WordPress.org
Get WordPress

Make WordPress Core


Ignore:
Timestamp:
04/27/2009 11:09:08 PM (17 years ago)
Author:
ryan
Message:

Some attr escaping. see #9650

File:
1 edited

Legend:

Unmodified
Added
Removed

  • trunk/wp-admin/edit-form-advanced.php

    r10995 r11104  
    3434    $form_action = 'post';
    3535    $temp_ID = -1 * time(); // don't change this formula without looking at wp_write_post()
    36     $form_extra = "<input type='hidden' id='post_ID' name='temp_ID' value='$temp_ID' />";
     36    $form_extra = "<input type='hidden' id='post_ID' name='temp_ID' value='" . attr($temp_ID) . "' />";
    3737    $autosave = false;
    3838} else {
    3939    $form_action = 'editpost';
    40     $form_extra = "<input type='hidden' id='post_ID' name='post_ID' value='$post_ID' />";
     40    $form_extra = "<input type='hidden' id='post_ID' name='post_ID' value='" . attr($post_ID) . "' />";
    4141    $autosave = wp_get_post_autosave( $post_ID );
    4242
    … …  
    7373<?php // Hidden submit button early on so that the browser chooses the right button when form is submitted with Return key ?>
    7474<div style="display:none;">
    75 <input type="submit" name="save" value="<?php echo attribute_escape( __('Save') ); ?>" />
     75<input type="submit" name="save" value="<?php _ea('Save'); ?>" />
    7676</div>
    7777
    … …  
    7979<div id="save-action">
    8080<?php if ( 'publish' != $post->post_status && 'future' != $post->post_status && 'pending' != $post->post_status )  { ?>
    81 <input <?php if ( 'private' == $post->post_status ) { ?>style="display:none"<?php } ?> type="submit" name="save" id="save-post" value="<?php echo attribute_escape( __('Save Draft') ); ?>" tabindex="4" class="button button-highlighted" />
     81<input <?php if ( 'private' == $post->post_status ) { ?>style="display:none"<?php } ?> type="submit" name="save" id="save-post" value="<?php _ea('Save Draft'); ?>" tabindex="4" class="button button-highlighted" />
    8282<?php } elseif ( 'pending' == $post->post_status && $can_publish ) { ?>
    83 <input type="submit" name="save" id="save-post" value="<?php echo attribute_escape( __('Save as Pending') ); ?>" tabindex="4" class="button button-highlighted" />
     83<input type="submit" name="save" id="save-post" value="<?php _ea('Save as Pending'); ?>" tabindex="4" class="button button-highlighted" />
    8484<?php } ?>
    8585</div>
    … …  
    130130
    131131<div id="post-status-select" class="hide-if-js">
    132 <input type="hidden" name="hidden_post_status" id="hidden_post_status" value="<?php echo $post->post_status; ?>" />
     132<input type="hidden" name="hidden_post_status" id="hidden_post_status" value="<?php echo attr($post->post_status); ?>" />
    133133<select name='post_status' id='post_status' tabindex='4'>
    134134<?php if ( 'publish' == $post->post_status ) : ?>
    … …  
    239239<?php if ( current_user_can('publish_posts') ) : ?>
    240240    <?php if ( !empty($post->post_date_gmt) && time() < strtotime( $post->post_date_gmt . ' +0000' ) ) : ?>
    241         <input name="original_publish" type="hidden" id="original_publish" value="<?php _e('Schedule') ?>" />
    242         <input name="publish" type="submit" class="button-primary" id="publish" tabindex="5" accesskey="p" value="<?php _e('Schedule') ?>" />
     241        <input name="original_publish" type="hidden" id="original_publish" value="<?php _ea('Schedule') ?>" />
     242        <input name="publish" type="submit" class="button-primary" id="publish" tabindex="5" accesskey="p" value="<?php _ea('Schedule') ?>" />
    243243    <?php else : ?>
    244         <input name="original_publish" type="hidden" id="original_publish" value="<?php _e('Publish') ?>" />
    245         <input name="publish" type="submit" class="button-primary" id="publish" tabindex="5" accesskey="p" value="<?php _e('Publish') ?>" />
     244        <input name="original_publish" type="hidden" id="original_publish" value="<?php _ea('Publish') ?>" />
     245        <input name="publish" type="submit" class="button-primary" id="publish" tabindex="5" accesskey="p" value="<?php _ea('Publish') ?>" />
    246246    <?php endif; ?>
    247247<?php else : ?>
    248     <input name="original_publish" type="hidden" id="original_publish" value="<?php _e('Submit for Review') ?>" />
    249     <input name="publish" type="submit" class="button-primary" id="publish" tabindex="5" accesskey="p" value="<?php _e('Submit for Review') ?>" />
     248    <input name="original_publish" type="hidden" id="original_publish" value="<?php _ea('Submit for Review') ?>" />
     249    <input name="publish" type="submit" class="button-primary" id="publish" tabindex="5" accesskey="p" value="<?php _ea('Submit for Review') ?>" />
