Changeset 5550 for branches/2.0/wp-admin/edit-form-advanced.php
- Timestamp:
- 05/25/2007 10:33:48 PM (16 years ago)
- File:
-
- 1 edited
Legend:
- Unmodified
- Added
- Removed
-
branches/2.0/wp-admin/edit-form-advanced.php
r4843 r5550 1 1 <?php 2 if ( isset($_GET['message']) ) 3 $_GET['message'] = (int) $_GET['message']; 2 4 $messages[1] = __('Post updated'); 3 5 $messages[2] = __('Custom field updated'); … … 5 7 ?> 6 8 <?php if (isset($_GET['message'])) : ?> 7 <div id="message" class="updated fade"><p><?php echo $messages[$_GET['message']]; ?></p></div>9 <div id="message" class="updated fade"><p><?php echo wp_specialchars($messages[$_GET['message']]); ?></p></div> 8 10 <?php endif; ?> 9 11 … … 25 27 wp_nonce_field('add-post'); 26 28 } else { 29 $post_ID = (int) $post_ID; 27 30 $form_action = 'editpost'; 28 31 $form_extra = "<input type='hidden' name='post_ID' value='$post_ID' />"; … … 30 33 } 31 34 32 $form_pingback = '<input type="hidden" name="post_pingback" value="' . get_option('default_pingback_flag') . '" id="post_pingback" />';33 34 $form_prevstatus = '<input type="hidden" name="prev_status" value="' . $post->post_status . '" />';35 36 $form_trackback = '<input type="text" name="trackback_url" style="width: 415px" id="trackback" tabindex="7" value="'. str_replace("\n", ' ', $post->to_ping) .'" />';35 $form_pingback = '<input type="hidden" name="post_pingback" value="' . (int) get_option('default_pingback_flag') . '" id="post_pingback" />'; 36 37 $form_prevstatus = '<input type="hidden" name="prev_status" value="' . attribute_escape( $post->post_status ) . '" />'; 38 39 $form_trackback = '<input type="text" name="trackback_url" style="width: 415px" id="trackback" tabindex="7" value="'. attribute_escape( str_replace("\n", ' ', $post->to_ping) ) .'" />'; 37 40 38 41 if ('' != $post->pinged) { … … 45 48 } 46 49 47 $saveasdraft = '<input name="save" type="submit" id="save" tabindex="3" value="' . __('Save and Continue Editing') . '" />';50 $saveasdraft = '<input name="save" type="submit" id="save" tabindex="3" value="' . attribute_escape(__('Save and Continue Editing')) . '" />'; 48 51 49 52 if (empty($post->post_status)) $post->post_status = 'draft'; … … 51 54 ?> 52 55 53 <input type="hidden" name="user_ID" value="<?php echo $user_ID ?>" />56 <input type="hidden" name="user_ID" value="<?php echo (int) $user_ID ?>" /> 54 57 <input type="hidden" name="action" value="<?php echo $form_action ?>" /> 55 <input type="hidden" name="post_author" value="<?php echo $post->post_author?>" />58 <input type="hidden" name="post_author" value="<?php echo attribute_escape($post->post_author) ?>" /> 56 59 57 60 <?php echo $form_extra ?> … … 83 86 <fieldset id="passworddiv" class="dbx-box"> 84 87 <h3 class="dbx-handle"><?php _e('Password-Protect Post') ?></h3> 85 <div class="dbx-content"><input name="post_password" type="text" size="13" id="post_password" value="<?php echo $post->post_password?>" /></div>88 <div class="dbx-content"><input name="post_password" type="text" size="13" id="post_password" value="<?php echo attribute_escape($post->post_password) ?>" /></div> 86 89 </fieldset> 87 90 88 91 <fieldset id="slugdiv" class="dbx-box"> 89 92 <h3 class="dbx-handle"><?php _e('Post slug') ?></h3> 90 <div class="dbx-content"><input name="post_name" type="text" size="13" id="post_name" value="<?php echo $post->post_name?>" /></div>93 <div class="dbx-content"><input name="post_name" type="text" size="13" id="post_name" value="<?php echo attribute_escape($post->post_name) ?>" /></div> 91 94 </fieldset> 92 95 … … 124 127 if ( $post->post_author == $o->ID || ( empty($post_ID) && $user_ID == $o->ID ) ) $selected = 'selected="selected"'; 125 128 else $selected = ''; 126 echo "<option value=' $o->ID' $selected>$o->display_name</option>";129 echo "<option value='" . (int) $o->ID . "' $selected>" . wp_specialchars($o->display_name) . "</option>"; 127 130 endforeach; 128 131 ?> … … 139 142 <fieldset id="titlediv"> 140 143 <legend><?php _e('Title') ?></legend> 141 <div><input type="text" name="post_title" size="30" tabindex="1" value="<?php echo $post->post_title; ?>" id="title" /></div>144 <div><input type="text" name="post_title" size="30" tabindex="1" value="<?php echo attribute_escape($post->post_title); ?>" id="title" /></div> 142 145 </fieldset> 143 146 … … 222 225 <?php 223 226 if (current_user_can('upload_files')) { 224 $uploading_iframe_ID = ( 0 == $post_ID ? $temp_ID : $post_ID);227 $uploading_iframe_ID = (int) (0 == $post_ID ? $temp_ID : $post_ID); 225 228 $uploading_iframe_src = wp_nonce_url("inline-uploading.php?action=view&post=$uploading_iframe_ID", 'inlineuploading'); 226 229 $uploading_iframe_src = apply_filters('uploading_iframe_src', $uploading_iframe_src);
Note: See TracChangeset
for help on using the changeset viewer.