Ticket #3113: write_validation.diff

wp-admin/admin-functions.php

@@ -958 +958 @@
         global $post_ID;
         // Exit if no meta
         if (!$meta) {
-                echo '<tbody id="the-list"></tbody>'; //TBODY needed for list-manipulation JS
+                echo '<tbody id="the-list"><tr style="display: none;"><td>&nbsp;</td></tr></tbody>'; //TBODY needed for list-manipulation JS
                 return;
         }
         $count = 0;
@@ -1254 +1254 @@
                 <div id="quicktags">
                         ';
                 wp_print_scripts( 'quicktags' );
-                echo '                  <script type="text/javascript">if ( typeof tinyMCE == "undefined" || tinyMCE.configs.length < 1 ) edToolbar();</script>
+                echo '                  <script type="text/javascript">
+                                //<![CDATA[
+                                if ( typeof tinyMCE == "undefined" || tinyMCE.configs.length < 1 ) edToolbar();
+                                //]]>
+                        </script>
                 </div>
 ';
         echo '

wp-admin/edit-form-advanced.php

@@ -183 +183 @@
         $uploading_iframe_src = wp_nonce_url("inline-uploading.php?action=view&post=$uploading_iframe_ID", 'inlineuploading');
         $uploading_iframe_src = apply_filters('uploading_iframe_src', $uploading_iframe_src);
         if ( false != $uploading_iframe_src )
-                echo '<iframe id="uploading" border="0" src="' . $uploading_iframe_src . '">' . __('This feature requires iframe support.') . '</iframe>';
+                echo '<iframe id="uploading" frameborder="0" src="' . $uploading_iframe_src . '">' . __('This feature requires iframe support.') . '</iframe>';
 }
 ?>
 

wp-admin/edit-page-form.php

@@ -159 +159 @@
         $uploading_iframe_src = wp_nonce_url("inline-uploading.php?action=view&post=$uploading_iframe_ID", 'inlineuploading');
         $uploading_iframe_src = apply_filters('uploading_iframe_src', $uploading_iframe_src);
         if ( false != $uploading_iframe_src )
-                echo '<iframe id="uploading" border="0" src="' . $uploading_iframe_src . '">' . __('This feature requires iframe support.') . '</iframe>';
+                echo '<iframe id="uploading" frameborder="0" src="' . $uploading_iframe_src . '">' . __('This feature requires iframe support.') . '</iframe>';
 }
 ?>
 
@@ -191 +191 @@
         if ( current_user_can('delete_page', $post->ID) ) ?>
                 <input name="deletepost" class="button" type="submit" id="deletepost" tabindex="10" value="<?php _e('Delete this page') ?>" <?php echo "onclick=\"if ( confirm('" . sprintf(__("You are about to delete this page \'%s\'\\n  \'Cancel\' to stop, \'OK\' to delete."), js_escape($post->post_title) ) . "') ) { document.forms.post._wpnonce.value = '$delete_nonce'; return true;}return false;\""; ?> />
 <?php endif; ?>
+</div>
+
 </form>
 
 </div>
-
-</div>

wp-admin/page.php

@@ -57 +57 @@
         ?>
         <div id='preview' class='wrap'>
         <h2 id="preview-post"><?php _e('Page Preview (updated when page is saved)'); ?> <small class="quickjump"><a href="#write-post"><?php _e('edit &uarr;'); ?></a></small></h2>
-                <iframe src="<?php echo apply_filters('preview_page_link', add_query_arg('preview', 'true', get_permalink($post->ID))); ?>" width="100%" height="600" ></iframe>
+                <iframe src="<?php echo wp_specialchars(apply_filters('preview_page_link', add_query_arg('preview', 'true', get_permalink($post->ID)))); ?>" width="100%" height="600" ></iframe>
         </div>
         <?php
         break;

wp-admin/post.php

@@ -63 +63 @@
         ?>
         <div id='preview' class='wrap'>
         <h2 id="preview-post"><?php _e('Post Preview (updated when post is saved)'); ?> <small class="quickjump"><a href="#write-post"><?php _e('edit &uarr;'); ?></a></small></h2>
-                <iframe src="<?php echo apply_filters('preview_post_link', add_query_arg('preview', 'true', get_permalink($post->ID))); ?>" width="100%" height="600" ></iframe>
+                <iframe src="<?php echo wp_specialchars(apply_filters('preview_post_link', add_query_arg('preview', 'true', get_permalink($post->ID)))); ?>" width="100%" height="600" ></iframe>
         </div>
         <?php
         break;