    250250<?php endif; ?>
    251251<?php } else { ?>
    252     <input name="original_publish" type="hidden" id="original_publish" value="<?php _e('Update Post') ?>" />
    253     <input name="save" type="submit" class="button-primary" id="publish" tabindex="5" accesskey="p" value="<?php _e('Update Post') ?>" />
     252    <input name="original_publish" type="hidden" id="original_publish" value="<?php _ea('Update Post') ?>" />
     253    <input name="save" type="submit" class="button-primary" id="publish" tabindex="5" accesskey="p" value="<?php _ea('Update Post') ?>" />
    254254<?php } ?>
    255255</div>
    … …  
    277277    <p class="jaxtag">
    278278        <label class="hidden" for="newtag"><?php _e( $box['title'] ); ?></label>
    279         <input type="hidden" name="<?php echo "tax_input[$tax_name]"; ?>" class="the-tags" id="tax-input[<?php echo $tax_name; ?>]" value="<?php echo get_terms_to_edit( $post->ID, $tax_name ); ?>" />
     279        <input type="hidden" name="<?php echo "tax_input[$tax_name]"; ?>" class="the-tags" id="tax-input[<?php echo $tax_name; ?>]" value="<?php echo attr(get_terms_to_edit( $post->ID, $tax_name )); ?>" />
    280280
    281281    <span class="ajaxtag">
    282         <input type="text" name="newtag[<?php echo $tax_name; ?>]" class="newtag form-input-tip" size="16" autocomplete="off" value="<?php _e('Add new tag'); ?>" />
    283         <input type="button" class="button tagadd" value="<?php _e('Add'); ?>" tabindex="3" />
     282        <input type="text" name="newtag[<?php echo $tax_name; ?>]" class="newtag form-input-tip" size="16" autocomplete="off" value="<?php _ea('Add new tag'); ?>" />
     283        <input type="button" class="button tagadd" value="<?php _ea('Add'); ?>" tabindex="3" />
    284284    </span></p>
    285285    <p class="howto"><?php echo $helps; ?></p>
    … …  
    330330    <h4><a id="category-add-toggle" href="#category-add" class="hide-if-no-js" tabindex="3"><?php _e( '+ Add New Category' ); ?></a></h4>
    331331    <p id="category-add" class="wp-hidden-child">
    332         <label class="hidden" for="newcat"><?php _e( 'Add New Category' ); ?></label><input type="text" name="newcat" id="newcat" class="form-required form-input-tip" value="<?php _e( 'New category name' ); ?>" tabindex="3" aria-required="true"/>
     332        <label class="hidden" for="newcat"><?php _e( 'Add New Category' ); ?></label><input type="text" name="newcat" id="newcat" class="form-required form-input-tip" value="<?php _ea( 'New category name' ); ?>" tabindex="3" aria-required="true"/>
    333333        <label class="hidden" for="newcat_parent"><?php _e('Parent category'); ?>:</label><?php wp_dropdown_categories( array( 'hide_empty' => 0, 'name' => 'newcat_parent', 'orderby' => 'name', 'hierarchical' => 1, 'show_option_none' => __('Parent category'), 'tab_index' => 3 ) ); ?>
    334         <input type="button" id="category-add-sumbit" class="add:categorychecklist:category-add button" value="<?php _e( 'Add' ); ?>" tabindex="3" />
     334        <input type="button" id="category-add-sumbit" class="add:categorychecklist:category-add button" value="<?php _ea( 'Add' ); ?>" tabindex="3" />
    335335        <?php wp_nonce_field( 'add-category', '_ajax_nonce', false ); ?>
    336336        <span id="category-ajax-response"></span>
    … …  
    573573
    574574<input type="hidden" id="user-id" name="user_ID" value="<?php echo (int) $user_ID ?>" />
    575 <input type="hidden" id="hiddenaction" name="action" value="<?php echo $form_action ?>" />
    576 <input type="hidden" id="originalaction" name="originalaction" value="<?php echo $form_action ?>" />
     575<input type="hidden" id="hiddenaction" name="action" value="<?php echo attr($form_action) ?>" />
     576<input type="hidden" id="originalaction" name="originalaction" value="<?php echo attr($form_action) ?>" />
    577577<input type="hidden" id="post_author" name="post_author" value="<?php echo attribute_escape( $post->post_author ); ?>" />
    578 <input type="hidden" id="post_type" name="post_type" value="<?php echo $post->post_type ?>" />
    579 <input type="hidden" id="original_post_status" name="original_post_status" value="<?php echo $post->post_status ?>" />
     578<input type="hidden" id="post_type" name="post_type" value="<?php echo attr($post->post_type) ?>" />
     579<input type="hidden" id="original_post_status" name="original_post_status" value="<?php echo attr($post->post_status) ?>" />
    580580<input name="referredby" type="hidden" id="referredby" value="<?php echo clean_url(stripslashes(wp_get_referer())); ?>" />
    581581<?php if ( 'draft' != $post->post_status ) wp_original_referer_field(true, 'previous'); ?>
Note: See TracChangeset for help on using the changeset viewer.