Changeset 5589 for branches/2.2/wp-admin/edit-page-form.php

Timestamp:

05/29/2007 04:37:35 AM (14 years ago)

Author:

markjaquith

Message:

Int casting and misc escaping for 2.2 Props g30rg3x. fixes #4333 for 2.2

File:

• branches/2.2/wp-admin/edit-page-form.php (modified) (6 diffs)

branches/2.2/wp-admin/edit-page-form.php

@@ -3 +3 @@
 <h2 id="write-post"><?php _e('Write Page'); ?></h2>
 <?php
+
 if (0 == $post_ID) {
     $form_action = 'post';
@@ -9 +10 @@
     $form_extra = "<input type='hidden' id='post_ID' name='temp_ID' value='$temp_ID' />";
 } else {
+    $post_ID = (int) $post_ID;
     $form_action = 'editpost';
     $nonce_action = 'update-page_' . $post_ID;
     $form_extra = "<input type='hidden' id='post_ID' name='post_ID' value='$post_ID' />";
 }
+
+$temp_ID = (int) $temp_ID;
+$user_ID = (int) $user_ID;
 
 $sendto = clean_url(stripslashes(wp_get_referer()));
@@ -69 +74 @@
 <fieldset id="passworddiv" class="dbx-box">
 <h3 class="dbx-handle"><?php _e('Page Password') ?></h3>
-<div class="dbx-content"><input name="post_password" type="text" size="13" id="post_password" value="<?php echo $post->post_password ?>" /></div>
+<div class="dbx-content"><input name="post_password" type="text" size="13" id="post_password" value="<?php echo attribute_escape( $post->post_password ); ?>" /></div>
 </fieldset>
 
@@ -94 +99 @@
 <fieldset id="slugdiv" class="dbx-box">
 <h3 class="dbx-handle"><?php _e('Page Slug') ?></h3>
-<div class="dbx-content"><input name="post_name" type="text" size="13" id="post_name" value="<?php echo $post->post_name ?>" /></div>
+<div class="dbx-content"><input name="post_name" type="text" size="13" id="post_name" value="<?php echo attribute_escape( $post->post_name ); ?>" /></div>
 </fieldset>
 
@@ -107 +112 @@
 if ( $post->post_author == $o->ID || ( empty($post_ID) && $user_ID == $o->ID ) ) $selected = 'selected="selected"';
 else $selected = '';
+$o->ID = (int) $o->ID;
+$o->display_name = wp_specialchars( $o->display_name );
 echo "<option value='$o->ID' $selected>$o->display_name</option>";
 endforeach;
@@ -127 +134 @@
 <fieldset id="titlediv">
   <legend><?php _e('Page Title') ?></legend>
-  <div><input type="text" name="post_title" size="30" tabindex="1" value="<?php echo $post->post_title; ?>" id="title" /></div>
+  <div><input type="text" name="post_title" size="30" tabindex="1" value="<?php echo attribute_escape( $post->post_title ); ?>" id="title" /></div>
 </fieldset>