Skip to content

Commit 5afd7cd

Browse files
mdawaffemdawaffe
committed
3.8:
- WPDB: Sanity check that any strings being stored in the DB are not too long to store correctly. - When upgrading, remove any suspicious comments. git-svn-id: https://develop.svn.wordpress.org/branches/3.8@32317 602fd350-edb4-49c9-b593-d223f7449a82
1 parent 5b66593 commit 5afd7cd

8 files changed

Lines changed: 186 additions & 4 deletions

File tree

‎package.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"name": "WordPress",
3-
"version": "3.8.7",
3+
"version": "3.8.8",
44
"description": "WordPress is web software you can use to create a beautiful website or blog.",
55
"repository": {
66
"type": "svn",

‎src/readme.html‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@
99
<body>
1010
<h1 id="logo">
1111
<a href="http://wordpress.org/"><img alt="WordPress" src="wp-admin/images/wordpress-logo.png" /></a>
12-
<br /> Version 3.8.7
12+
<br /> Version 3.8.8
1313
</h1>
1414
<p style="text-align: center">Semantic Personal Publishing Platform</p>
1515

‎src/wp-admin/about.php‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -39,7 +39,11 @@
3939
</h2>
4040

4141
<div class="changelog point-releases">
42-
<h3><?php echo _n( 'Maintenance and Security Release', 'Maintenance and Security Releases', 7 ); ?></h3>
42+
<h3><?php echo _n( 'Maintenance and Security Release', 'Maintenance and Security Releases', 8 ); ?></h3>
43+
<p><?php printf( _n( '<strong>Version %1$s</strong> addressed a security issue.',
44+
'<strong>Version %1$s</strong> addressed some security issues.', 1 ), '3.8.8' ); ?>
45+
<?php printf( __( 'For more information, see <a href="%s">the release notes</a>.' ), 'http://codex.wordpress.org/Version_3.8.8' ); ?>
46+
</p>
4347
<p><?php printf( _n( '<strong>Version %1$s</strong> addressed %2$s bug.',
4448
'<strong>Version %1$s</strong> addressed %2$s bugs.', 1 ), '3.8.7', number_format_i18n( 1 ) ); ?>
4549
<?php printf( __( 'For more information, see <a href="%s">the release notes</a>.' ), 'https://codex.wordpress.org/Version_3.8.7' ); ?>

‎src/wp-admin/includes/upgrade.php‎

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -414,6 +414,9 @@ function upgrade_all() {
414414
if ( $wp_current_db_version < 26692 )
415415
upgrade_383();
416416

417+
if ( $wp_current_db_version < 26693 )
418+
upgrade_388();
419+
417420
maybe_disable_link_manager();
418421

419422
maybe_disable_automattic_widgets();
@@ -1284,6 +1287,33 @@ function upgrade_383() {
12841287
}
12851288
}
12861289

1290+
/**
1291+
* Execute changes made in WordPress 3.8.8.
1292+
*
1293+
* @since 3.8.8
1294+
*/
1295+
function upgrade_388() {
1296+
global $wp_current_db_version, $wpdb;
1297+
1298+
if ( $wp_current_db_version < 26693 ) {
1299+
$content_length = $wpdb->get_col_length( $wpdb->comments, 'comment_content' );
1300+
if ( ! $content_length ) {
1301+
$content_length = 65535;
1302+
}
1303+
1304+
$comments = $wpdb->get_results(
1305+
"SELECT comment_ID FROM $wpdb->comments
1306+
WHERE comment_date_gmt > '2015-04-26'
1307+
AND CHAR_LENGTH( comment_content ) >= $content_length
1308+
AND ( comment_content LIKE '%<%' OR comment_content LIKE '%>%' )"
1309+
);
1310+
1311+
foreach ( $comments as $comment ) {
1312+
wp_delete_comment( $comment->comment_ID, true );
1313+
}
1314+
}
1315+
}
1316+
12871317
/**
12881318
* Execute network level changes
12891319
*

‎src/wp-includes/version.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@
1111
*
1212
* @global int $wp_db_version
1313
*/
14-
$wp_db_version = 26692;
14+
$wp_db_version = 26693;
1515

1616
/**
1717
* Holds the TinyMCE version

‎src/wp-includes/wp-db.php‎

Lines changed: 114 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1521,11 +1521,20 @@ function delete( $table, $where, $where_format = null ) {
15211521
*/
15221522
protected function process_fields( $table, $data, $format ) {
15231523
$data = $this->process_field_formats( $data, $format );
1524+
if ( false === $data ) {
1525+
return false;
1526+
}
1527+
15241528
$data = $this->process_field_charsets( $data, $table );
15251529
if ( false === $data ) {
15261530
return false;
15271531
}
15281532

1533+
$data = $this->process_field_lengths( $data, $table );
1534+
if ( false === $data ) {
1535+
return false;
1536+
}
1537+
15291538
$converted_data = $this->strip_invalid_text( $data );
15301539

15311540
if ( $data !== $converted_data ) {
@@ -1606,6 +1615,40 @@ protected function process_field_charsets( $data, $table ) {
16061615
return $data;
16071616
}
16081617

