WordPress.org

Make WordPress Core


Ignore:
Timestamp:
05/29/2007 04:37:35 AM (14 years ago)
Author:
markjaquith
Message:

Int casting and misc escaping for 2.2 Props g30rg3x. fixes #4333 for 2.2

File:
1 edited

Legend:

Unmodified
Added
Removed

  • branches/2.2/wp-admin/edit-form-advanced.php

    r5289 r5589  
    11<?php
     2if ( isset($_GET['message']) )
     3      $_GET['message'] = (int) $_GET['message'];
    24$messages[1] = __('Post updated');
    35$messages[2] = __('Custom field updated');
    … …  
    57?>
    68<?php if (isset($_GET['message'])) : ?>
    7 <div id="message" class="updated fade"><p><?php echo $messages[$_GET['message']]; ?></p></div>
     9<div id="message" class="updated fade"><p><?php echo wp_specialchars($messages[$_GET['message']]); ?></p></div>
    810<?php endif; ?>
    911
    … …  
    2224    wp_nonce_field('add-post');
    2325} else {
     26    $post_ID = (int) $post_ID;
    2427    $form_action = 'editpost';
    2528    $form_extra = "<input type='hidden' id='post_ID' name='post_ID' value='$post_ID' />";
    … …  
    2730}
    2831
    29 $form_pingback = '<input type="hidden" name="post_pingback" value="' . get_option('default_pingback_flag') . '" id="post_pingback" />';
    30 
    31 $form_prevstatus = '<input type="hidden" name="prev_status" value="' . $post->post_status . '" />';
    32 
    33 $form_trackback = '<input type="text" name="trackback_url" style="width: 415px" id="trackback" tabindex="7" value="'. str_replace("\n", ' ', $post->to_ping) .'" />';
     32$form_pingback = '<input type="hidden" name="post_pingback" value="' . (int) get_option('default_pingback_flag') . '" id="post_pingback" />';
     33
     34$form_prevstatus = '<input type="hidden" name="prev_status" value="' . attribute_escape( $post->post_status ) . '" />';
     35
     36$form_trackback = '<input type="text" name="trackback_url" style="width: 415px" id="trackback" tabindex="7" value="'. attribute_escape( str_replace("\n", ' ', $post->to_ping) ) .'" />';
    3437
    3538if ('' != $post->pinged) {
    … …  
    4245}
    4346
    44 $saveasdraft = '<input name="save" type="submit" id="save" tabindex="3" value="' . __('Save and Continue Editing') . '" />';
     47$saveasdraft = '<input name="save" type="submit" id="save" tabindex="3" value="' . attribute_escape( __('Save and Continue Editing') ) . '" />';
    4548
    4649if (empty($post->post_status)) $post->post_status = 'draft';
    … …  
    4851?>
    4952
    50 <input type="hidden" name="user_ID" value="<?php echo $user_ID ?>" />
     53<input type="hidden" name="user_ID" value="<?php echo (int) $user_ID ?>" />
    5154<input type="hidden" id="hiddenaction" name="action" value="<?php echo $form_action ?>" />
    5255<input type="hidden" id="originalaction" name="originalaction" value="<?php echo $form_action ?>" />
    53 <input type="hidden" name="post_author" value="<?php echo $post->post_author ?>" />
     56<input type="hidden" name="post_author" value="<?php echo attribute_escape( $post->post_author ); ?>" />
    5457<input type="hidden" id="post_type" name="post_type" value="post" />
    5558
    … …  
    8992<fieldset id="passworddiv" class="dbx-box">
    9093<h3 class="dbx-handle"><?php _e('Post Password') ?></h3>
    91 <div class="dbx-content"><input name="post_password" type="text" size="13" id="post_password" value="<?php echo $post->post_password ?>" /></div>
     94<div class="dbx-content"><input name="post_password" type="text" size="13" id="post_password" value="<?php echo attribute_escape( $post->post_password ); ?>" /></div>
    9295</fieldset>
    9396
    9497<fieldset id="slugdiv" class="dbx-box">
    9598<h3 class="dbx-handle"><?php _e('Post Slug') ?></h3>
    96 <div class="dbx-content"><input name="post_name" type="text" size="13" id="post_name" value="<?php echo $post->post_name ?>" /></div>
     99<div class="dbx-content"><input name="post_name" type="text" size="13" id="post_name" value="<?php echo attribute_escape( $post->post_name ); ?>" /></div>
    97100</fieldset>
    98101
    … …  
    126129if ( $post->post_author == $o->ID || ( empty($post_ID) && $user_ID == $o->ID ) ) $selected = 'selected="selected"';
    127130else $selected = '';
    128 echo "<option value='$o->ID' $selected>$o->display_name</option>";
     131echo "<option value='" . (int) $o->ID . "' $selected>" . wp_specialchars( $o->display_name ) . "</option>";
    129132endforeach;
    130133?>
    … …  
    141144<fieldset id="titlediv">
    142145    <legend><?php _e('Title') ?></legend>
    143     <div><input type="text" name="post_title" size="30" tabindex="1" value="<?php echo $post->post_title; ?>" id="title" /></div>
     146    <div><input type="text" name="post_title" size="30" tabindex="1" value="<?php echo attribute_escape($post->post_title); ?>" id="title" /></div>
    144147</fieldset>
    145148
    … …  
    169172?>
    170173<?php if ( current_user_can('publish_posts') ) : ?>
    171     <input name="publish" type="submit" id="publish" tabindex="5" accesskey="p" value="<?php _e('Publish') ?>" />
     174    <input name="publish" type="submit" id="publish" tabindex="5" accesskey="p" value="<?php _e('Publish'); ?>" />
    172175<?php endif; ?>
    173176<?php
    … …  
    187190<?php
    188191if (current_user_can('upload_files')) {
    189     $uploading_iframe_ID = (0 == $post_ID ? $temp_ID : $post_ID);
     192    $uploading_iframe_ID = (int) (0 == $post_ID ? $temp_ID : $post_ID);
    190193    $uploading_iframe_src = wp_nonce_url("upload.php?style=inline&amp;tab=upload&amp;post_id=$uploading_iframe_ID", 'inlineuploading');
    191194    $uploading_iframe_src = apply_filters('uploading_iframe_src', $uploading_iframe_src);
Note: See TracChangeset for help on using the changeset viewer.