Changeset 19471

Timestamp:

11/28/2011 10:58:51 PM (15 years ago)

Author:

nacin

Message:

WP_Screen: Whitelist -new and -add screens, and prevent edit-comments and edit-tags from being mashed on. fixes #19353.

File:

• trunk/wp-admin/includes/screen.php (modified) (5 diffs)

trunk/wp-admin/includes/screen.php

@@ -234 +234 @@
          * @access public
          */
-        public $action = '';
+        public $action;
 
         /**
@@ -388 +388 @@
                         return $hook_name;
 
-                $action = $post_type = $taxonomy = null;
+                $post_type = $taxonomy = null;
                 $is_network = $is_user = false;
+                $action = '';
 
                 if ( $hook_name )
@@ -401 +402 @@
                         $id = 'post'; // changes later. ends up being $base.
                 } else {
-                        $last_four = substr( $id, -4 );
-                        if ( '.php' == $last_four ) {
+                        if ( '.php' == substr( $id, -4 ) )
                                 $id = substr( $id, 0, -4 );
-                                $last_four = substr( $id, -4 );
-                        }
-                        if ( '-add' == $last_four || '-new' == $last_four ) {
+
+                        if ( 'post-new' == $id || 'link-add' == $id || 'media-new' == $id || 'user-new' == $id ) {
                                 $id = substr( $id, 0, -4 );
                                 $action = 'add';
@@ -422 +421 @@
 
                         $id = sanitize_key( $id );
-                        if ( 'edit-' == substr( $id, 0, 5 ) ) {
+                        if ( 'edit-comments' != $id && 'edit-tags' != $id && 'edit-' == substr( $id, 0, 5 ) ) {
                                 $maybe = substr( $id, 5 );
                                 if ( taxonomy_exists( $maybe ) ) {
@@ -486 +485 @@
                                         $taxonomy = 'post_tag';
                                 $id = 'edit-' . $taxonomy;
-                                break;
-                        case 'upload' :
-                                if ( null === $post_type )
-                                        $post_type = 'attachment';
                                 break;
                 }