1618+
/**
1619+
* For string fields, record the maximum string length that field can safely save.
1620+
*
1621+
* @since 4.2.1
1622+
* @access protected
1623+
*
1624+
* @param array $data As it comes from the wpdb::process_field_charsets() method.
1625+
* @param string $table Table name.
1626+
* @return array|False The same array as $data with additional 'length' keys, or false if
1627+
* any of the values were too long for their corresponding field.
1628+
*/
1629+
protected function process_field_lengths( $data, $table ) {
1630+
foreach ( $data as $field => $value ) {
1631+
if ( '%d' === $value['format'] || '%f' === $value['format'] ) {
1632+
// We can skip this field if we know it isn't a string.
1633+
// This checks %d/%f versus ! %s because it's sprintf() could take more.
1634+
$value['length'] = false;
1635+
} else {
1636+
$value['length'] = $this->get_col_length( $table, $field );
1637+
if ( is_wp_error( $value['length'] ) ) {
1638+
return false;
1639+
}
1640+
}
1641+
1642+
if ( false !== $value['length'] && strlen( $value['value'] ) > $value['length'] ) {
1643+
return false;
1644+
}
1645+
1646+
$data[ $field ] = $value;
1647+
}
1648+
1649+
return $data;
1650+
}
1651+
16091652
/**
16101653
* Retrieve one variable from the database.
16111654
*
@@ -1921,6 +1964,77 @@ public function get_col_charset( $table, $column ) {
19211964
return $charset;
19221965
}
19231966

1967+
/**
1968+
* Retrieve the maximum string length allowed in a given column.
1969+
*
1970+
* @since 4.2.1
1971+
* @access public
1972+
*
1973+
* @param string $table Table name.
1974+
* @param string $column Column name.
1975+
* @return mixed Max column length as an int. False if the column has no
1976+
* length. WP_Error object if there was an error.
1977+
*/
1978+
public function get_col_length( $table, $column ) {
1979+
$tablekey = strtolower( $table );
1980+
$columnkey = strtolower( $column );
1981+
1982+
// Skip this entirely if this isn't a MySQL database.
1983+
if ( false === $this->is_mysql ) {
1984+
return false;
1985+
}
1986+
1987+
if ( empty( $this->col_meta[ $tablekey ] ) ) {
1988+
// This primes column information for us.
1989+
$table_charset = $this->get_table_charset( $table );
1990+
if ( is_wp_error( $table_charset ) ) {
1991+
return $table_charset;
1992+
}
1993+
}
1994+
1995+
if ( empty( $this->col_meta[ $tablekey ][ $columnkey ] ) ) {
1996+
return false;
1997+
}
1998+
1999+
$typeinfo = explode( '(', $this->col_meta[ $tablekey ][ $columnkey ]->Type );
2000+
2001+
$type = strtolower( $typeinfo[0] );
2002+
if ( ! empty( $typeinfo[1] ) ) {
2003+
$length = trim( $typeinfo[1], ')' );
2004+
} else {
2005+
$length = false;
2006+
}
2007+
2008+
switch( $type ) {
2009+
case 'binary':
2010+
case 'char':
2011+
case 'varbinary':
2012+
case 'varchar':
2013+
return $length;
2014+
break;
2015+
case 'tinyblob':
2016+
case 'tinytext':
2017+
return 255; // 2^8 - 1
2018+
break;
2019+
case 'blob':
2020+
case 'text':
2021+
return 65535; // 2^16 - 1
2022+
break;
2023+
case 'mediumblob':
2024+
case 'mediumtext':
2025+
return 16777215; // 2^24 - 1
2026+
break;
2027+
case 'longblob':
2028+
case 'longtext':
2029+
return 4294967295; // 2^32 - 1
2030+
break;
2031+
default:
2032+
return false;
2033+
}
2034+
2035+
return false;
2036+
}
2037+
19242038
/**
19252039
* Check if a string is ASCII.
19262040
*

‎tests/phpunit/tests/comment.php‎

Lines changed: 33 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -14,4 +14,37 @@ function test_wp_update_comment() {
1414
$result = wp_update_comment( array( 'comment_ID' => $comments[0], 'comment_parent' => $comments[1] ) );
1515
$this->assertEquals( 0, $result );
1616
}
17+
18+
public function test_comment_content_length() {
19+
// `wp_new_comment()` checks REMOTE_ADDR, so we fake it to avoid PHP notices.
20+
if ( isset( $_SERVER['REMOTE_ADDR'] ) ) {
21+
$remote_addr = $_SERVER['REMOTE_ADDR'];
22+
} else {
23+
$_SERVER['REMOTE_ADDR'] = '';
24+
}
25+
26+
$post_id = $this->factory->post->create();
27+
28+
$data = array(
29+
'comment_post_ID' => $post_id,
30+
'comment_author' => rand_str(),
31+
'comment_author_url' => '',
32+
'comment_author_email' => '',
33+
'comment_type' => '',
34+
'comment_content' => str_repeat( 'A', 65536 ),
35+
'comment_date' => '2011-01-01 10:00:00',
36+
'comment_date_gmt' => '2011-01-01 10:00:00',
37+
);
38+
39+
$id = wp_new_comment( $data );
40+
41+
$this->assertFalse( $id );
42+
43+
// Cleanup.
44+
if ( isset( $remote_addr ) ) {
45+
$_SERVER['REMOTE_ADDR'] = $remote_addr;
46+
} else {
47+
unset( $_SERVER['REMOTE_ADDR'] );
48+
}
49+
}
1750
}

‎tests/phpunit/tests/db.php‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -511,6 +511,7 @@ function test_process_fields() {
511511
'format' => '%s',
512512
'charset' => $expected_charset,
513513
'ascii' => false,
514+
'length' => $wpdb->get_col_length( $wpdb->posts, 'post_content' ),
514515
)
515516
);
516517

0 commit comments

Comments
 (0)