Changeset 5404 for trunk/wp-admin/import/textpattern.php

Timestamp:

05/07/2007 03:56:53 PM (19 years ago)

Author:

ryan

Message:

Add nonces to importers

File:

• trunk/wp-admin/import/textpattern.php (modified) (11 diffs)

trunk/wp-admin/import/textpattern.php

@@ -57 +57 @@
                 echo '<p>'.__('Your Textpattern Configuration settings are as follows:').'</p>';
                 echo '<form action="admin.php?import=textpattern&amp;step=1" method="post">';
+                wp_nonce_field('import-textpattern');
                 $this->db_form();
-                echo '<p class="submit"><input type="submit" name="submit" value="'.__('Import Categories').' &raquo;" /></p>';
+                echo '<p class="submit"><input type="submit" name="submit" value="'.attribute_escape(__('Import Categories &raquo;')).'" /></p>';
                 echo '</form>';
                 echo '</div>';
@@ -484 +485 @@
 
                 echo '<form action="admin.php?import=textpattern&amp;step=2" method="post">';
-                printf('<input type="submit" name="submit" value="%s" />', __('Import Users'));
+                wp_nonce_field('import-textpattern');
+                printf('<input type="submit" name="submit" value="%s" />', attribute_escape(__('Import Users')));
                 echo '</form>';
 
@@ -496 +498 @@
 
                 echo '<form action="admin.php?import=textpattern&amp;step=3" method="post">';
-                printf('<input type="submit" name="submit" value="%s" />', __('Import Posts'));
+                wp_nonce_field('import-textpattern');
+                printf('<input type="submit" name="submit" value="%s" />', attribute_escape(__('Import Posts')));
                 echo '</form>';
         }
@@ -507 +510 @@
 
                 echo '<form action="admin.php?import=textpattern&amp;step=4" method="post">';
-                printf('<input type="submit" name="submit" value="%s" />', __('Import Comments'));
+                wp_nonce_field('import-textpattern');
+                printf('<input type="submit" name="submit" value="%s" />', attribute_escape(__('Import Comments')));
                 echo '</form>';
         }
@@ -518 +522 @@
 
                 echo '<form action="admin.php?import=textpattern&amp;step=5" method="post">';
-                printf('<input type="submit" name="submit" value="%s" />', __('Import Links'));
+                wp_nonce_field('import-textpattern');
+                printf('<input type="submit" name="submit" value="%s" />', attribute_escape(__('Import Links')));
                 echo '</form>';
         }
@@ -530 +535 @@
 
                 echo '<form action="admin.php?import=textpattern&amp;step=6" method="post">';
-                printf('<input type="submit" name="submit" value="%s" />', __('Finish'));
+                wp_nonce_field('import-textpattern');
+                printf('<input type="submit" name="submit" value="%s" />', attribute_escape(__('Finish')));
                 echo '</form>';
         }
@@ -591 +597 @@
                 if ( $step > 0 )
                 {
+                        check_admin_referer('import-textpattern');
+
                         if($_POST['dbuser'])
                         {
                                 if(get_option('txpuser'))
                                         delete_option('txpuser');
-                                add_option('txpuser',$_POST['dbuser']);
+                                add_option('txpuser', sanitize_user($_POST['dbuser'], true));
                         }
                         if($_POST['dbpass'])
@@ -601 +609 @@
                                 if(get_option('txppass'))
                                         delete_option('txppass');
-                                add_option('txppass',$_POST['dbpass']);
+                                add_option('txppass',  sanitize_user($_POST['dbpass'], true));
                         }
 
@@ -608 +616 @@
                                 if(get_option('txpname'))
                                         delete_option('txpname');
-                                add_option('txpname',$_POST['dbname']);
+                                add_option('txpname',  sanitize_user($_POST['dbname'], true));
                         }
                         if($_POST['dbhost'])
@@ -614 +622 @@
                                 if(get_option('txphost'))
                                         delete_option('txphost');
-                                add_option('txphost',$_POST['dbhost']);
+                                add_option('txphost',  sanitize_user($_POST['dbhost'], true));
                         }
                         if($_POST['dbprefix'])
@@ -620 +628 @@
                                 if(get_option('tpre'))
                                         delete_option('tpre');
-                                add_option('tpre',$_POST['dbprefix']);
+                                add_option('tpre',  sanitize_user($_POST['dbprefix']));
                         }