting integers to strings.
>
> For instance, $_SERVER['REQUEST_TIME'], which is a unix timestamp, gets
> recast to a string of numbers, breaking downstream functionality (like
> PhpUnit) that expects the timestamp to actually be a timestamp.
>
> add_magic_quotes() needs to be updated to only apply addslashes() when
> the type of the value is already a string.
New description:
Discovered as a result of: https://github.com/sebastianbergmann/php-code-
coverage/issues/708
wp_magic_quotes() applies add_magic_quotes() to a wide variety of globals,
including $_SERVER. Unfortunately, add_magic_quotes() indiscriminately
calls addslashes() on ''every single non-array value'', effectively
recasting integers to strings.
For instance, `$_SERVER['REQUEST_TIME']`, which is a unix timestamp, gets
recast to a string of numbers, breaking downstream functionality (like
PhpUnit) that expects the timestamp to actually be a timestamp.
add_magic_quotes() needs to be updated to only apply addslashes() when the
type of the value is already a string.
--
Comment (by SergeyBiryukov):
Related: #18322, #21767, #47663.
--
Ticket URL: <https://core.trac.wordpress.org/ticket/48605#comment:1>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform
More information about the wp-trac
mailing list