Changes from trunk/wp-includes/comment-template.php at r11435 to branches/2.8/wp-includes/comment-template.php at r11725

File:

• branches/2.8/wp-includes/comment-template.php (modified) (2 diffs)

branches/2.8/wp-includes/comment-template.php

@@ -195 +195 @@
     global $comment;
     $url = ('http://' == $comment->comment_author_url) ? '' : $comment->comment_author_url;
+    $url = esc_url( $url, array('http', 'https') );
     return apply_filters('get_comment_author_url', $url);
 }
@@ -818 +819 @@
 
     $req = get_option('require_name_email');
+
+    /**
+     * Comment author information fetched from the comment cookies.
+     *
+     * @uses wp_get_current_commenter()
+     */
     $commenter = wp_get_current_commenter();
-    extract($commenter, EXTR_SKIP);
+
+    /**
+     * The name of the current comment author escaped for use in attributes.
+     */
+    $comment_author = $commenter['comment_author']; // Escaped by sanitize_comment_cookies()
+
+    /**
+     * The email address of the current comment author escaped for use in attributes.
+     */ 
+    $comment_author_email = $commenter['comment_author_email'];  // Escaped by sanitize_comment_cookies()
+
+    /**
+     * The url of the current comment author escaped for use in attributes.
+     */ 
+    $comment_author_url = esc_url($commenter['comment_author_url']);
 
     /** @todo Use API instead of SELECTs. */