WordPress.org

Make WordPress Core

Changeset 5589


Ignore:
Timestamp:
05/29/07 04:37:35 (7 years ago)
Author:
markjaquith
Message:

Int casting and misc escaping for 2.2 Props g30rg3x. fixes #4333 for 2.2

Location:
branches/2.2/wp-admin
Files:
7 edited

Legend:

Unmodified
Added
Removed
  • branches/2.2/wp-admin/admin-functions.php

    r5453 r5589  
    348348 
    349349    $post->post_password = format_to_edit( $post->post_password ); 
     350     
     351    $post->menu_order = (int) $post->menu_order; 
    350352 
    351353    if ( $post->post_type == 'page' ) 
     
    397399function get_comment_to_edit( $id ) { 
    398400    $comment = get_comment( $id ); 
     401     
     402    $comment->comment_ID = (int) $comment->comment_ID; 
     403    $comment->comment_post_ID = (int) $comment->comment_post_ID; 
    399404 
    400405    $comment->comment_content = format_to_edit( $comment->comment_content, user_can_richedit() ); 
    401406    $comment->comment_content = apply_filters( 'comment_edit_pre', $comment->comment_content); 
     407    $comment->comment_content = apply_filters( 'comment_text', $comment->comment_content ); 
    402408 
    403409    $comment->comment_author = format_to_edit( $comment->comment_author ); 
    404410    $comment->comment_author_email = format_to_edit( $comment->comment_author_email ); 
     411    $comment->comment_author_url = clean_url($comment->comment_author_url); 
    405412    $comment->comment_author_url = format_to_edit( $comment->comment_author_url ); 
    406413 
     
    410417function get_category_to_edit( $id ) { 
    411418    $category = get_category( $id ); 
     419     
     420    $category->term_id = (int) $category->term_id; 
     421    $category->parent = (int) $category->parent; 
    412422 
    413423    return $category; 
     
    10271037        $entry['meta_key']   = attribute_escape($entry['meta_key']); 
    10281038        $entry['meta_value'] = attribute_escape($entry['meta_value']); 
     1039        $entry['meta_id'] = (int) $entry['meta_id']; 
    10291040        $r .= "\n\t<tr id='meta-{$entry['meta_id']}' class='$style'>"; 
    10301041        $r .= "\n\t\t<td valign='top'><input name='meta[{$entry['meta_id']}][key]' tabindex='6' type='text' size='20' value='{$entry['meta_key']}' /></td>"; 
     
    10791090 
    10801091    foreach ( $keys as $key ) { 
    1081         $key = attribute_escape( $key); 
     1092        $key = attribute_escape( $key ); 
    10821093        echo "\n\t<option value='$key'>$key</option>"; 
    10831094    } 
  • branches/2.2/wp-admin/comment.php

    r4623 r5589  
    4040    $nonce_action .= $comment; 
    4141 
    42     if ( ! $comment = get_comment($comment) ) 
     42    if ( ! $comment = get_comment_to_edit($comment) ) 
    4343        wp_die(__('Oops, no comment with this ID.').sprintf(' <a href="%s">'.__('Go back').'</a>!', 'edit.php')); 
    4444 
     
    9797<tr> 
    9898<th scope="row" valign="top"><p><?php _e('Comment:'); ?></p></th> 
    99 <td><?php echo apply_filters( 'comment_text', $comment->comment_content ); ?></td> 
     99<td><?php echo $comment->comment_content; ?></td> 
    100100</tr> 
    101101</table> 
     
    156156        wp_redirect(wp_get_referer()); 
    157157    } else { 
    158         wp_redirect(get_option('siteurl') .'/wp-admin/edit.php?p='.$comment->comment_post_ID.'&c=1#comments'); 
     158        wp_redirect(get_option('siteurl') .'/wp-admin/edit.php?p='. (int) $comment->comment_post_ID.'&c=1#comments'); 
    159159    } 
    160160    exit(); 
     
    186186        wp_redirect(wp_get_referer()); 
    187187    } else { 
    188         wp_redirect(get_option('siteurl') .'/wp-admin/edit.php?p='.$comment->comment_post_ID.'&c=1#comments'); 
     188        wp_redirect(get_option('siteurl') .'/wp-admin/edit.php?p='. (int) $comment->comment_post_ID.'&c=1#comments'); 
    189189    } 
    190190    exit(); 
  • branches/2.2/wp-admin/edit-form-advanced.php

    r5289 r5589  
    11<?php 
     2if ( isset($_GET['message']) ) 
     3      $_GET['message'] = (int) $_GET['message']; 
    24$messages[1] = __('Post updated'); 
    35$messages[2] = __('Custom field updated'); 
     
