Changeset 5404 for trunk/wp-admin/import/textpattern.php

Timestamp:

05/07/2007 03:56:53 PM (19 years ago)

Author:

ryan

Message:

Add nonces to importers

File:

• trunk/wp-admin/import/textpattern.php (modified) (11 diffs)

trunk/wp-admin/import/textpattern.php

@@ -57 +57 @@
         echo '<p>'.__('Your Textpattern Configuration settings are as follows:').'</p>';
         echo '<form action="admin.php?import=textpattern&amp;step=1" method="post">';
+        wp_nonce_field('import-textpattern');
         $this->db_form();
-        echo '<p class="submit"><input type="submit" name="submit" value="'.__('Import Categories').' &raquo;" /></p>';
+        echo '<p class="submit"><input type="submit" name="submit" value="'.attribute_escape(__('Import Categories &raquo;')).'" /></p>';
         echo '</form>';
         echo '</div>';
@@ -484 +485 @@
 
         echo '<form action="admin.php?import=textpattern&amp;step=2" method="post">';
-        printf('<input type="submit" name="submit" value="%s" />', __('Import Users'));
+        wp_nonce_field('import-textpattern');
+        printf('<input type="submit" name="submit" value="%s" />', attribute_escape(__('Import Users')));
         echo '</form>';
 
@@ -496 +498 @@
 
         echo '<form action="admin.php?import=textpattern&amp;step=3" method="post">';
-        printf('<input type="submit" name="submit" value="%s" />', __('Import Posts'));
+        wp_nonce_field('import-textpattern');
+        printf('<input type="submit" name="submit" value="%s" />', attribute_escape(__('Import Posts')));
         echo '</form>';
     }
@@ -507 +510 @@
 
         echo '<form action="admin.php?import=textpattern&amp;step=4" method="post">';
-        printf('<input type="submit" name="submit" value="%s" />', __('Import Comments'));
+        wp_nonce_field('import-textpattern');
+        printf('<input type="submit" name="submit" value="%s" />', attribute_escape(__('Import Comments')));
         echo '</form>';
     }
@@ -518 +522 @@
 
         echo '<form action="admin.php?import=textpattern&amp;step=5" method="post">';
-        printf('<input type="submit" name="submit" value="%s" />', __('Import Links'));
+        wp_nonce_field('import-textpattern');
+        printf('<input type="submit" name="submit" value="%s" />', attribute_escape(__('Import Links')));
         echo '</form>';
     }
@@ -530 +535 @@
 
         echo '<form action="admin.php?import=textpattern&amp;step=6" method="post">';
-        printf('<input type="submit" name="submit" value="%s" />', __('Finish'));
+        wp_nonce_field('import-textpattern');
+        printf('<input type="submit" name="submit" value="%s" />', attribute_escape(__('Finish')));
         echo '</form>';
     }
@@ -591 +597 @@
         if ( $step > 0 )
         {
+            check_admin_referer('import-textpattern');
+
             if($_POST['dbuser'])
             {
                 if(get_option('txpuser'))
                     delete_option('txpuser');
-                add_option('txpuser',$_POST['dbuser']);
+                add_option('txpuser', sanitize_user($_POST['dbuser'], true));
             }
             if($_POST['dbpass'])
@@ -601 +609 @@
                 if(get_option('txppass'))
                     delete_option('txppass');
-                add_option('txppass',$_POST['dbpass']);
+                add_option('txppass',  sanitize_user($_POST['dbpass'], true));
             }
 
@@ -608 +616 @@
                 if(get_option('txpname'))
                     delete_option('txpname');
-                add_option('txpname',$_POST['dbname']);
+                add_option('txpname',  sanitize_user($_POST['dbname'], true));
             }
             if($_POST['dbhost'])
@@ -614 +622 @@
                 if(get_option('txphost'))
                     delete_option('txphost');
-                add_option('txphost',$_POST['dbhost']);
+                add_option('txphost',  sanitize_user($_POST['dbhost'], true));
             }
             if($_POST['dbprefix'])
@@ -620 +628 @@
                 if(get_option('tpre'))
                     delete_option('tpre');
-                add_option('tpre',$_POST['dbprefix']);
+                add_option('tpre',  sanitize_user($_POST['dbprefix']));
             }