Changeset 5711

Timestamp:

06/15/2007 05:22:38 PM (18 years ago)

Author:

ryan

Message:

Use CDATA escaping on fields. Props tellyworth. fixes #4452

Location:

trunk/wp-admin

Files:

• export.php (modified) (2 diffs)
• import/wordpress.php (modified) (3 diffs)

trunk/wp-admin/export.php

@@ -132 +132 @@
     your blog. It contains information about your blog's posts, comments, and 
     categories. You may use this file to transfer that content from one site to 
-    another. This file is not intended to serve as a complete backup of your 
+    another. This file is not intended to serve as a complete backup of your
     blog.
 
@@ -204 +204 @@
 <wp:comment>
 <wp:comment_id><?php echo $c->comment_ID; ?></wp:comment_id>
-<wp:comment_author><?php echo $c->comment_author; ?></wp:comment_author>
+<wp:comment_author><?php echo wxr_cdata($c->comment_author); ?></wp:comment_author>
 <wp:comment_author_email><?php echo $c->comment_author_email; ?></wp:comment_author_email>
 <wp:comment_author_url><?php echo $c->comment_author_url; ?></wp:comment_author_url>

trunk/wp-admin/import/wordpress.php

@@ -38 +38 @@
         global $wpdb;
         preg_match("|<$tag.*?>(.*?)</$tag>|is", $string, $return);
-        $return = $wpdb->escape( trim( $return[1] ) );
+        $return = preg_replace('|<!\[CDATA\[(.*)\]\]>|', '$1', $return[1]);
+        $return = $wpdb->escape( trim( $return ) );
         return $return;
     }
@@ -216 +217 @@
 
         while ( $c = array_shift($this->categories) ) {
-            $cat_name = trim(str_replace(array ('<![CDATA[', ']]>'), '', $this->get_tag( $c, 'wp:cat_name' )));
+            $cat_name = trim($this->get_tag( $c, 'wp:cat_name' ));
 
             // If the category exists we leave it alone
@@ -275 +276 @@
 
         $post_content = $this->get_tag( $post, 'content:encoded' );
-        $post_content = str_replace(array ('<![CDATA[', ']]>'), '', $post_content);
         $post_content = preg_replace('|<(/?[A-Z]+)|e', "'<' . strtolower('$1')", $post_content);
         $post_content = str_replace('<br>', '<br />', $post_content);