Changeset 14374 for trunk/wp-admin/includes/dashboard.php

Timestamp:

05/03/2010 06:16:22 PM (16 years ago)

Author:

ryan

Message:

Revert [14347] and [14372]. It broke more than we expected. Try again in 3.1. see #13051

File:

• trunk/wp-admin/includes/dashboard.php (modified) (4 diffs)

trunk/wp-admin/includes/dashboard.php

@@ -384 +384 @@
         if ( 'post' === strtolower( $_SERVER['REQUEST_METHOD'] ) && isset( $_POST['action'] ) && 0 === strpos( $_POST['action'], 'post-quickpress' ) && (int) $_POST['post_ID'] ) {
                 $view = get_permalink( $_POST['post_ID'] );
-                $edit = get_edit_post_link( $_POST['post_ID'] );
+                $edit = esc_url( get_edit_post_link( $_POST['post_ID'] ) );
                 if ( 'post-quickpress-publish' == $_POST['action'] ) {
                         if ( current_user_can('publish_posts') )
-                                printf( '<div class="message"><p>' . __( 'Post Published. <a href="%s">View post</a> | <a href="%s">Edit post</a>' ) . '</p></div>', $view , $edit );
+                                printf( '<div class="message"><p>' . __( 'Post Published. <a href="%s">View post</a> | <a href="%s">Edit post</a>' ) . '</p></div>', esc_url( $view ), $edit );
                         else
-                                printf( '<div class="message"><p>' . __( 'Post submitted. <a href="%s">Preview post</a> | <a href="%s">Edit post</a>' ) . '</p></div>', add_query_arg( 'preview', 1, $view ), $edit );
+                                printf( '<div class="message"><p>' . __( 'Post submitted. <a href="%s">Preview post</a> | <a href="%s">Edit post</a>' ) . '</p></div>', esc_url( add_query_arg( 'preview', 1, $view ) ), $edit );
                 } else {
-                        printf( '<div class="message"><p>' . __( 'Draft Saved. <a href="%s">Preview post</a> | <a href="%s">Edit post</a>' ) . '</p></div>', add_query_arg( 'preview', 1, $view ), $edit );
+                        printf( '<div class="message"><p>' . __( 'Draft Saved. <a href="%s">Preview post</a> | <a href="%s">Edit post</a>' ) . '</p></div>', esc_url( add_query_arg( 'preview', 1, $view ) ), $edit );
                         $drafts_query = new WP_Query( array(
                                 'post_type' => 'post',
@@ -411 +411 @@
 ?>
 
-        <form name="post" action="<?php echo admin_url( 'post.php' ); ?>" method="post" id="quick-press">
+        <form name="post" action="<?php echo esc_url( admin_url( 'post.php' ) ); ?>" method="post" id="quick-press">
                 <h4 id="quick-post-title"><label for="title"><?php _e('Title') ?></label></h4>
                 <div class="input-text-wrap">
@@ -444 +444 @@
                         <span id="publishing-action">
                                 <input type="submit" name="publish" id="publish" accesskey="p" tabindex="5" class="button-primary" value="<?php current_user_can('publish_posts') ? esc_attr_e('Publish') : esc_attr_e('Submit for Review'); ?>" />
-                                <img class="waiting" src="<?php echo admin_url( 'images/wpspin_light.gif' ); ?>" />
+                                <img class="waiting" src="<?php echo esc_url( admin_url( 'images/wpspin_light.gif' ) ); ?>" />
                         </span>
                         <br class="clear" />
@@ -559 +559 @@
         $comment_post_title = strip_tags(get_the_title( $comment->comment_post_ID ));
         $comment_post_link = "<a href='$comment_post_url'>$comment_post_title</a>";
-        $comment_link = '<a class="comment-link" href="' . get_comment_link() . '">#</a>';
+        $comment_link = '<a class="comment-link" href="' . esc_url(get_comment_link()) . '">#</a>';
 
         $actions_string = '';