Make WordPress Core

Ticket #3937: add_query_arg_output_sanitization.001.diff

File add_query_arg_output_sanitization.001.diff, 13.6 KB (added by markjaquith, 18 years ago)

Patch for entire /wordpress/ family

  • trunk/wp-includes/script-loader.php

     
    150150                                                $ver .= '&' . $this->args[$handle];
    151151                                        $src = 0 === strpos($this->scripts[$handle]->src, 'http://') ? $this->scripts[$handle]->src : get_option( 'siteurl' ) . $this->scripts[$handle]->src;
    152152                                        $src = add_query_arg('ver', $ver, $src);
    153                                         $src = apply_filters( 'script_loader_src', $src );
     153                                        $src = attribute_escape(apply_filters( 'script_loader_src', $src ));
    154154                                        echo "<script type='text/javascript' src='$src'></script>\n";
    155155                                        $this->print_scripts_l10n( $handle );
    156156                                }
  • trunk/wp-admin/edit-comments.php

     
    101101$r = '';
    102102if ( 1 < $page ) {
    103103        $args['apage'] = ( 1 == $page - 1 ) ? FALSE : $page - 1;
    104         $r .=  '<a class="prev" href="' . add_query_arg( $args ) . '">&laquo; '. __('Previous Page') .'</a>' . "\n";
     104        $r .=  '<a class="prev" href="' . attribute_escape(add_query_arg( $args )) . '">&laquo; '. __('Previous Page') .'</a>' . "\n";
    105105}
    106106if ( ( $total_pages = ceil( $total / 20 ) ) > 1 ) {
    107107        for ( $page_num = 1; $page_num <= $total_pages; $page_num++ ) :
     
    111111                        $p = false;
    112112                        if ( $page_num < 3 || ( $page_num >= $page - 3 && $page_num <= $page + 3 ) || $page_num > $total_pages - 3 ) :
    113113                                $args['apage'] = ( 1 == $page_num ) ? FALSE : $page_num;
    114                                 $r .= '<a class="page-numbers" href="' . add_query_arg($args) . '">' . ( $page_num ) . "</a>\n";
     114                                $r .= '<a class="page-numbers" href="' . attribute_escape(add_query_arg($args)) . '">' . ( $page_num ) . "</a>\n";
    115115                                $in = true;
    116116                        elseif ( $in == true ) :
    117117                                $r .= "...\n";
     
    122122}
    123123if ( ( $page ) * 20 < $total || -1 == $total ) {
    124124        $args['apage'] = $page + 1;
    125         $r .=  '<a class="next" href="' . add_query_arg($args) . '">'. __('Next Page') .' &raquo;</a>' . "\n";
     125        $r .=  '<a class="next" href="' . attribute_escape(add_query_arg($args)) . '">'. __('Next Page') .' &raquo;</a>' . "\n";
    126126}
    127127echo "<p class='pagenav'>$r</p>";
    128128?>
     
    248248$r = '';
    249249if ( 1 < $page ) {
    250250        $args['apage'] = ( 1 == $page - 1 ) ? FALSE : $page - 1;
    251         $r .=  '<a class="prev" href="' . add_query_arg( $args ) . '">&laquo; '. __('Previous Page') .'</a>' . "\n";
     251        $r .=  '<a class="prev" href="' . attribute_escape(add_query_arg( $args )) . '">&laquo; '. __('Previous Page') .'</a>' . "\n";
    252252}
    253253if ( ( $total_pages = ceil( $total / 20 ) ) > 1 ) {
    254254        for ( $page_num = 1; $page_num <= $total_pages; $page_num++ ) :
     
    258258                        $p = false;
    259259                        if ( $page_num < 3 || ( $page_num >= $page - 3 && $page_num <= $page + 3 ) || $page_num > $total_pages - 3 ) :
    260260                                $args['apage'] = ( 1 == $page_num ) ? FALSE : $page_num;
    261                                 $r .= '<a class="page-numbers" href="' . add_query_arg($args) . '">' . ( $page_num ) . "</a>\n";
     261                                $r .= '<a class="page-numbers" href="' . attribute_escape(add_query_arg($args)) . '">' . ( $page_num ) . "</a>\n";
    262262                                $in = true;
    263263                        elseif ( $in == true ) :
    264264                                $r .= "...\n";
     