    57?> 
    68<?php if (isset($_GET['message'])) : ?> 
    7 <div id="message" class="updated fade"><p><?php echo $messages[$_GET['message']]; ?></p></div> 
     9<div id="message" class="updated fade"><p><?php echo wp_specialchars($messages[$_GET['message']]); ?></p></div> 
    810<?php endif; ?> 
    911 
     
    2224    wp_nonce_field('add-post'); 
    2325} else { 
     26    $post_ID = (int) $post_ID; 
    2427    $form_action = 'editpost'; 
    2528    $form_extra = "<input type='hidden' id='post_ID' name='post_ID' value='$post_ID' />"; 
     
    2730} 
    2831 
    29 $form_pingback = '<input type="hidden" name="post_pingback" value="' . get_option('default_pingback_flag') . '" id="post_pingback" />'; 
    30  
    31 $form_prevstatus = '<input type="hidden" name="prev_status" value="' . $post->post_status . '" />'; 
    32  
    33 $form_trackback = '<input type="text" name="trackback_url" style="width: 415px" id="trackback" tabindex="7" value="'. str_replace("\n", ' ', $post->to_ping) .'" />'; 
     32$form_pingback = '<input type="hidden" name="post_pingback" value="' . (int) get_option('default_pingback_flag') . '" id="post_pingback" />'; 
     33 
     34$form_prevstatus = '<input type="hidden" name="prev_status" value="' . attribute_escape( $post->post_status ) . '" />'; 
     35 
     36$form_trackback = '<input type="text" name="trackback_url" style="width: 415px" id="trackback" tabindex="7" value="'. attribute_escape( str_replace("\n", ' ', $post->to_ping) ) .'" />'; 
    3437 
    3538if ('' != $post->pinged) { 
     
    4245} 
    4346 
    44 $saveasdraft = '<input name="save" type="submit" id="save" tabindex="3" value="' . __('Save and Continue Editing') . '" />'; 
     47$saveasdraft = '<input name="save" type="submit" id="save" tabindex="3" value="' . attribute_escape( __('Save and Continue Editing') ) . '" />'; 
    4548 
    4649if (empty($post->post_status)) $post->post_status = 'draft'; 
     
    4851?> 
    4952 
    50 <input type="hidden" name="user_ID" value="<?php echo $user_ID ?>" /> 
     53<input type="hidden" name="user_ID" value="<?php echo (int) $user_ID ?>" /> 
    5154<input type="hidden" id="hiddenaction" name="action" value="<?php echo $form_action ?>" /> 
    5255<input type="hidden" id="originalaction" name="originalaction" value="<?php echo $form_action ?>" /> 
    53 <input type="hidden" name="post_author" value="<?php echo $post->post_author ?>" /> 
     56<input type="hidden" name="post_author" value="<?php echo attribute_escape( $post->post_author ); ?>" /> 
    5457<input type="hidden" id="post_type" name="post_type" value="post" /> 
    5558 
     
    8992<fieldset id="passworddiv" class="dbx-box"> 
    9093<h3 class="dbx-handle"><?php _e('Post Password') ?></h3>  
    91 <div class="dbx-content"><input name="post_password" type="text" size="13" id="post_password" value="<?php echo $post->post_password ?>" /></div> 
     94<div class="dbx-content"><input name="post_password" type="text" size="13" id="post_password" value="<?php echo attribute_escape( $post->post_password ); ?>" /></div> 
    9295</fieldset> 
    9396 
    9497<fieldset id="slugdiv" class="dbx-box"> 
    9598<h3 class="dbx-handle"><?php _e('Post Slug') ?></h3>  
    96 <div class="dbx-content"><input name="post_name" type="text" size="13" id="post_name" value="<?php echo $post->post_name ?>" /></div> 
     99<div class="dbx-content"><input name="post_name" type="text" size="13" id="post_name" value="<?php echo attribute_escape( $post->post_name ); ?>" /></div> 
    97100</fieldset> 
    98101 
     
    126129if ( $post->post_author == $o->ID || ( empty($post_ID) && $user_ID == $o->ID ) ) $selected = 'selected="selected"'; 
    127130else $selected = ''; 
    128 echo "<option value='$o->ID' $selected>$o->display_name</option>"; 
     131echo "<option value='" . (int) $o->ID . "' $selected>" . wp_specialchars( $o->display_name ) . "</option>"; 
    129132endforeach; 
    130133?> 
     
    141144<fieldset id="titlediv"> 
    142145    <legend><?php _e('Title') ?></legend> 
    143     <div><input type="text" name="post_title" size="30" tabindex="1" value="<?php echo $post->post_title; ?>" id="title" /></div> 
     146    <div><input type="text" name="post_title" size="30" tabindex="1" value="<?php echo attribute_escape($post->post_title); ?>" id="title" /></div> 
    144147</fieldset> 
    145148 
     
