Changeset 20096

Timestamp:

03/02/2012 10:26:58 PM (14 years ago)

Author:

nacin

Message:

Use sanitize_key() for theme search tags/features. sanitize_title_with_dashes() is overkill. see #19815.

File:

• trunk/wp-admin/includes/class-wp-theme-install-list-table.php (modified) (8 diffs)

trunk/wp-admin/includes/class-wp-theme-install-list-table.php

@@ -8 +8 @@
  * @access private
  */
-class WP_Theme_Install_List_Table extends WP_Themes_List_Table {
+class WP_Theme_Install_List_Table extends WP_List_Table {
 
-        var $features = array();
+        function __construct() {
+                parent::__construct( array(
+                        'ajax' => true,
+                ) );
+        }
 
         function ajax_user_can() {
-                return current_user_can( 'install_themes' );
+                return current_user_can('install_themes');
         }
 
@@ -19 +23 @@
                 include( ABSPATH . 'wp-admin/includes/theme-install.php' );
 
-                global $tabs, $tab, $paged, $type, $theme_field_defaults;
+                global $tabs, $tab, $paged, $type, $term, $theme_field_defaults;
+
                 wp_reset_vars( array( 'tab' ) );
-
-                $search_terms = array();
-                $search_string = '';
-                if ( ! empty( $_REQUEST['s'] ) ){
-                        $search_string = strtolower( stripslashes( $_REQUEST['s'] ) );
-                        $search_terms = array_unique( array_filter( array_map( 'trim', explode( ',', $search_string ) ) ) );
-                }
-
-                if ( ! empty( $_REQUEST['features'] ) )
-                        $this->features = $_REQUEST['features'];
 
                 $paged = $this->get_pagenum();
@@ -61 +56 @@
                         case 'search':
                                 $type = isset( $_REQUEST['type'] ) ? stripslashes( $_REQUEST['type'] ) : '';
+                                $term = isset( $_REQUEST['s'] ) ? stripslashes( $_REQUEST['s'] ) : '';
+
                                 switch ( $type ) {
                                         case 'tag':
-                                                $args['tag'] = array_map( 'sanitize_title_with_dashes', $search_terms );
+                                                $terms = explode( ',', $term );
+                                                $terms = array_map( 'trim', $terms );
+                                                $terms = array_map( 'sanitize_key', $terms );
+                                                $args['tag'] = $terms;
                                                 break;
                                         case 'term':
-                                                $args['search'] = $search_string;
+                                                $args['search'] = $term;
                                                 break;
                                         case 'author':
-                                                $args['author'] = $search_string;
+                                                $args['author'] = $term;
                                                 break;
                                 }
 
-                                if ( ! empty( $this->features ) ) {
-                                        $args['tag'] = $this->features;
-                                        $_REQUEST['s'] = implode( ',', $this->features );
+                                if ( !empty( $_REQUEST['features'] ) ) {
+                                        $terms = $_REQUEST['features'];
+                                        $terms = array_map( 'trim', $terms );
+                                        $terms = array_map( 'sanitize_key', $terms );
+                                        $args['tag'] = $terms;
+                                        $_REQUEST['s'] = implode( ',', $terms );
                                         $_REQUEST['type'] = 'tag';
                                 }
@@ -93 +96 @@
                 }
 
-                if ( ! $args )
+                if ( !$args )
                         return;
 
@@ -106 +109 @@
                         'total_items' => $api->info['results'],
                         'per_page' => $per_page,
-                        'infinite_scroll' => true,
                 ) );
         }
@@ -127 +129 @@
         }
 
+        function get_columns() {
+                return array();
+        }
+
         function display() {
+
                 wp_nonce_field( "fetch-list-" . get_class( $this ), '_ajax_fetch_list_nonce' );
 ?>
@@ -143 +150 @@
                 </div>
 
-                <?php
-                parent::tablenav( 'bottom' );
+                <div class="tablenav bottom themes">
+                        <?php $this->pagination( 'bottom' ); ?>
+                        <img src="<?php echo esc_url( admin_url( 'images/wpspin_light.gif' ) ); ?>" class="ajax-loading list-ajax-loading" alt="" />
+                        <br class="clear" />
+                </div>
+<?php
         }
 
@@ -160 +171 @@
                 <?php } // end foreach $theme_names
         }
-
-        /**
-         * Send required variables to JavaScript land
-         *
-         * @since 3.4
-         * @access private
-         *
-         * @uses $tab Global; current tab within Themes->Install screen
-         * @uses $type Global; type of search.
-         */
-        function _js_vars() {
-                global $tab, $type;
-                parent::_js_vars( compact( $tab, $type ) );
-        }
 }