Changes in branches/2.2 [5828:5841]

Location:

branches/2.2

Files:

• wp-admin/admin-functions.php (modified) (1 diff)
• wp-admin/edit-comments.php (modified) (1 diff)
• wp-admin/link-import.php (modified) (1 diff)
• wp-admin/options.php (modified) (4 diffs)
• wp-admin/upload-functions.php (modified) (4 diffs)
• wp-includes/functions.php (modified) (4 diffs)

branches/2.2/wp-admin/admin-functions.php

@@ -902 +902 @@
     global $wpdb;
 
-    $start = (int) $start;
+    $start = abs( (int) $start );
     $num = (int) $num;
 

branches/2.2/wp-admin/edit-comments.php

@@ -77 +77 @@
 
 if ( isset( $_GET['apage'] ) )
-    $page = (int) $_GET['apage'];
+    $page = abs( (int) $_GET['apage'] );
 else
     $page = 1;

branches/2.2/wp-admin/link-import.php

@@ -74 +74 @@
 <h2><?php _e('Importing...') ?></h2>
 <?php
-        $cat_id = $_POST['cat_id'];
-        if ( $cat_id == '' || $cat_id == 0 )
+        $cat_id = abs( (int) $_POST['cat_id'] );
+        if ( $cat_id < 1 )
             $cat_id  = 1;
 

branches/2.2/wp-admin/options.php

@@ -128 +128 @@
 foreach ( (array) $options as $option) :
     $disabled = '';
+    $option->option_name = attribute_escape($option->option_name);
     if ( is_serialized($option->option_value) ) {
         if ( is_serialized_string($option->option_value) ) {
             // this is a serialized string, so we should display it
-            $value = wp_specialchars(maybe_unserialize($option->option_value), 'single');
+            $value = maybe_unserialize($option->option_value);
             $options_to_update[] = $option->option_name;
             $class = 'all-options';
@@ -140 +141 @@
         }
     } else {
-        $value = wp_specialchars($option->option_value, 'single');
+        $value = $option->option_value;
         $options_to_update[] = $option->option_name;
         $class = 'all-options';
@@ -149 +150 @@
 <td>";
 
-    if (strpos($value, "\n") !== false) echo "<textarea class='$class' name='$option->option_name' id='$option->option_name' cols='30' rows='5'>$value</textarea>";
-    else echo "<input class='$class' type='text' name='$option->option_name' id='$option->option_name' size='30' value='" . $value . "'$disabled />";
+    if (strpos($value, "\n") !== false) echo "<textarea class='$class' name='$option->option_name' id='$option->option_name' cols='30' rows='5'>" . wp_specialchars($value) . "</textarea>";
+    else echo "<input class='$class' type='text' name='$option->option_name' id='$option->option_name' size='30' value='" . attribute_escape($value) . "'$disabled />";
 
     echo "</td>
@@ -159 +160 @@
   </table>
 <?php $options_to_update = implode(',', $options_to_update); ?>
-<p class="submit"><input type="hidden" name="page_options" value="<?php echo attribute_escape($options_to_update); ?>" /><input type="submit" name="Update" value="<?php _e('Update Options &raquo;') ?>" /></p>
+<p class="submit"><input type="hidden" name="page_options" value="<?php echo $options_to_update; ?>" /><input type="submit" name="Update" value="<?php _e('Update Options &raquo;') ?>" /></p>
   </form>
 </div>

branches/2.2/wp-admin/upload-functions.php

@@ -108 +108 @@
     $post_id = (int) $post_id;
 ?>
-    <form<?php echo $enctype; ?> id="upload-file" method="post" action="<?php echo get_option('siteurl') . '/wp-admin/upload.php?style=' . attribute_escape($style) . '&amp;tab=upload&amp;post_id=' . $post_id; ?>">
+    <form<?php echo $enctype; ?> id="upload-file" method="post" action="<?php echo get_option('siteurl') . '/wp-admin/upload.php?style=' . attribute_escape($style . '&amp;tab=upload&amp;post_id=' . $post_id); ?>">
 <?php
     if ( $id ) :
@@ -203 +203 @@
         if ( !current_user_can( 'upload_files' ) )
             wp_die( __('You are not allowed to upload files.')
-                . " <a href='" . get_option('siteurl') . "/wp-admin/upload.php?style=$style&amp;tab=browse-all&amp;post_id=$post_id'>"
+                . " <a href='" . get_option('siteurl') . "/wp-admin/upload.php?style=" . attribute_escape($style . "&amp;tab=browse-all&amp;post_id=$post_id") . "'>"
                 . __('Browse Files') . '</a>'
             );
@@ -213 +213 @@
         if ( isset($file['error']) )
             wp_die($file['error'] . "<br /><a href='" . get_option('siteurl')
-            . "/wp-admin/upload.php?style=$style&amp;tab=$from_tab&amp;post_id=$post_id'>" . __('Back to Image Uploading') . '</a>'
+            . "/wp-admin/upload.php?style=" . attribute_escape($style . "&amp;tab=$from_tab&amp;post_id=$post_id") . "'>" . __('Back to Image Uploading') . '</a>'
         );
 
@@ -260 +260 @@
         if ( !current_user_can('edit_post', (int) $ID) )
             wp_die( __('You are not allowed to delete this attachment.')
-                . " <a href='" . get_option('siteurl') . "/wp-admin/upload.php?style=$style&amp;tab=$from_tab&amp;post_id=$post_id'>"
+                . " <a href='" . get_option('siteurl') . "/wp-admin/upload.php?style=" . attribute_escape($style . "&amp;tab=$from_tab&amp;post_id=$post_id") . "'>"
                 . __('Go back') . '</a>'
             );

branches/2.2/wp-includes/functions.php

@@ -204 +204 @@
 /* Options functions */
 
+// expects $setting to already be SQL-escaped
 function get_option($setting) {
     global $wpdb;
@@ -303 +304 @@
 }
 
+// expects $option_name to NOT be SQL-escaped
 function update_option($option_name, $newvalue) {
     global $wpdb;
@@ -308 +310 @@
     wp_protect_special_option($option_name);
 
+    $safe_option_name = $wpdb->escape($option_name);
+
     if ( is_string($newvalue) )
         $newvalue = trim($newvalue);
 
     // If the new and old values are the same, no need to update.
-    $oldvalue = get_option($option_name);
+    $oldvalue = get_option($safe_option_name);
     if ( $newvalue === $oldvalue ) {
         return false;
@@ -350 +354 @@
 
 // thx Alex Stapleton, http://alex.vort-x.net/blog/
+// expects $name to NOT be SQL-escaped
 function add_option($name, $value = '', $description = '', $autoload = 'yes') {
     global $wpdb;
 
     wp_protect_special_option($name);
+    $safe_name = $wpdb->escape($name);
 
     // Make sure the option doesn't already exist. We can check the 'notoptions' cache before we ask for a db query
     $notoptions = wp_cache_get('notoptions', 'options');
     if ( !is_array($notoptions) || !isset($notoptions[$name]) )
-        if ( false !== get_option($name) )
+        if ( false !== get_option($safe_name) )
             return;