Changeset 14673 for trunk/wp-admin/includes/template.php

Timestamp:

05/15/2010 08:36:49 PM (16 years ago)

Author:

nacin

Message:

More validation fixes. Escape some preview=true URLs, also clean up tags in edit-attachment-rows. Slight CSS tweak to match presentation to the formerly invalid HTML. props zeo, see #13383.

File:

• trunk/wp-admin/includes/template.php (modified) (2 diffs)

trunk/wp-admin/includes/template.php

@@ -1362 +1362 @@
             if ( in_array($post->post_status, array('pending', 'draft')) ) {
                 if ( current_user_can($post_type_object->cap->edit_post, $post->ID) )
-                    $actions['view'] = '<a href="' . add_query_arg( 'preview', 'true', get_permalink($post->ID) ) . '" title="' . esc_attr(sprintf(__('Preview &#8220;%s&#8221;'), $title)) . '" rel="permalink">' . __('Preview') . '</a>';
+                    $actions['view'] = '<a href="' . esc_url( add_query_arg( 'preview', 'true', get_permalink($post->ID) ) ) . '" title="' . esc_attr(sprintf(__('Preview &#8220;%s&#8221;'), $title)) . '" rel="permalink">' . __('Preview') . '</a>';
             } elseif ( 'trash' != $post->post_status ) {
                 $actions['view'] = '<a href="' . get_permalink($post->ID) . '" title="' . esc_attr(sprintf(__('View &#8220;%s&#8221;'), $title)) . '" rel="permalink">' . __('View') . '</a>';
@@ -1584 +1584 @@
         if ( in_array($post->post_status, array('pending', 'draft')) ) {
             if ( current_user_can($post_type_object->cap->edit_post, $page->ID) )
-                $actions['view'] = '<a href="' . add_query_arg( 'preview', 'true', get_permalink($page->ID) ) . '" title="' . esc_attr(sprintf(__('Preview &#8220;%s&#8221;'), $title)) . '" rel="permalink">' . __('Preview') . '</a>';
+                $actions['view'] = '<a href="' . esc_url( add_query_arg( 'preview', 'true', get_permalink($page->ID) ) ) . '" title="' . esc_attr(sprintf(__('Preview &#8220;%s&#8221;'), $title)) . '" rel="permalink">' . __('Preview') . '</a>';
         } elseif ( $post->post_status != 'trash' ) {
             $actions['view'] = '<a href="' . get_permalink($page->ID) . '" title="' . esc_attr(sprintf(__('View &#8220;%s&#8221;'), $title)) . '" rel="permalink">' . __('View') . '</a>';