Ticket #11119: press-this.002.diff

wp-admin/press-this.php

@@ -91 +91 @@
 }
 
 // Set Variables
-$title = isset($_GET['t']) ? esc_html(aposfix(stripslashes($_GET['t']))) : '';
-$selection = isset($_GET['s']) ? trim( aposfix( stripslashes($_GET['s']) ) ) : '';
+$title = isset( $_GET['t'] ) ? trim( strip_tags( aposfix( stripslashes( $_GET['t'] ) ) ) ) : '';
+$selection = isset( $_GET['s'] ) ? trim( htmlspecialchars( html_entity_decode( aposfix( stripslashes( $_GET['s'] ) ) ) ) ) : '';
 if ( ! empty($selection) ) {
         $selection = preg_replace('/(\r?\n|\r)/', '</p><p>', $selection);
         $selection = '<p>'.str_replace('<p></p>', '', $selection).'</p>';
 }
+
 $url = isset($_GET['u']) ? esc_url($_GET['u']) : '';
 $image = isset($_GET['i']) ? $_GET['i'] : '';
 
@@ -119 +120 @@
                         <div class="postbox">
                                 <h2><label for="embed-code"><?php _e('Embed Code') ?></label></h2>
                                 <div class="inside">
-                                        <textarea name="embed-code" id="embed-code" rows="8" cols="40"><?php echo format_to_edit($selection, true); ?></textarea>
+                                        <textarea name="embed-code" id="embed-code" rows="8" cols="40"><?php echo wp_htmledit_pre( $selection ); ?></textarea>
                                         <p id="options"><a href="#" class="select button"><?php _e('Insert Video'); ?></a> <a href="#" class="close button"><?php _e('Cancel'); ?></a></p>
                                 </div>
                         </div>
@@ -576 +577 @@
                         <div class="editor-container">
                                 <textarea name="content" id="content" style="width:100%;" class="theEditor" rows="15"><?php
                                         if ( $selection )
-                                                echo wp_richedit_pre(htmlspecialchars_decode($selection));
+                                                echo wp_richedit_pre($selection);
                                         if ( $url ) {
                                                 echo '<p>';
                                                 if ( $selection )