From 925002bc3716992d7d0ef8d1ff4e3aa0b2bc838e Mon Sep 17 00:00:00 2001 From: Peter Fabian Date: Mon, 6 Aug 2018 20:49:27 +0200 Subject: [PATCH 1/3] Changed wc_clean sanitization to checking for valid utf8 and the input is later sanitized by WordPress db layer. It caused issues in 2 places: Order item name (product name) and user's password. --- includes/admin/wc-admin-functions.php | 2 +- includes/api/v1/class-wc-rest-customers-controller.php | 2 +- includes/class-wc-checkout.php | 3 +++ includes/class-wc-customer.php | 2 +- includes/class-wc-order-item.php | 2 +- 5 files changed, 7 insertions(+), 4 deletions(-) diff --git a/includes/admin/wc-admin-functions.php b/includes/admin/wc-admin-functions.php index be7dfa39a42..6bba04d9e20 100644 --- a/includes/admin/wc-admin-functions.php +++ b/includes/admin/wc-admin-functions.php @@ -208,7 +208,7 @@ function wc_save_order_items( $order_id, $items ) { $item_data = array(); foreach ( $data_keys as $key => $default ) { - $item_data[ $key ] = isset( $items[ $key ][ $item_id ] ) ? wc_clean( wp_unslash( $items[ $key ][ $item_id ] ) ) : $default; + $item_data[ $key ] = isset( $items[ $key ][ $item_id ] ) ? wp_check_invalid_utf8( wp_unslash( $items[ $key ][ $item_id ] ) ) : $default; } if ( '0' === $item_data['order_item_qty'] ) { diff --git a/includes/api/v1/class-wc-rest-customers-controller.php b/includes/api/v1/class-wc-rest-customers-controller.php index 551b6e89dba..535c1ce8e0f 100644 --- a/includes/api/v1/class-wc-rest-customers-controller.php +++ b/includes/api/v1/class-wc-rest-customers-controller.php @@ -419,7 +419,7 @@ class WC_REST_Customers_V1_Controller extends WC_REST_Controller { // Customer password. if ( isset( $request['password'] ) ) { - $customer->set_password( wc_clean( $request['password'] ) ); + $customer->set_password( wp_check_invalid_utf8( $request['password'] ) ); } $this->update_customer_meta_fields( $customer, $request ); diff --git a/includes/class-wc-checkout.php b/includes/class-wc-checkout.php index edab882884d..9f9469608e6 100644 --- a/includes/class-wc-checkout.php +++ b/includes/class-wc-checkout.php @@ -615,6 +615,9 @@ class WC_Checkout { case 'textarea': $value = isset( $_POST[ $key ] ) ? wc_sanitize_textarea( wp_unslash( $_POST[ $key ] ) ) : ''; // WPCS: input var ok, CSRF ok. break; + case 'password': + $value = isset( $_POST[ $key ] ) ? wp_check_invalid_utf8( wp_unslash( $_POST[ $key ] ) ) : ''; // WPCS: input var ok, CSRF ok. + break; default: $value = isset( $_POST[ $key ] ) ? wc_clean( wp_unslash( $_POST[ $key ] ) ) : ''; // WPCS: input var ok, CSRF ok. break; diff --git a/includes/class-wc-customer.php b/includes/class-wc-customer.php index 658f3c36ecc..32b422c4adf 100644 --- a/includes/class-wc-customer.php +++ b/includes/class-wc-customer.php @@ -294,7 +294,7 @@ class WC_Customer extends WC_Legacy_Customer { * @param string $password Password. */ public function set_password( $password ) { - $this->password = wc_clean( $password ); + $this->password = wp_check_invalid_utf8( $password ); } /** diff --git a/includes/class-wc-order-item.php b/includes/class-wc-order-item.php index 649ff5ce779..f0f8148d33b 100644 --- a/includes/class-wc-order-item.php +++ b/includes/class-wc-order-item.php @@ -186,7 +186,7 @@ class WC_Order_Item extends WC_Data implements ArrayAccess { * @param string $value Item name. */ public function set_name( $value ) { - $this->set_prop( 'name', wc_clean( $value ) ); + $this->set_prop( 'name', wp_check_invalid_utf8( $value ) ); } /* From d4fab78b057f7393658f6482d2f68c0ea846111f Mon Sep 17 00:00:00 2001 From: Peter Fabian Date: Thu, 9 Aug 2018 11:30:40 +0200 Subject: [PATCH 2/3] PHPCS update. --- includes/class-wc-checkout.