WordPress.org
Get WordPress

Make WordPress Core

Changeset 1743


Ignore:
Timestamp:
10/05/2004 06:59:13 AM (21 years ago)
Author:
saxmatt
Message:

Input cleanup

Location:
trunk/wp-admin
Files:
5 edited

Legend:

Unmodified
Added
Removed

  • trunk/wp-admin/admin-header.php

    r1648 r1743  
    4242<link rel="shortcut icon" href="../wp-images/wp-favicon.png" />
    4343<meta http-equiv="Content-Type" content="text/html; charset=<?php echo get_settings('blog_charset'); ?>" />
    44 <?php
    45 if ($redirect==1) {
    46 ?>
    47 <script type="text/javascript">
    48 <!--
    49 function redirect() {
    50   window.location = "<?php echo $redirect_url; ?>";
    51 }
    52 setTimeout("redirect();", 600);
    53 //-->
    54 </script>
    55 <?php
    56 } // redirect
    57 ?>
    5844
    5945<?php if (isset($xfn)) : ?>

  • trunk/wp-admin/bookmarklet.php

    r1698 r1743  
    11<?php
    2 /* <Bookmarklet> */
    3 
    4 // accepts 'post_title' and 'content' as vars passed in. Add-on from Alex King
    5 
    62$mode = 'bookmarklet';
    73
    … …  
    2420</head>
    2521<body></body>
    26 </html><?php
    27 
     22</html>
     23<?php
    2824} else {
    29 
    30     $popuptitle = stripslashes($popuptitle);
    31     $text = stripslashes(urldecode($text));
     25    $popuptitle = htmlspecialchars(stripslashes($popuptitle));
     26    $text = htmlspecialchars(stripslashes(urldecode($text)));
    3227   
    3328    /* big funky fixes for browsers' javascript bugs */
    … …  
    5853// the var instead of changing the assignment on the lines above.
    5954// -- Alex King 2004-01-07
    60     $edited_post_title = $post_title;
     55    $edited_post_title = htmlspecialchars($post_title);
    6156
    6257// $post_pingback needs to be set in any file that includes edit-form.php

  • trunk/wp-admin/categories.php

    r1551 r1743  
    9898    <form name="editcat" action="categories.php" method="post">
    9999        <input type="hidden" name="action" value="editedcat" />
    100         <input type="hidden" name="cat_ID" value="<?php echo $_GET['cat_ID'] ?>" />
     100        <input type="hidden" name="cat_ID" value="<?php echo $cat_ID ?>" />
    101101        <p><?php _e('Category name:') ?><br />
    102102        <input type="text" name="cat_name" value="<?php echo htmlspecialchars($cat_name); ?>" /></p>

  • trunk/wp-admin/edit-comments.php

    r1690 r1743  
    2929  <fieldset>
    3030  <legend><?php _e('Show Comments That Contain...') ?></legend>
    31   <input type="text" name="s" value="<?php if (isset($s)) echo $s; ?>" size="17" />
     31  <input type="text" name="s" value="<?php if (isset($_GET['s'])) echo htmlspecialchars($_GET['s']); ?>" size="17" />
    3232  <input type="submit" name="submit" value="<?php _e('Search') ?>"  /> 
    3333  <input type="hidden" name="mode" value="<?php echo $mode; ?>" />
    … …  
    149149</div>
    150150
    151 <?php
    152 include('admin-footer.php');
    153 ?>
     151<?php include('admin-footer.php'); ?>

  • trunk/wp-admin/edit.php

    r1720 r1743  
    6666    echo $month[substr( $_GET['m'], 4, 2 )] . ' ' . substr( $_GET['m'], 0, 4 );
    6767} elseif ( isset( $_GET['s'] ) ) {
    68     printf(__('Search for &#8220;%s&#8221;'), $_GET['s']);
     68    printf(__('Search for &#8220;%s&#8221;'), htmlspecialchars($_GET['s']) );
    6969} else {
    7070    _e('Last 15 Posts');
Note: See TracChangeset for help on using the changeset viewer.