Changeset 4952

Timestamp:

02/27/2007 07:16:15 AM (17 years ago)

Author:

markjaquith

Message:

attribute_escape() in nonce AYS

Location:

branches/2.1/wp-includes

Files:

• functions.php (modified) (2 diffs)
• version.php (modified) (1 diff)

branches/2.1/wp-includes/functions.php

@@ -1191 +1191 @@
     $adminurl = get_option('siteurl') . '/wp-admin';
     if ( wp_get_referer() )
-        $adminurl = wp_get_referer();
+        $adminurl = attribute_escape(wp_get_referer());
 
     $title = __('WordPress Confirmation');
@@ -1208 +1208 @@
         $html .= "\t\t<div id='message' class='confirm fade'>\n\t\t<p>" . wp_specialchars(wp_explain_nonce($action)) . "</p>\n\t\t<p><a href='$adminurl'>" . __('No') . "</a> <input type='submit' value='" . __('Yes') . "' /></p>\n\t\t</div>\n\t</form>\n";
     } else {
-        $html .= "\t<div id='message' class='confirm fade'>\n\t<p>" . wp_specialchars(wp_explain_nonce($action)) . "</p>\n\t<p><a href='$adminurl'>" . __('No') . "</a> <a href='" . add_query_arg( '_wpnonce', wp_create_nonce($action), $_SERVER['REQUEST_URI'] ) . "'>" . __('Yes') . "</a></p>\n\t</div>\n";
+        $html .= "\t<div id='message' class='confirm fade'>\n\t<p>" . wp_specialchars(wp_explain_nonce($action)) . "</p>\n\t<p><a href='$adminurl'>" . __('No') . "</a> <a href='" . attribute_escape(add_query_arg( '_wpnonce', wp_create_nonce($action), $_SERVER['REQUEST_URI'] )) . "'>" . __('Yes') . "</a></p>\n\t</div>\n";
     }
     $html .= "</body>\n</html>";

branches/2.1/wp-includes/version.php

@@ -3 +3 @@
 // This holds the version number in a separate file so we can bump it without cluttering the SVN
 
-$wp_version = '2.1.1';
+$wp_version = '2.1.2-alpha';
 $wp_db_version = 4773;