Changeset 18992

Timestamp:

10/18/2011 07:32:40 PM (15 years ago)

Author:

nacin

Message:

Fix media/audio/file URL insertion. Strip slashes off title text. Leave red X to images only. fixes #14996. fixes #17578.

File:

• trunk/wp-admin/includes/media.php (modified) (3 diffs)

trunk/wp-admin/includes/media.php

@@ -513 +513 @@
 
         if ( !empty($_POST['insertonlybutton']) ) {
-                $src = $_POST['insertonly']['src'];
+                $src = $_POST['src'];
                 if ( !empty($src) && !strpos($src, '://') )
                         $src = "http://$src";
 
                 if ( isset( $_POST['media_type'] ) && 'image' != $_POST['media_type'] ) {
-                        $title = esc_attr($_POST['insertonly']['title']);
-                        if ( empty($title) )
-                                $title = esc_attr( basename($src) );
-
-                        if ( !empty($title) && !empty($src) )
+                        $title = esc_html( stripslashes( $_POST['title'] ) );
+                        if ( empty( $title ) )
+                                $title = esc_html( basename( $src ) );
+
+                        if ( $title && $src )
                                 $html = "<a href='" . esc_url($src) . "' >$title</a>";
 
                         $type = 'file';
-                        if ( $ext = preg_replace( '/^.+?\.([^.]+)$/', '$1', $src ) && $ext_type = wp_ext2type( $ext )
+                        if ( ( $ext = preg_replace( '/^.+?\.([^.]+)$/', '$1', $src ) ) && ( $ext_type = wp_ext2type( $ext ) )
                                 && ( 'audio' == $ext_type || 'video' == $ext_type ) )
                                         $type = $ext_type;
@@ -533 +533 @@
                 } else {
                         $align = '';
-                        $alt = esc_attr($_POST['insertonly']['alt']);
-                        if ( isset($_POST['insertonly']['align']) ) {
-                                $align = esc_attr($_POST['insertonly']['align']);
+                        $alt = esc_attr( stripslashes( $_POST['alt'] ) );
+                        if ( isset($_POST['align']) ) {
+                                $align = esc_attr( stripslashes( $_POST['align'] ) );
                                 $class = " class='align$align'";
                         }
@@ -1518 +1518 @@
 
         getImageData : function() {
+                if ( jQuery('table.describe').hasClass('not-image') )
+                        return;
+
                 var t = addExtImage, src = document.forms[0].src.value;
 
-                if ( ! src || jQuery('table.describe').hasClass('not-image') ) {
+                if ( ! src ) {
                         t.resetImageData();
                         return false;