WordPress SQL注入漏洞与提权分析

case 'post-quickdraft-save':     // Check nonce and capabilities     $nonce = $_REQUEST['_wpnonce'];     $error_msg = false;     // For output of the quickdraft dashboard widget     require_once ABSPATH . 'wp-admin/includes/dashboard.<a href="http://blog.nsfocus.net/tag/php/" title="php" target="_blank">php</a>';     if ( ! wp_verify_nonce( $nonce, 'add-post' ) )         $error_msg = __( 'Unable to submit this form, please refresh and try again.' );     if ( ! current_user_can( 'edit_posts' ) )         $error_msg = __( 'Oops, you don’t have access to add new drafts.' );     if ( $error_msg )         return wp_dashboard_quick_press( $error_msg );

wp_nonce_field( 'add-post' );

if ( isset( $_GET['post'] ) )     $post_id = $post_ID = (int) $_GET['post']; elseif ( isset( $_POST['post_ID'] ) )     $post_id = $post_ID = (int) $_POST['post_ID']; else     $post_id = $post_ID = 0; global $post_type, $post_type_object, $post; if ( $post_id )     $post = get_post( $post_id ); if ( $post ) {     $post_type = $post->post_type;     $post_type_object = get_post_type_object( $post_type ); }

function edit_post( $post_data = null ) {     global $wpdb;     if ( empty($post_data) )         $post_data = &$_POST;     // Clear out any data in internal vars.     unset( $post_data['filter'] );     $post_ID = (int) $post_data['post_ID'];     $post = get_post( $post_ID );     $post_data['post_type'] = $post->post_type;     $post_data['post_mime_type'] = $post->post_mime_type;     if ( ! empty( $post_data['post_status'] ) ) {         $post_data['post_status'] = sanitize_key( $post_data['post_status'] );         if ( 'inherit' == $post_data['post_status'] ) {             unset( $post_data['post_status'] );         }     }     $ptype = get_post_type_object($post_data['post_type']);     if ( !current_user_can( 'edit_post', $post_ID ) ) {         if ( 'page' == $post_data['post_type'] )             wp_die( __('You are not allowed to edit this page.' ));         else             wp_die( __('You are not allowed to edit this post.' ));     }

case 'edit_post':     case 'edit_page':         $post = get_post( $args[0] );         if ( empty( $post ) )             break;         if ( 'revision' == $post->post_type ) {             $post = get_post( $post->post_parent );         }

public function has_cap( $cap ) {         if ( is_numeric( $cap ) ) {             _deprecated_argument( __FUNCTION__, '2.0', __('Usage of user levels by plugins and themes is deprecated. Use roles and capabilities instead.') );             $cap = $this->translate_level_to_cap( $cap );         }         $args = array_slice( func_get_args(), 1 );         $args = array_merge( array( $cap, $this->ID ), $args );         $caps = call_user_func_array( 'map_meta_cap', $args );         // Multisite super admin has all caps by definition, Unless specifically denied.         if ( is_multisite() && is_super_admin( $this->ID ) ) {             if ( in_array('do_not_allow', $caps) )                 return false;             return true;         }         $capabilities = apply_filters( 'user_has_cap', $this->allcaps, $caps, $args, $this );         $capabilities['exist'] = true; // Everyone is allowed to exist         foreach ( (array) $caps as $cap ) {             if ( empty( $capabilities[ $cap ] ) )                 return false;         }         return true;     }

if ( isset( $post_data['tax_input'] ) ) {         foreach ( (array) $post_data['tax_input'] as $taxonomy => $terms ) {             // Hierarchical taxonomy data is already sent as term IDs, so no conversion is necessary.             if ( is_taxonomy_hierarchical( $taxonomy ) ) {                 continue;             }             if ( ! is_array( $terms ) ) {                 $comma = _x( ',', 'tag delimiter' );                 if ( ',' !== $comma ) {                     $terms = str_replace( $comma, ',', $terms );                 }                 $terms = explode( ',', trim( $terms, " /n/t/r/x0B," ) );             }             $clean_terms = array();             foreach ( $terms as $term ) {                 // Empty terms are invalid input.                 if ( empty( $term ) ) {                     continue;                 }                 $_term = get_terms( $taxonomy, array(                     'name' => $term,                     'fields' => 'ids',                     'hide_empty' => false,                 ) );

revisions字段用于记录草稿或者更新的发布，Wordpress中用revisions记录对于完成的提交和存储都会在posts数据库表中将post_type设置成revision，每个revision都会有一个’post_parent’字段，指明这个revision所基于的原版提交。

当尝试编辑一个revision时，会通过post_parent来进行校验，而不是revision本身。这样，如果我们基于一个post创建一个revision，那么我们可以任意设置它的状态为“trash”之外的任何状态，即使原始的post的状态是“trash”

使用这个trick，我们能够编辑这个“puppet revision”（傀儡文章？）和自由的向他添加评论，即使他的原版post已经被丢弃到了垃圾箱当中。

function wp_untrash_post_comments( $post = null ) {     global $wpdb;     $post = get_post($post);     if ( empty($post) )         return;     $post_id = $post->ID;     $statuses = get_post_meta($post_id, '_wp_trash_meta_comments_status', true);     if ( empty($statuses) )         return true;     do_action( 'untrash_post_comments', $post_id );     // Restore each comment to its original status.     $group_by_status = array();     foreach ( $statuses as $comment_id => $comment_status )         $group_by_status[$comment_status][] = $comment_id;     foreach ( $group_by_status as $status => $comments ) {         // Sanity check. This shouldn't happen.         if ( 'post-trashed' == $status )             $status = '0';         $comments_in = implode( "', '", $comments );         $wpdb->query( "UPDATE $wpdb->comments SET comment_approved = '$status' WHERE comment_ID IN ('" . $comments_in . "')" );     }     clean_comment_cache( array_keys($statuses) );     delete_post_meta($post_id, '_wp_trash_meta_comments_status');     do_action( 'untrashed_post_comments', $post_id ); }