Changeset 12539

Timestamp:

12/24/2009 04:08:15 PM (15 years ago)

Author:

ryan

Message:

Some hardening for 2.8

Location:

branches/2.8

Files:

• wp-admin/includes/template.php (modified) (4 diffs)
• wp-includes/pluggable.php (modified) (1 diff)

branches/2.8/wp-admin/includes/template.php

@@ -2096 +2096 @@
         $ptime = mysql2date(__('Y/m/d \a\t g:i A'), $comment->comment_date );
 
+    $comment_url = esc_url(get_comment_link($comment->comment_ID));
     $delete_url = esc_url( wp_nonce_url( "comment.php?action=deletecomment&p=$post->ID&c=$comment->comment_ID", "delete-comment_$comment->comment_ID" ) );
     $approve_url = esc_url( wp_nonce_url( "comment.php?action=approvecomment&p=$post->ID&c=$comment->comment_ID", "approve-comment_$comment->comment_ID" ) );
@@ -2123 +2124 @@
                 echo "<td $attributes>";
                 echo '<div id="submitted-on">';
-                printf(__('Submitted on <a href="%1$s">%2$s at %3$s</a>'), get_comment_link($comment->comment_ID), get_comment_date(__('Y/m/d')), get_comment_date(__('g:ia')));
+                printf(__('Submitted on <a href="%1$s">%2$s at %3$s</a>'), $comment_url, get_comment_date(__('Y/m/d')), get_comment_date(__('g:ia')));
                 echo '</div>';
                 comment_text(); ?>
@@ -2141 +2142 @@
                     if ( $comment_status && 'all' != $comment_status ) { // not looking at all comments
                         if ( 'approved' == $the_comment_status ) {
-                            $actions['unapprove'] = "<a href='$unapprove_url' class='delete:the-comment-list:comment-$comment->comment_ID:e7e7d3:action=dim-comment&amp;new=unapproved vim-u vim-destructive' title='" . __( 'Unapprove this comment' ) . "'>" . __( 'Unapprove' ) . '</a>';
+                            $actions['unapprove'] = "<a href='$unapprove_url' class='delete:the-comment-list:comment-$comment->comment_ID:e7e7d3:action=dim-comment&amp;new=unapproved vim-u vim-destructive' title='" . esc_attr__( 'Unapprove this comment' ) . "'>" . __( 'Unapprove' ) . '</a>';
                             unset($actions['approve']);
                         } else {
-                            $actions['approve'] = "<a href='$approve_url' class='delete:the-comment-list:comment-$comment->comment_ID:e7e7d3:action=dim-comment&amp;new=approved vim-a vim-destructive' title='" . __( 'Approve this comment' ) . "'>" . __( 'Approve' ) . '</a>';
+                            $actions['approve'] = "<a href='$approve_url' class='delete:the-comment-list:comment-$comment->comment_ID:e7e7d3:action=dim-comment&amp;new=approved vim-a vim-destructive' title='" . esc_attr__( 'Approve this comment' ) . "'>" . __( 'Approve' ) . '</a>';
                             unset($actions['unapprove']);
                         }
                     }
                     if ( 'spam' != $the_comment_status )
-                        $actions['spam'] = "<a href='$spam_url' class='delete:the-comment-list:comment-$comment->comment_ID::spam=1 vim-s vim-destructive' title='" . __( 'Mark this comment as spam' ) . "'>" . /* translators: mark as spam link */ _x( 'Spam', 'verb' ) . '</a>';
+                        $actions['spam'] = "<a href='$spam_url' class='delete:the-comment-list:comment-$comment->comment_ID::spam=1 vim-s vim-destructive' title='" . esc_attr__( 'Mark this comment as spam' ) . "'>" . /* translators: mark as spam link */ _x( 'Spam', 'verb' ) . '</a>';
                     $actions['delete'] = "<a href='$delete_url' class='delete:the-comment-list:comment-$comment->comment_ID delete vim-d vim-destructive'>" . __('Delete') . '</a>';
                     $actions['edit'] = "<a href='comment.php?action=editcomment&amp;c={$comment->comment_ID}' title='" . __('Edit comment') . "'>". __('Edit') . '</a>';
@@ -2215 +2216 @@
                     echo '<div class="response-links"><span class="post-com-count-wrapper">';
                     echo $post_link . '<br />';
-                    $pending_phrase = sprintf( __('%s pending'), number_format( $pending_comments ) );
+                    $pending_phrase = esc_attr(sprintf( __('%s pending'), number_format( $pending_comments ) ));
                     if ( $pending_comments )
                         echo '<strong>';

branches/2.8/wp-includes/pluggable.php

@@ -100 +100 @@
 
     if ( ! $user = wp_validate_auth_cookie() ) {
-         if ( empty($_COOKIE[LOGGED_IN_COOKIE]) || !$user = wp_validate_auth_cookie($_COOKIE[LOGGED_IN_COOKIE], 'logged_in') ) {
+         if ( is_admin() || empty($_COOKIE[LOGGED_IN_COOKIE]) || !$user = wp_validate_auth_cookie($_COOKIE[LOGGED_IN_COOKIE], 'logged_in') ) {
             wp_set_current_user(0);
             return false;