Upstream
/
WordPress
mirror of https://github.com/WordPress/WordPress.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

Axing htmlspecialchars because it double-encodes-encodes. Better error handling around queries. 

git-svn-id: http://svn.automattic.com/wordpress/trunk@1940 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This commit is contained in:
saxmatt 2004-12-12 20:41:19 +00:00
parent 06bacff67d
commit c3e1d51c20
35 changed files with 199 additions and 202 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
wp-admin/admin-functions.php
View File

@ -90,7 +90,7 @@ function write_nested_categories($categories) {
foreach($categories as $category) {
echo '<label for="category-', $category['cat_ID'], '" class="selectit"><input value="', $category['cat_ID'],
'" type="checkbox" name="post_category[]" id="category-', $category['cat_ID'], '"',
($category['checked'] ? ' checked="checked"' : ""), '/> ', htmlspecialchars($category['cat_name']), "</label>\n";
($category['checked'] ? ' checked="checked"' : ""), '/> ', wp_specialchars($category['cat_name']), "</label>\n";
if(isset($category['children'])) {
echo "\n<span class='cat-nest'>\n";
@ -113,7 +113,7 @@ function cat_rows($parent = 0, $level = 0, $categories = 0) {
if ($categories) {
foreach ($categories as $category) {
if ($category->category_parent == $parent) {
$category->cat_name = htmlspecialchars($category->cat_name);
$category->cat_name = wp_specialchars($category->cat_name);
$count = $wpdb->get_var("SELECT COUNT(post_id) FROM $wpdb->post2cat WHERE category_id = $category->cat_ID");
$pad = str_repeat('&#8212; ', $level);
if ( $user_level > 3 )
@ -144,7 +144,7 @@ function wp_dropdown_cats($currentcat = 0, $currentparent = 0, $parent = 0, $lev
foreach ($categories as $category) { if ($currentcat != $category->cat_ID && $parent == $category->category_parent) {
$count = $wpdb->get_var("SELECT COUNT(post_id) FROM $wpdb->post2cat WHERE category_id = $category->cat_ID");
$pad = str_repeat('&#8211; ', $level);
$category->cat_name = htmlspecialchars($category->cat_name);
$category->cat_name = wp_specialchars($category->cat_name);
echo "\n\t<option value='$category->cat_ID'";
if ($currentparent == $category->cat_ID)
echo " selected='selected'";

27
wp-admin/bookmarklet.php
View File

@ -20,8 +20,8 @@ window.close()
</html>
<?php
} else {
$popuptitle = htmlspecialchars(stripslashes($popuptitle));
$text = htmlspecialchars(stripslashes(urldecode($text)));
$popuptitle = wp_specialchars(stripslashes($popuptitle));
$text = wp_specialchars(stripslashes(urldecode($text)));
/* big funky fixes for browsers' javascript bugs */
@ -40,24 +40,22 @@ window.close()
$text = preg_replace($wp_gecko_correction["in"],$wp_gecko_correction["out"],$text);
}
$post_title = $_REQUEST['post_title'];
$post_title = wp_specialchars($_REQUEST['post_title']);
if (!empty($post_title)) {
$post_title = stripslashes($post_title);
} else {
$post_title = $popuptitle;
}
// I'm not sure why we're using $edited_post_title in the edit-form.php, but we are
// and that is what is being included below. For this reason, I am just duplicating
// the var instead of changing the assignment on the lines above.
// -- Alex King 2004-01-07
$edited_post_title = htmlspecialchars($post_title);
$edited_post_title = wp_specialchars($post_title);
// $post_pingback needs to be set in any file that includes edit-form.php
$post_pingback = get_settings('default_pingback_flag');
$content = htmlspecialchars($_REQUEST['content']);
if (!empty($content)) {
$content = stripslashes($content);
$content = wp_specialchars($_REQUEST['content']);
$popupurl = wp_specialchars($_REQUEST['popupurl']);
if ( !empty($content) ) {
$content = wp_specialchars( stripslashes($_REQUEST['content']) );
} else {
$content = '<a href="'.$popupurl.'">'.$popuptitle.'</a>'."\n$text";
}
@ -71,14 +69,7 @@ window.close()
<meta http-equiv="Content-Type" content="text/html; charset=<?php echo get_settings('blog_charset'); ?>" />
<link rel="stylesheet" href="wp-admin.css" type="text/css" />
<link rel="shortcut icon" href="../wp-images/wp-favicon.png" />
<script type="text/javascript">
<!--
function launchupload() {
window.open ("upload.php", "wpupload", "width=380,height=360,location=0,menubar=0,resizable=1,scrollbars=yes,status=1,toolbar=0");
}
//-->
</script>
<style type="text/css">
<!--

