Changeset 5056 for trunk/wp-admin/edit-comments.php

Timestamp:

03/17/2007 08:46:59 AM (18 years ago)

Author:

markjaquith

Message:

use clean_url() instead of attribute_escape() when dealing with src/href to protect against XSS. props xknown. fixes #3986 for trunk.

File:

• trunk/wp-admin/edit-comments.php (modified) (6 diffs)

trunk/wp-admin/edit-comments.php

@@ -102 +102 @@
 if ( 1 < $page ) {
     $args['apage'] = ( 1 == $page - 1 ) ? FALSE : $page - 1;
-    $r .=  '<a class="prev" href="' . attribute_escape(add_query_arg( $args )) . '">&laquo; '. __('Previous Page') .'</a>' . "\n";
+    $r .=  '<a class="prev" href="' . clean_url(add_query_arg( $args )) . '">&laquo; '. __('Previous Page') .'</a>' . "\n";
 }
 if ( ( $total_pages = ceil( $total / 20 ) ) > 1 ) {
@@ -112 +112 @@
             if ( $page_num < 3 || ( $page_num >= $page - 3 && $page_num <= $page + 3 ) || $page_num > $total_pages - 3 ) :
                 $args['apage'] = ( 1 == $page_num ) ? FALSE : $page_num;
-                $r .= '<a class="page-numbers" href="' . attribute_escape(add_query_arg($args)) . '">' . ( $page_num ) . "</a>\n";
+                $r .= '<a class="page-numbers" href="' . clean_url(add_query_arg($args)) . '">' . ( $page_num ) . "</a>\n";
                 $in = true;
             elseif ( $in == true ) :
@@ -123 +123 @@
 if ( ( $page ) * 20 < $total || -1 == $total ) {
     $args['apage'] = $page + 1;
-    $r .=  '<a class="next" href="' . attribute_escape(add_query_arg($args)) . '">'. __('Next Page') .' &raquo;</a>' . "\n";
+    $r .=  '<a class="next" href="' . clean_url(add_query_arg($args)) . '">'. __('Next Page') .' &raquo;</a>' . "\n";
 }
 echo "<p class='pagenav'>$r</p>";
@@ -249 +249 @@
 if ( 1 < $page ) {
     $args['apage'] = ( 1 == $page - 1 ) ? FALSE : $page - 1;
-    $r .=  '<a class="prev" href="' . attribute_escape(add_query_arg( $args )) . '">&laquo; '. __('Previous Page') .'</a>' . "\n";
+    $r .=  '<a class="prev" href="' . clean_url(add_query_arg( $args )) . '">&laquo; '. __('Previous Page') .'</a>' . "\n";
 }
 if ( ( $total_pages = ceil( $total / 20 ) ) > 1 ) {
@@ -259 +259 @@
             if ( $page_num < 3 || ( $page_num >= $page - 3 && $page_num <= $page + 3 ) || $page_num > $total_pages - 3 ) :
                 $args['apage'] = ( 1 == $page_num ) ? FALSE : $page_num;
-                $r .= '<a class="page-numbers" href="' . attribute_escape(add_query_arg($args)) . '">' . ( $page_num ) . "</a>\n";
+                $r .= '<a class="page-numbers" href="' . clean_url(add_query_arg($args)) . '">' . ( $page_num ) . "</a>\n";
                 $in = true;
             elseif ( $in == true ) :
@@ -270 +270 @@
 if ( ( $page ) * 20 < $total || -1 == $total ) {
     $args['apage'] = $page + 1;
-    $r .=  '<a class="next" href="' . attribute_escape(add_query_arg($args)) . '">'. __('Next Page') .' &raquo;</a>' . "\n";
+    $r .=  '<a class="next" href="' . clean_url(add_query_arg($args)) . '">'. __('Next Page') .' &raquo;</a>' . "\n";
 }
 echo "<p class='pagenav'>$r</p>";