    169172?> 
    170173<?php if ( current_user_can('publish_posts') ) : ?> 
    171     <input name="publish" type="submit" id="publish" tabindex="5" accesskey="p" value="<?php _e('Publish') ?>" />  
     174    <input name="publish" type="submit" id="publish" tabindex="5" accesskey="p" value="<?php _e('Publish'); ?>" />  
    172175<?php endif; ?> 
    173176<?php 
     
    187190<?php 
    188191if (current_user_can('upload_files')) { 
    189     $uploading_iframe_ID = (0 == $post_ID ? $temp_ID : $post_ID); 
     192    $uploading_iframe_ID = (int) (0 == $post_ID ? $temp_ID : $post_ID); 
    190193    $uploading_iframe_src = wp_nonce_url("upload.php?style=inline&amp;tab=upload&amp;post_id=$uploading_iframe_ID", 'inlineuploading'); 
    191194    $uploading_iframe_src = apply_filters('uploading_iframe_src', $uploading_iframe_src); 
  • branches/2.2/wp-admin/edit-form-comment.php

    r5237 r5589  
    33$toprow_title = sprintf(__('Editing Comment # %s'), $comment->comment_ID); 
    44$form_action = 'editedcomment'; 
    5 $form_extra = "' />\n<input type='hidden' name='comment_ID' value='" . $comment->comment_ID . "' />\n<input type='hidden' name='comment_post_ID' value='".$comment->comment_post_ID; 
     5$form_extra = "' />\n<input type='hidden' name='comment_ID' value='" . $comment->comment_ID . "' />\n<input type='hidden' name='comment_post_ID' value='" . $comment->comment_post_ID; 
    66?> 
    77 
     
    99<?php wp_nonce_field('update-comment_' . $comment->comment_ID) ?> 
    1010<div class="wrap"> 
    11 <input type="hidden" name="user_ID" value="<?php echo $user_ID ?>" /> 
     11<input type="hidden" name="user_ID" value="<?php echo (int) $user_ID ?>" /> 
    1212<input type="hidden" name="action" value='<?php echo $form_action . $form_extra ?>' /> 
    1313 
     
    2121    <legend><label for="name"><?php _e('Name:') ?></label></legend> 
    2222    <div> 
    23       <input type="text" name="newcomment_author" size="25" value="<?php echo $comment->comment_author ?>" tabindex="1" id="name" /> 
     23      <input type="text" name="newcomment_author" size="25" value="<?php echo attribute_escape( $comment->comment_author ); ?>" tabindex="1" id="name" /> 
    2424    </div> 
    2525</fieldset> 
     
    2727        <legend><label for="email"><?php _e('E-mail:') ?></label></legend> 
    2828        <div> 
    29           <input type="text" name="newcomment_author_email" size="20" value="<?php echo $comment->comment_author_email ?>" tabindex="2" id="email" /> 
     29          <input type="text" name="newcomment_author_email" size="20" value="<?php echo attribute_escape( $comment->comment_author_email ); ?>" tabindex="2" id="email" /> 
    3030    </div> 
    3131</fieldset> 
     
    3333        <legend><label for="newcomment_author_url"><?php _e('URL:') ?></label></legend> 
    3434        <div> 
    35           <input type="text" id="newcomment_author_url" name="newcomment_author_url" size="35" value="<?php echo $comment->comment_author_url ?>" tabindex="3" /> 
     35          <input type="text" id="newcomment_author_url" name="newcomment_author_url" size="35" value="<?php echo attribute_escape( $comment->comment_author_url ); ?>" tabindex="3" /> 
    3636    </div> 
    3737</fieldset> 
  • branches/2.2/wp-admin/edit-form.php

    r4658 r5589  
    77<input type="hidden" name="mode" value="bookmarklet" /> 
    88<?php endif; ?> 
    9 <input type="hidden" name="user_ID" value="<?php echo $user_ID ?>" /> 
     9<input type="hidden" name="user_ID" value="<?php echo (int) $user_ID ?>" /> 
    1010<input type="hidden" name="action" value='post' /> 
    1111 
     
    2222    <fieldset id="titlediv"> 
    2323      <legend><a href="http://wordpress.org/docs/reference/post/#title" title="<?php _e('Help on titles') ?>"><?php _e('Title') ?></a></legend>  
    24       <div><input type="text" name="post_title" size="30" tabindex="1" value="<?php echo $post->post_title; ?>" id="title" /></div> 
     24      <div><input type="text" name="post_title" size="30" tabindex="1" value="<?php echo attribute_escape( $post->post_title ); ?>" id="title" /></div> 
    2525    </fieldset> 
    2626 
     
