Changeset 18992

Timestamp:

10/18/2011 07:32:40 PM (14 years ago)

Author:

nacin

Message:

Fix media/audio/file URL insertion. Strip slashes off title text. Leave red X to images only. fixes #14996. fixes #17578.

File:

• trunk/wp-admin/includes/media.php (modified) (3 diffs)

trunk/wp-admin/includes/media.php

@@ -513 +513 @@
 
     if ( !empty($_POST['insertonlybutton']) ) {
-        $src = $_POST['insertonly']['src'];
+        $src = $_POST['src'];
         if ( !empty($src) && !strpos($src, '://') )
             $src = "http://$src";
 
         if ( isset( $_POST['media_type'] ) && 'image' != $_POST['media_type'] ) {
-            $title = esc_attr($_POST['insertonly']['title']);
-            if ( empty($title) )
-                $title = esc_attr( basename($src) );
-
-            if ( !empty($title) && !empty($src) )
+            $title = esc_html( stripslashes( $_POST['title'] ) );
+            if ( empty( $title ) )
+                $title = esc_html( basename( $src ) );
+
+            if ( $title && $src )
                 $html = "<a href='" . esc_url($src) . "' >$title</a>";
 
             $type = 'file';
-            if ( $ext = preg_replace( '/^.+?\.([^.]+)$/', '$1', $src ) && $ext_type = wp_ext2type( $ext )
+            if ( ( $ext = preg_replace( '/^.+?\.([^.]+)$/', '$1', $src ) ) && ( $ext_type = wp_ext2type( $ext ) )
                 && ( 'audio' == $ext_type || 'video' == $ext_type ) )
                     $type = $ext_type;
@@ -533 +533 @@
         } else {
             $align = '';
-            $alt = esc_attr($_POST['insertonly']['alt']);
-            if ( isset($_POST['insertonly']['align']) ) {
-                $align = esc_attr($_POST['insertonly']['align']);
+            $alt = esc_attr( stripslashes( $_POST['alt'] ) );
+            if ( isset($_POST['align']) ) {
+                $align = esc_attr( stripslashes( $_POST['align'] ) );
                 $class = " class='align$align'";
             }
@@ -1518 +1518 @@
 
     getImageData : function() {
+        if ( jQuery('table.describe').hasClass('not-image') )
+            return;
+
         var t = addExtImage, src = document.forms[0].src.value;
 
-        if ( ! src || jQuery('table.describe').hasClass('not-image') ) {
+        if ( ! src ) {
             t.resetImageData();
             return false;