    269269}
    270270if ( ( $page ) * 20 < $total || -1 == $total ) {
    271271        $args['apage'] = $page + 1;
    272         $r .=  '<a class="next" href="' . add_query_arg($args) . '">'. __('Next Page') .' &raquo;</a>' . "\n";
     272        $r .=  '<a class="next" href="' . attribute_escape(add_query_arg($args)) . '">'. __('Next Page') .' &raquo;</a>' . "\n";
    273273}
    274274echo "<p class='pagenav'>$r</p>";
    275275?>
  • trunk/wp-admin/admin-functions.php

     
    19351935        if (strpos($size, 'g') !== false)
    19361936                $bytes = $size * 1024 * 1024 * 1024;
    19371937?>
    1938 <form enctype="multipart/form-data" id="import-upload-form" method="post" action="<?php echo $action ?>">
     1938<form enctype="multipart/form-data" id="import-upload-form" method="post" action="<?php echo attribute_escape($action) ?>">
    19391939<p>
    19401940<label for="upload"><?php _e( 'Choose a file from your computer:' ); ?></label> (<?php printf( __('Maximum size: %s' ), $size ); ?> )
    19411941<input type="file" id="upload" name="import" size="25" />
  • trunk/wp-admin/custom-header.php

     
    174174<h2><?php _e('Upload New Header Image'); ?></h2><p><?php _e('Here you can upload a custom header image to be shown at the top of your blog instead of the default one. On the next screen you will be able to crop the image.'); ?></p>
    175175<p><?php printf(__('Images of exactly <strong>%1$d x %2$d pixels</strong> will be used as-is.'), HEADER_IMAGE_WIDTH, HEADER_IMAGE_HEIGHT); ?></p>
    176176
    177 <form enctype="multipart/form-data" id="uploadForm" method="POST" action="<?php echo add_query_arg('step', 2) ?>" style="margin: auto; width: 50%;">
     177<form enctype="multipart/form-data" id="uploadForm" method="POST" action="<?php echo attribute_escape(add_query_arg('step', 2)) ?>" style="margin: auto; width: 50%;">
    178178<label for="upload"><?php _e('Choose an image from your computer:'); ?></label><br /><input type="file" id="upload" name="import" />
    179179<input type="hidden" name="action" value="save" />
    180180<p class="submit">
     
    188188<div class="wrap">
    189189<h2><?php _e('Reset Header Image and Color'); ?></h2>
    190190<p><?php _e('This will restore the original header image and color. You will not be able to retrieve any customizations.') ?></p>
    191 <form method="post" action="<?php echo add_query_arg('step', 1) ?>">
     191<form method="post" action="<?php echo attribute_escape(add_query_arg('step', 1)) ?>">
    192192<input type="submit" name="resetheader" value="<?php _e('Restore Original Header'); ?>" />
    193193</form>
    194194</div>
     
    240240
    241241<div class="wrap">
    242242
    243 <form method="POST" action="<?php echo add_query_arg('step', 3) ?>">
     243<form method="POST" action="<?php echo attribute_escape(add_query_arg('step', 3)) ?>">
    244244
    245245<p><?php _e('Choose the part of the image you want to use as your header.'); ?></p>
    246246<div id="testWrap">
  • branches/2.0/wp-admin/admin-functions.php

     
    18101810o.submit();
    18111811}
    18121812</script>
    1813 <form enctype="multipart/form-data" id="uploadForm" method="post" action="<?php echo $action ?>">
     1813<form enctype="multipart/form-data" id="uploadForm" method="post" action="<?php echo attribute_escape($action) ?>">
    18141814<label for="upload"><?php _e('File:'); ?></label><input type="file" id="upload" name="import" />
    18151815<input type="hidden" name="action" value="save" />
    18161816<div id="buttons">
  • branches/2.1/wp-includes/script-loader.php