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/includes/class-wc-checkout.php b/includes/class-wc-checkout.php index 9f9469608e6..5a1d293f347 100644 --- a/includes/class-wc-checkout.php +++ b/includes/class-wc-checkout.php @@ -616,7 +616,7 @@ class WC_Checkout { $value = isset( $_POST[ $key ] ) ? wc_sanitize_textarea( wp_unslash( $_POST[ $key ] ) ) : ''; // WPCS: input var ok, CSRF ok. break; case 'password': - $value = isset( $_POST[ $key ] ) ? wp_check_invalid_utf8( wp_unslash( $_POST[ $key ] ) ) : ''; // WPCS: input var ok, CSRF ok. + $value = isset( $_POST[ $key ] ) ? wp_check_invalid_utf8( wp_unslash( $_POST[ $key ] ) ) : ''; // WPCS: input var ok, CSRF ok, sanitization ok. break; default: $value = isset( $_POST[ $key ] ) ? wc_clean( wp_unslash( $_POST[ $key ] ) ) : ''; // WPCS: input var ok, CSRF ok. From 1a2f0d4a0bd6dbd9c8154186f3fd8024ad237486 Mon Sep 17 00:00:00 2001 From: Peter Fabian Date: Fri, 17 Aug 2018 11:01:30 +0200 Subject: [PATCH 3/3] Removed check for invalid utf8 in passwords. --- includes/api/v1/class-wc-rest-customers-controller.php | 2 +- includes/class-wc-checkout.php | 2 +- includes/class-wc-customer.php | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/includes/api/v1/class-wc-rest-customers-controller.php b/includes/api/v1/class-wc-rest-customers-controller.php index 535c1ce8e0f..4659e60946b 100644 --- a/includes/api/v1/class-wc-rest-customers-controller.php +++ b/includes/api/v1/class-wc-rest-customers-controller.php @@ -419,7 +419,7 @@ class WC_REST_Customers_V1_Controller extends WC_REST_Controller { // Customer password. if ( isset( $request['password'] ) ) { - $customer->set_password( wp_check_invalid_utf8( $request['password'] ) ); + $customer->set_password( $request['password'] ); } $this->update_customer_meta_fields( $customer, $request ); diff --git a/includes/class-wc-checkout.php b/includes/class-wc-checkout.php index 5a1d293f347..9d1803906f0 100644 --- a/includes/class-wc-checkout.php +++ b/includes/class-wc-checkout.php @@ -616,7 +616,7 @@ class WC_Checkout { $value = isset( $_POST[ $key ] ) ? wc_sanitize_textarea( wp_unslash( $_POST[ $key ] ) ) : ''; // WPCS: input var ok, CSRF ok. break; case 'password': - $value = isset( $_POST[ $key ] ) ? wp_check_invalid_utf8( wp_unslash( $_POST[ $key ] ) ) : ''; // WPCS: input var ok, CSRF ok, sanitization ok. + $value = isset( $_POST[ $key ] ) ? wp_unslash( $_POST[ $key ] ) : ''; // WPCS: input var ok, CSRF ok, sanitization ok. break; default: $value = isset( $_POST[ $key ] ) ? wc_clean( wp_unslash( $_POST[ $key ] ) ) : ''; // WPCS: input var ok, CSRF ok. diff --git a/includes/class-wc-customer.php b/includes/class-wc-customer.php index 32b422c4adf..a3dfd8b08f6 100644 --- a/includes/class-wc-customer.php +++ b/includes/class-wc-customer.php @@ -294,7 +294,7 @@ class WC_Customer extends WC_Legacy_Customer { * @param string $password Password. */ public function set_password( $password ) { - $this->password = wp_check_invalid_utf8( $password ); + $this->password = $password; } /**