    5050</script> 
    5151 
    52 <input type="hidden" name="post_pingback" value="<?php echo get_option('default_pingback_flag') ?>" id="post_pingback" /> 
     52<input type="hidden" name="post_pingback" value="<?php echo (int) get_option('default_pingback_flag') ?>" id="post_pingback" /> 
    5353 
    5454<p><label for="trackback"> <?php printf(__('<a href="%s" title="Help on trackbacks"><strong>TrackBack</strong> a <abbr title="Universal Resource Locator">URL</abbr></a>:</label> (Separate multiple <abbr title="Universal Resource Locator">URL</abbr>s with spaces.)'), 'http://wordpress.org/docs/reference/post/#trackback'); echo '<br />'; ?> 
     
    6565        echo '<input name="advanced" type="submit" id="advancededit" tabindex="7" value="' .  __('Advanced Editing &raquo;') . '" />'; 
    6666    } ?> 
    67     <input name="referredby" type="hidden" id="referredby" value="<?php if ( wp_get_referer() ) echo urlencode(wp_get_referer()); ?>" /> 
     67    <input name="referredby" type="hidden" id="referredby" value="<?php if ( $refby = wp_get_referer() ) echo urlencode($refby); ?>" /> 
    6868</p> 
    6969 
  • branches/2.2/wp-admin/edit-page-form.php

    r5159 r5589  
    33<h2 id="write-post"><?php _e('Write Page'); ?></h2> 
    44<?php 
     5 
    56if (0 == $post_ID) { 
    67    $form_action = 'post'; 
     
    910    $form_extra = "<input type='hidden' id='post_ID' name='temp_ID' value='$temp_ID' />"; 
    1011} else { 
     12    $post_ID = (int) $post_ID; 
    1113    $form_action = 'editpost'; 
    1214    $nonce_action = 'update-page_' . $post_ID; 
    1315    $form_extra = "<input type='hidden' id='post_ID' name='post_ID' value='$post_ID' />"; 
    1416} 
     17 
     18$temp_ID = (int) $temp_ID; 
     19$user_ID = (int) $user_ID; 
    1520 
    1621$sendto = clean_url(stripslashes(wp_get_referer())); 
     
    6974<fieldset id="passworddiv" class="dbx-box"> 
    7075<h3 class="dbx-handle"><?php _e('Page Password') ?></h3> 
    71 <div class="dbx-content"><input name="post_password" type="text" size="13" id="post_password" value="<?php echo $post->post_password ?>" /></div> 
     76<div class="dbx-content"><input name="post_password" type="text" size="13" id="post_password" value="<?php echo attribute_escape( $post->post_password ); ?>" /></div> 
    7277</fieldset> 
    7378 
     
    9499<fieldset id="slugdiv" class="dbx-box"> 
    95100<h3 class="dbx-handle"><?php _e('Page Slug') ?></h3> 
    96 <div class="dbx-content"><input name="post_name" type="text" size="13" id="post_name" value="<?php echo $post->post_name ?>" /></div> 
     101<div class="dbx-content"><input name="post_name" type="text" size="13" id="post_name" value="<?php echo attribute_escape( $post->post_name ); ?>" /></div> 
    97102</fieldset> 
    98103 
     
    107112if ( $post->post_author == $o->ID || ( empty($post_ID) && $user_ID == $o->ID ) ) $selected = 'selected="selected"'; 
    108113else $selected = ''; 
     114$o->ID = (int) $o->ID; 
     115$o->display_name = wp_specialchars( $o->display_name ); 
    109116echo "<option value='$o->ID' $selected>$o->display_name</option>"; 
    110117endforeach; 
     
    127134<fieldset id="titlediv"> 
    128135  <legend><?php _e('Page Title') ?></legend> 
    129   <div><input type="text" name="post_title" size="30" tabindex="1" value="<?php echo $post->post_title; ?>" id="title" /></div> 
     136  <div><input type="text" name="post_title" size="30" tabindex="1" value="<?php echo attribute_escape( $post->post_title ); ?>" id="title" /></div> 
    130137</fieldset> 
    131138 
  • branches/2.2/wp-admin/user-edit.php

    r5198 r5589  
    7777<?php wp_nonce_field('update-user_' . $user_id) ?> 
    7878<?php if ( $wp_http_referer ) : ?> 
    79     <input type="hidden" name="wp_http_referer" value="<?php echo wp_specialchars($wp_http_referer); ?>" /> 
     79    <input type="hidden" name="wp_http_referer" value="<?php echo clean_url($wp_http_referer); ?>" /> 
    8080<?php endif; ?> 
    8181<p> 
Note: See TracChangeset for help on using the changeset viewer.