     
    7878                                        if ( isset($this->args[$handle]) )
    7979                                                $ver .= '&amp;' . $this->args[$handle];
    8080                                        $src = 0 === strpos($this->scripts[$handle]->src, 'http://') ? $this->scripts[$handle]->src : get_option( 'siteurl' ) . $this->scripts[$handle]->src;
    81                                         $src = add_query_arg('ver', $ver, $src);
     81                                        $src = attribute_escape(add_query_arg('ver', $ver, $src));
    8282                                        echo "<script type='text/javascript' src='$src'></script>\n";
    8383                                }
    8484                                $this->printed[] = $handle;
  • branches/2.1/wp-admin/edit-comments.php

     
    101101$r = '';
    102102if ( 1 < $page ) {
    103103        $args['apage'] = ( 1 == $page - 1 ) ? FALSE : $page - 1;
    104         $r .=  '<a class="prev" href="' . add_query_arg( $args ) . '">&laquo; '. __('Previous Page') .'</a>' . "\n";
     104        $r .=  '<a class="prev" href="' . attribute_escape(add_query_arg( $args )) . '">&laquo; '. __('Previous Page') .'</a>' . "\n";
    105105}
    106106if ( ( $total_pages = ceil( $total / 20 ) ) > 1 ) {
    107107        for ( $page_num = 1; $page_num <= $total_pages; $page_num++ ) :
     
    111111                        $p = false;
    112112                        if ( $page_num < 3 || ( $page_num >= $page - 3 && $page_num <= $page + 3 ) || $page_num > $total_pages - 3 ) :
    113113                                $args['apage'] = ( 1 == $page_num ) ? FALSE : $page_num;
    114                                 $r .= '<a class="page-numbers" href="' . add_query_arg($args) . '">' . ( $page_num ) . "</a>\n";
     114                                $r .= '<a class="page-numbers" href="' . attribute_escape(add_query_arg($args)) . '">' . ( $page_num ) . "</a>\n";
    115115                                $in = true;
    116116                        elseif ( $in == true ) :
    117117                                $r .= "...\n";
     
    122122}
    123123if ( ( $page ) * 20 < $total || -1 == $total ) {
    124124        $args['apage'] = $page + 1;
    125         $r .=  '<a class="next" href="' . add_query_arg($args) . '">'. __('Next Page') .' &raquo;</a>' . "\n";
     125        $r .=  '<a class="next" href="' . attribute_escape(add_query_arg($args)) . '">'. __('Next Page') .' &raquo;</a>' . "\n";
    126126}
    127127echo "<p class='pagenav'>$r</p>";
    128128?>
     
    248248$r = '';
    249249if ( 1 < $page ) {
    250250        $args['apage'] = ( 1 == $page - 1 ) ? FALSE : $page - 1;
    251         $r .=  '<a class="prev" href="' . add_query_arg( $args ) . '">&laquo; '. __('Previous Page') .'</a>' . "\n";
     251        $r .=  '<a class="prev" href="' . attribute_escape(add_query_arg( $args )) . '">&laquo; '. __('Previous Page') .'</a>' . "\n";
    252252}
    253253if ( ( $total_pages = ceil( $total / 20 ) ) > 1 ) {
    254254        for ( $page_num = 1; $page_num <= $total_pages; $page_num++ ) :
     
    258258                        $p = false;
    259259                        if ( $page_num < 3 || ( $page_num >= $page - 3 && $page_num <= $page + 3 ) || $page_num > $total_pages - 3 ) :
    260260                                $args['apage'] = ( 1 == $page_num ) ? FALSE : $page_num;
    261                                 $r .= '<a class="page-numbers" href="' . add_query_arg($args) . '">' . ( $page_num ) . "</a>\n";
     261                                $r .= '<a class="page-numbers" href="' . attribute_escape(add_query_arg($args)) . '">' . ( $page_num ) . "</a>\n";
    262262                                $in = true;
    263263                        elseif ( $in == true ) :
    264264                                $r .= "...\n";
     
