Changeset 5058

Timestamp:

03/17/2007 09:04:56 AM (20 years ago)

Author:

markjaquith

Message:

use clean_url() instead of attribute_escape() when dealing with src/href to protect against XSS. props xknown. fixes #3986 for 2.0.

Location:

branches/2.0

Files:

• wp-admin/admin-functions.php (modified) (2 diffs)
• wp-admin/bookmarklet.php (modified) (1 diff)
• wp-admin/post.php (modified) (1 diff)
• wp-admin/upgrade.php (modified) (2 diffs)
• wp-includes/functions.php (modified) (1 diff)
• wp-includes/links.php (modified) (1 diff)
• wp-includes/template-functions-links.php (modified) (2 diffs)

branches/2.0/wp-admin/admin-functions.php

@@ -468 +468 @@
         $link = get_link($link_id);
 
-        $link->link_url         = attribute_escape($link->link_url);
+        $link->link_url         =        clean_url($link->link_url);
         $link->link_name        = attribute_escape($link->link_name);
         $link->link_image       = attribute_escape($link->link_image);
         $link->link_description = attribute_escape($link->link_description);
-        $link->link_rss         = attribute_escape($link->link_rss);
+        $link->link_rss         =        clean_url($link->link_rss);
         $link->link_rel         = attribute_escape($link->link_rel);
         $link->link_notes       =  wp_specialchars($link->link_notes);
@@ -482 +482 @@
 function get_default_link_to_edit() {
         if ( isset($_GET['linkurl']) )
-                $link->link_url = attribute_escape($_GET['linkurl']);
+                $link->link_url = clean_url($_GET['linkurl']);
         else
                 $link->link_url = '';

branches/2.0/wp-admin/bookmarklet.php

@@ -38 +38 @@
   
 $content  = wp_specialchars($_REQUEST['content']);
-$popupurl = attribute_escape(stripslashes($_REQUEST['popupurl']));
+$popupurl = clean_url(stripslashes($_REQUEST['popupurl']));
     if ( !empty($content) ) {
         $post->post_content = wp_specialchars( stripslashes($_REQUEST['content']) );

branches/2.0/wp-admin/post.php

@@ -82 +82 @@
         <div id='preview' class='wrap'>
         <h2 id="preview-post"><?php _e('Post Preview (updated when post is saved)'); ?> <small class="quickjump"><a href="#write-post"><?php _e('edit &uarr;'); ?></a></small></h2>
-                <iframe src="<?php echo attribute_escape(apply_filters('preview_post_link', add_query_arg('preview', 'true', get_permalink($post->ID)))); ?>" width="100%" height="600" ></iframe>
+                <iframe src="<?php echo clean_url(apply_filters('preview_post_link', add_query_arg('preview', 'true', get_permalink($post->ID)))); ?>" width="100%" height="600" ></iframe>
         </div>
         <?php

branches/2.0/wp-admin/upgrade.php

@@ -68 +68 @@
 
         case 0:
-        $goback = attribute_escape(stripslashes(wp_get_referer()));
+        $goback = clean_url(stripslashes(wp_get_referer()));
 ?> 
 <p><?php _e('This file upgrades you from any previous version of WordPress to the latest. It may take a while though, so be patient.'); ?></p> 
@@ -87 +87 @@
                 $backto = __get_option('home');
         else
-                $backto = attribute_escape(stripslashes($_GET['backto']));
+                $backto = clean_url(stripslashes($_GET['backto']));
 ?> 
 <h2><?php _e('Step 1'); ?></h2> 

branches/2.0/wp-includes/functions.php

@@ -2492 +2492 @@
                 $html .= "\t\t<div id='message' class='confirm fade'>\n\t\t<p>" . wp_specialchars(wp_explain_nonce($action)) . "</p>\n\t\t<p><a href='$adminurl'>" . __('No') . "</a> <input type='submit' value='" . __('Yes') . "' /></p>\n\t\t</div>\n\t</form>\n";
         } else {
-                $html .= "\t<div id='message' class='confirm fade'>\n\t<p>" . wp_specialchars(wp_explain_nonce($action)) . "</p>\n\t<p><a href='$adminurl'>" . __('No') . "</a> <a href='" . attribute_escape(add_query_arg('_wpnonce', wp_create_nonce($action), $_SERVER['REQUEST_URI'])) . "'>" . __('Yes') . "</a></p>\n\t</div>\n";
+                $html .= "\t<div id='message' class='confirm fade'>\n\t<p>" . wp_specialchars(wp_explain_nonce($action)) . "</p>\n\t<p><a href='$adminurl'>" . __('No') . "</a> <a href='" . clean_url(add_query_arg('_wpnonce', wp_create_nonce($action), $_SERVER['REQUEST_URI'])) . "'>" . __('Yes') . "</a></p>\n\t</div>\n";
         }
         $html .= "</body>\n</html>";

branches/2.0/wp-includes/links.php

@@ -213 +213 @@
                 $the_link = '#';
                 if (!empty($row->link_url))
-                        $the_link = attribute_escape($row->link_url);
+                        $the_link = clean_url($row->link_url);
 
                 $rel = $row->link_rel;

branches/2.0/wp-includes/template-functions-links.php

@@ -459 +459 @@
 
 function next_posts($max_page = 0) {
-        echo attribute_escape(get_next_posts_page_link($max_page));
+        echo clean_url(get_next_posts_page_link($max_page));
 }
 
@@ -496 +496 @@
 
 function previous_posts() {
-        echo attribute_escape(get_previous_posts_page_link());
+        echo clean_url(get_previous_posts_page_link());
 }