Changeset 11720

Timestamp:

07/18/2009 11:21:00 PM (15 years ago)

Author:

azaozz

Message:

Properly escape comment_author_url when displaying, for 2.8

Location:

branches/2.8

Files:

• wp-admin/comment.php (modified) (2 diffs)
• wp-admin/edit-form-comment.php (modified) (3 diffs)
• wp-admin/includes/comment.php (modified) (1 diff)
• wp-admin/includes/template.php (modified) (1 diff)
• wp-includes/comment-template.php (modified) (1 diff)

branches/2.8/wp-admin/comment.php

@@ -23 +23 @@
  * @param string $msg Error Message. Assumed to contain HTML and be sanitized.
  */
-function comment_footer_die( $msg ) {  //
+function comment_footer_die( $msg ) {
     echo "<div class='wrap'><p>$msg</p></div>";
     include('admin-footer.php');
@@ -120 +120 @@
 <tr>
 <th scope="row"><?php _e('URL'); ?></th>
-<td><a href='<?php echo $comment->comment_author_url; ?>'><?php echo $comment->comment_author_url; ?></a></td>
+<td><a href="<?php echo $comment->comment_author_url; ?>"><?php echo $comment->comment_author_url; ?></a></td>
 </tr>
 <?php } ?>

branches/2.8/wp-admin/edit-form-comment.php

@@ -25 +25 @@
 <input type="hidden" name="user_ID" value="<?php echo (int) $user_ID ?>" />
 <input type="hidden" name="action" value='<?php echo $form_action . $form_extra ?>' />
-<?php
-
-$email = esc_attr( $comment->comment_author_email );
-$url = esc_attr( $comment->comment_author_url );
-// add_meta_box('submitdiv', __('Save'), 'comment_submit_meta_box', 'comment', 'side', 'core');
-?>
 
 <div id="side-info-column" class="inner-sidebar">
@@ -96 +90 @@
     <td class="first">
     <?php
-        if ( $email ) {
+        if ( $comment->comment_author_email ) {
             printf( __( 'E-mail (%s):' ), get_comment_author_email_link( __( 'send e-mail' ), '', '' ) );
         } else {
@@ -102 +96 @@
         }
 ?></td>
-    <td><input type="text" name="newcomment_author_email" size="30" value="<?php echo esc_attr($email); ?>" tabindex="2" id="email" /></td>
+    <td><input type="text" name="newcomment_author_email" size="30" value="<?php echo $comment->comment_author_email; ?>" tabindex="2" id="email" /></td>
 </tr>
 <tr valign="top">
     <td class="first">
     <?php
-        $url = get_comment_author_url();
-        if ( ! empty( $url ) && 'http://' != $url ) {
-            $link = "<a href='$url' rel='external nofollow' target='_blank'>" . __('visit site') . "</a>";
+        if ( ! empty( $comment->comment_author_url ) && 'http://' != $comment->comment_author_url ) {
+            $link = '<a href="' . $comment->comment_author_url . '" rel="external nofollow" target="_blank">' . __('visit site') . '</a>';
             printf( __( 'URL (%s):' ), apply_filters('get_comment_author_link', $link ) );
         } else {

branches/2.8/wp-admin/includes/comment.php

@@ -90 +90 @@
     $comment->comment_author = format_to_edit( $comment->comment_author );
     $comment->comment_author_email = format_to_edit( $comment->comment_author_email );
+    $comment->comment_author_url = format_to_edit( $comment->comment_author_url );
     $comment->comment_author_url = esc_url($comment->comment_author_url);
-    $comment->comment_author_url = format_to_edit( $comment->comment_author_url );
 
     return $comment;

branches/2.8/wp-admin/includes/template.php

@@ -2086 +2086 @@
     if ( 'http://' == $author_url )
         $author_url = '';
-    $author_url_display = $author_url;
-    $author_url_display = str_replace('http://www.', '', $author_url_display);
-    $author_url_display = str_replace('http://', '', $author_url_display);
+    $author_url_display = preg_replace('|http://(www\.)?|i', '', $author_url);
     if ( strlen($author_url_display) > 50 )
         $author_url_display = substr($author_url_display, 0, 49) . '...';

branches/2.8/wp-includes/comment-template.php

@@ -195 +195 @@
     global $comment;
     $url = ('http://' == $comment->comment_author_url) ? '' : $comment->comment_author_url;
+    $url = esc_url( $url, array('http', 'https') );
     return apply_filters('get_comment_author_url', $url);
 }