    269269}
    270270if ( ( $page ) * 20 < $total || -1 == $total ) {
    271271        $args['apage'] = $page + 1;
    272         $r .=  '<a class="next" href="' . add_query_arg($args) . '">'. __('Next Page') .' &raquo;</a>' . "\n";
     272        $r .=  '<a class="next" href="' . attribute_escape(add_query_arg($args)) . '">'. __('Next Page') .' &raquo;</a>' . "\n";
    273273}
    274274echo "<p class='pagenav'>$r</p>";
    275275?>
  • branches/2.1/wp-admin/admin-functions.php

     
    19221922        if ( strstr( $size, 'g' ) )
    19231923                $bytes = $size * 1024 * 1024 * 1024;
    19241924?>
    1925 <form enctype="multipart/form-data" id="import-upload-form" method="post" action="<?php echo $action ?>">
     1925<form enctype="multipart/form-data" id="import-upload-form" method="post" action="<?php echo attribute_escape($action) ?>">
    19261926<p>
    19271927<label for="upload"><?php _e( 'Choose a file from your computer:' ); ?></label> (<?php printf( __('Maximum size: %s' ), $size ); ?> )
    19281928<input type="file" id="upload" name="import" size="25" />
  • branches/2.1/wp-admin/custom-header.php

     
    174174<h2><?php _e('Upload New Header Image'); ?></h2><p><?php _e('Here you can upload a custom header image to be shown at the top of your blog instead of the default one. On the next screen you will be able to crop the image.'); ?></p>
    175175<p><?php printf(__('Images of exactly <strong>%1$d x %2$d pixels</strong> will be used as-is.'), HEADER_IMAGE_WIDTH, HEADER_IMAGE_HEIGHT); ?></p>
    176176
    177 <form enctype="multipart/form-data" id="uploadForm" method="POST" action="<?php echo add_query_arg('step', 2) ?>" style="margin: auto; width: 50%;">
     177<form enctype="multipart/form-data" id="uploadForm" method="POST" action="<?php echo attribute_escape(add_query_arg('step', 2)) ?>" style="margin: auto; width: 50%;">
    178178<label for="upload"><?php _e('Choose an image from your computer:'); ?></label><br /><input type="file" id="upload" name="import" />
    179179<input type="hidden" name="action" value="save" />
    180180<p class="submit">
     
    188188<div class="wrap">
    189189<h2><?php _e('Reset Header Image and Color'); ?></h2>
    190190<p><?php _e('This will restore the original header image and color. You will not be able to retrieve any customizations.') ?></p>
    191 <form method="post" action="<?php echo add_query_arg('step', 1) ?>">
     191<form method="post" action="<?php echo attribute_escape(add_query_arg('step', 1)) ?>">
    192192<input type="submit" name="resetheader" value="<?php _e('Restore Original Header'); ?>" />
    193193</form>
    194194</div>
     
    240240
    241241<div class="wrap">
    242242
    243 <form method="POST" action="<?php echo add_query_arg('step', 3) ?>">
     243<form method="POST" action="<?php echo attribute_escape(add_query_arg('step', 3)) ?>">
    244244
    245245<p><?php _e('Choose the part of the image you want to use as your header.'); ?></p>
    246246<div id="testWrap">
  • branches/2.1/wp-admin/upload-functions.php

     
    3535        $r = '';
    3636
    3737        if ( $href )
    38                 $r .= "<a id='file-link-$id' href='$href' title='$post_title' class='file-link $class'>\n";
     38                $r .= "<a id='file-link-$id' href='" . attribute_escape($href) ."' title='$post_title' class='file-link $class'>\n";
    3939        if ( $href || $image_src )
    4040                $r .= "\t\t\t$innerHTML";
    4141        if ( $href )