Changeset 5057 for branches/2.1/wp-admin/admin-functions.php

Timestamp:

03/17/2007 08:47:29 AM (18 years ago)

Author:

markjaquith

Message:

use clean_url() instead of attribute_escape() when dealing with src/href to protect against XSS. props xknown. fixes #3986 for 2.1.

File:

• branches/2.1/wp-admin/admin-functions.php (modified) (5 diffs)

branches/2.1/wp-admin/admin-functions.php

@@ -359 +359 @@
         $text       = wp_specialchars( stripslashes( urldecode( $_REQUEST['text'] ) ) );
         $text       = funky_javascript_fix( $text);
-        $popupurl   = attribute_escape($_REQUEST['popupurl']);
+        $popupurl   = clean_url($_REQUEST['popupurl']);
         $post_content = '<a href="'.$popupurl.'">'.$post_title.'</a>'."\n$text";
     }
@@ -418 +418 @@
     $user->user_login   = attribute_escape($user->user_login);
     $user->user_email   = attribute_escape($user->user_email);
-    $user->user_url     = attribute_escape($user->user_url);
+    $user->user_url     = clean_url($user->user_url);
     $user->first_name   = attribute_escape($user->first_name);
     $user->last_name    = attribute_escape($user->last_name);
@@ -563 +563 @@
     $link = get_link( $link_id );
 
-    $link->link_url         = attribute_escape($link->link_url);
+    $link->link_url         = clean_url($link->link_url);
     $link->link_name        = attribute_escape($link->link_name);
     $link->link_image       = attribute_escape($link->link_image);
     $link->link_description = attribute_escape($link->link_description);
-    $link->link_rss         = attribute_escape($link->link_rss);
+    $link->link_rss         = clean_url($link->link_rss);
     $link->link_rel         = attribute_escape($link->link_rel);
     $link->link_notes       =  wp_specialchars($link->link_notes);
@@ -577 +577 @@
 function get_default_link_to_edit() {
     if ( isset( $_GET['linkurl'] ) )
-        $link->link_url = attribute_escape( $_GET['linkurl']);
+        $link->link_url = clean_url( $_GET['linkurl']);
     else
         $link->link_url = '';
@@ -868 +868 @@
     $r .= "</td>\n\t\t<td>";
     if ( current_user_can( 'edit_user', $user_object->ID ) ) {
-        $edit_link = attribute_escape( add_query_arg( 'wp_http_referer', urlencode( stripslashes( $_SERVER['REQUEST_URI'] ) ), "user-edit.php?user_id=$user_object->ID" ));
+        $edit_link = clean_url( add_query_arg( 'wp_http_referer', urlencode( stripslashes( $_SERVER['REQUEST_URI'] ) ), "user-edit.php?user_id=$user_object->ID" ));
         $r .= "<a href='$edit_link' class='edit'>".__( 'Edit' )."</a>";
     }