Slash page content before writing in import-page-draft - #213
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
import-page-draftstill carries the defect that was fixed forpublish-postin v5.16.1 (#210, also shipped in the current v5.17.0). This PR lands as 5.17.1.Both the local and the production path passed
file_get_contents()straight intowp_update_post(), which callswp_unslash()internally and expects slashed input. Every literal backslash was eaten on the way into the database.Prose is unaffected, which is why it goes unnoticed. A page draft carrying code is silently corrupted:
\",\',\\,\n,\band backreferences like\2are load-bearing in regexes andprintf/sprintfcalls, and simply vanish.How this surfaced
Hit today on a live post (13729) via the
publish_postMCP tool. The v5.16.1 fix was already merged and built, butmcp-server/run.shrebuilds only at process start, so a long-running MCP session kept executing the pre-fix build while the correcteddist/sat on disk. The stored PHP sample came back as:\bct-inner-content\b->bct-inner-contentbstr_replace( '\\', '\\\\', $notice )->str_replace( '\', '\\', $notice )\n->n,\2->2The regex a reader copies out of the published post is broken. Auditing the rest of the tree for the same pattern turned up
import-page-draft.shas the one remaining unslashed write.Change
Wraps the body in
wp_slash()on both the local and production paths, matching howpublish-post.shdoes it, with a comment explaining why.bash -nclean.