[wp-trac] [WordPress Trac] #48605: add_magic_quotes() inappropriately recasts data types

[WordPress Trac]

#48605: add_magic_quotes() inappropriately recasts data types
--------------------------+------------------------------
 Reporter:  Veraxus       |       Owner:  (none)
     Type:  defect (bug)  |      Status:  new
 Priority:  normal        |   Milestone:  Awaiting Review
Component:  General       |     Version:  trunk
 Severity:  major         |  Resolution:
 Keywords:  needs-patch   |     Focuses:
--------------------------+------------------------------

Old description:

> Discovered as a result of: https://github.com/sebastianbergmann/php-code-
> coverage/issues/708
>
> wp_magic_quotes() applies add_magic_quotes() to a wide variety of
> globals, including $_SERVER. Unfortunately, add_magic_quotes()
> indiscriminately calls addslashes() on ''every single non-array value'',
> effectively recasting integers to strings.
>
> For instance, $_SERVER['REQUEST_TIME'], which is a unix timestamp, gets
> recast to a string of numbers, breaking downstream functionality (like
> PhpUnit) that expects the timestamp to actually be a timestamp.
>
> add_magic_quotes() needs to be updated to only apply addslashes() when
> the type of the value is already a string.

New description:

 Discovered as a result of: https://github.com/sebastianbergmann/php-code-
 coverage/issues/708

 wp_magic_quotes() applies add_magic_quotes() to a wide variety of globals,
 including $_SERVER. Unfortunately, add_magic_quotes() indiscriminately
 calls addslashes() on ''every single non-array value'', effectively
 recasting integers to strings.

 For instance, `$_SERVER['REQUEST_TIME']`, which is a unix timestamp, gets
 recast to a string of numbers, breaking downstream functionality (like
 PhpUnit) that expects the timestamp to actually be a timestamp.

 add_magic_quotes() needs to be updated to only apply addslashes() when the
 type of the value is already a string.

--

Comment (by SergeyBiryukov):

 Related: #18322, #21767, #47663.

-- 
Ticket URL: <https://core.trac.wordpress.org/ticket/48605#comment:1>
WordPress Trac <https://core.trac.wordpress.org/>
WordPress publishing platform