Ticket #12400: 12400.2.diff

wp-includes/link-template.php

@@ -2015 +2015 @@
         echo "<link rel='canonical' href='$link' />\n";
 }
 
-?>
+/**
+ * Prints the ajax url on the front end
+ *
+ * @since 3.0
+ **/
+function _wp_ajaxurl() {
+        echo '<script type="text/javascript">',
+                "var ajaxurl = '", site_url('wp-ajax.php'), "';",
+                '</script>';
+}
+
+/**
+ * Hooks _wp_ajaxurl() to wp_head
+ *
+ * @since 3.0
+ **/
+
+function wp_ajaxurl() {
+        add_action('wp_head', '_wp_ajaxurl', 1);
+}
+?>
+ No newline at end of file

wp-ajax.php

@@ +1 @@
+<?php
+/**
+ * Execute an AJAX action.
+ *
+ * To take full advantage of this file, call wp_ajaxurl(); in your theme
+ * or plugin while registering your front-end scripts. Doing so will make
+ * an ajaxurl variable available for use in javascripts. The ajaxurl
+ * variable will point to this file's absolute URL.
+ *
+ * In the admin area, an ajaxurl variable is always available, and points
+ * to wp-admin/admin-ajax.php instead - with slightly different hooks.
+ *
+ * @since 3.0
+ */
+define('DOING_AJAX', true);
+require_once('wp-load.php');
+
+@header('Content-Type: text/html; charset=' . get_option('blog_charset'));
+
+do_action('ajax_init');
+
+$action = !empty($_REQUEST['action']) ? stripslashes($_REQUEST['action']) : false;
+
+if ( !$action || ! has_action('ajax_' . $action) ) {
+        status_header(400); // invalid request
+        exit;
+}
+
+do_action('ajax_' . $action);
+?>
+ No newline at end of file

wp-admin/admin-ajax.php

@@ -43 +43 @@
         }
 
         if ( !empty( $_REQUEST['action'] ) )
-                do_action( 'wp_ajax_nopriv_' . $_REQUEST['action'] );
+                do_action( 'wp_ajax_nopriv_' . stripslashes($_REQUEST['action']) );
 
         die('-1');
 }
@@ -136 +136 @@
         die( $return );
         break;
 default :
-        do_action( 'wp_ajax_' . $_GET['action'] );
+        if ( !empty($_GET['action']) )
+                do_action( 'wp_ajax_' . stripslashes($_GET['action']) );
         die('0');
         break;
 endswitch;
@@ -1414 +1415 @@
         }
         die( '0' );
 default :
-        do_action( 'wp_ajax_' . $_POST['action'] );
+        if ( !empty($_POST['action']) )
+                do_action( 'wp_ajax_' . stripslashes($_POST['action']) );
         die('0');
         break;
 endswitch;