Changeset 5046 for branches/2.1/wp-includes/link-template.php

Timestamp:

03/16/2007 08:04:44 AM (19 years ago)

Author:

markjaquith

Message:

Sanitize output of previous_posts() and next_posts(). Props Alex Concha for the report.

File:

• branches/2.1/wp-includes/link-template.php (modified) (5 diffs)

branches/2.1/wp-includes/link-template.php

@@ -380 +380 @@
         global $wp_rewrite;
 
-        $qstr = wp_specialchars($_SERVER['REQUEST_URI']);
+        $qstr = $_SERVER['REQUEST_URI'];
 
         $page_querystring = "paged";
@@ -447 +447 @@
 }
 
-function next_posts($max_page = 0) { // original by cfactor at cooltux.org
+function get_next_posts_page_link($max_page = 0) {
         global $paged, $pagenow;
 
@@ -455 +455 @@
                 $nextpage = intval($paged) + 1;
                 if ( !$max_page || $max_page >= $nextpage )
-                        echo get_pagenum_link($nextpage);
-        }
+                        return get_pagenum_link($nextpage);
+        }
+}
+
+function next_posts($max_page = 0) {
+        echo attribute_escape(get_next_posts_page_link($max_page));
 }
 
@@ -474 +478 @@
 }
 
-
-function previous_posts() { // original by cfactor at cooltux.org
+function get_previous_posts_page_link() {
         global $paged, $pagenow;
 
@@ -482 +485 @@
                 if ( $nextpage < 1 )
                         $nextpage = 1;
-                echo get_pagenum_link($nextpage);
-        }
-}
-
+                return get_pagenum_link($nextpage);
+        }
+}
+
+function previous_posts() {
+        echo attribute_escape(get_previous_posts_page_link());
+}
 
 function previous_posts_link($label='&laquo; Previous Page') {