12
wp-admin/categories.php
View File

@ -26,7 +26,7 @@ case 'addcat':
if ($user_level < 3)
die (__('Cheatin&#8217; uh?'));
$cat_name= $_POST['cat_name'];
$cat_name= wp_specialchars($_POST['cat_name']);
$id_result = $wpdb->get_row("SHOW TABLE STATUS LIKE '$wpdb->categories'");
$cat_ID = $id_result->Auto_increment;
$category_nicename = sanitize_title($cat_name, $cat_ID);
@ -64,7 +64,7 @@ break;
case 'edit':
require_once ('admin-header.php');
$cat_ID = intval($_GET['cat_ID']);
$cat_ID = (int) $_GET['cat_ID'];
$category = $wpdb->get_row("SELECT * FROM $wpdb->categories WHERE cat_ID = '$cat_ID'");
$cat_name = $category->cat_name;
?>
@ -75,12 +75,12 @@ case 'edit':
<table class="editform" width="100%" cellspacing="2" cellpadding="5">
<tr>
<th width="33%" scope="row"><?php _e('Category name:') ?></th>
<td width="67%"><input name="cat_name" type="text" value="<?php echo htmlspecialchars($cat_name); ?>" size="40" /> <input type="hidden" name="action" value="editedcat" />
<td width="67%"><input name="cat_name" type="text" value="<?php echo wp_specialchars($cat_name); ?>" size="40" /> <input type="hidden" name="action" value="editedcat" />
<input type="hidden" name="cat_ID" value="<?php echo $cat_ID ?>" /></td>
</tr>
<tr>
<th scope="row"><?php _e('Category slug:') ?></th>
<td><input name="category_nicename" type="text" value="<?php echo htmlspecialchars($category->category_nicename); ?>" size="40" /></td>
<td><input name="category_nicename" type="text" value="<?php echo wp_specialchars($category->category_nicename); ?>" size="40" /></td>
</tr>
<tr>
<th scope="row"><?php _e('Category parent:') ?></th>
@ -92,7 +92,7 @@ case 'edit':
</tr>
<tr>
<th scope="row"><?php _e('Description:') ?></th>
<td><textarea name="category_description" rows="5" cols="50" style="width: 97%;"><?php echo htmlspecialchars($category->category_description, ENT_NOQUOTES); ?></textarea></td>
<td><textarea name="category_description" rows="5" cols="50" style="width: 97%;"><?php echo wp_specialchars($category->category_description, 1); ?></textarea></td>
</tr>
</table>
<p class="submit"><input type="submit" name="submit" value="<?php _e('Edit category') ?> &raquo;" /></p>
@ -107,7 +107,7 @@ case 'editedcat':
if ($user_level < 3)
die (__('Cheatin&#8217; uh?'));
$cat_name = $_POST['cat_name'];
$cat_name = wp_specialchars($_POST['cat_name']);
$cat_ID = (int) $_POST['cat_ID'];
$category_nicename = sanitize_title($_POST['category_nicename'], $cat_ID);
$category_description = $_POST['category_description'];

4
wp-admin/edit-comments.php
View File

@ -6,7 +6,7 @@ $parent_file = 'edit.php';
require_once('admin-header.php');
if (empty($_GET['mode'])) $mode = 'view';
else $mode = htmlspecialchars($_GET['mode']);
else $mode = wp_specialchars($_GET['mode'], 1);
?>
<script type="text/javascript">
@ -29,7 +29,7 @@ function checkAll(form)
<form name="searchform" action="" method="get">
<fieldset>
<legend><?php _e('Show Comments That Contain...') ?></legend>
<input type="text" name="s" value="<?php if (isset($_GET['s'])) echo htmlspecialchars($_GET['s']); ?>" size="17" />
<input type="text" name="s" value="<?php if (isset($_GET['s'])) echo wp_specialchars($_GET['s'], 1); ?>" size="17" />
<input type="submit" name="submit" value="<?php _e('Search') ?>" />
<input type="hidden" name="mode" value="<?php echo $mode; ?>" />
<?php _e('(Searches within comment text, e-mail, URI, and IP address.)') ?>

2
wp-admin/edit-form-advanced.php
View File

@ -128,7 +128,7 @@ if ('publish' != $post_status || 0 == $post_ID) {
<?php
}
?>
<input name="referredby" type="hidden" id="referredby" value="<?php echo htmlspecialchars($_SERVER['HTTP_REFERER']); ?>" />
<input name="referredby" type="hidden" id="referredby" value="<?php echo wp_specialchars($_SERVER['HTTP_REFERER']); ?>" />
</p>
<?php do_action('edit_form_advanced', ''); ?>

2
wp-admin/edit-page-form.php
View File

@ -77,7 +77,7 @@ edCanvas = document.getElementById('content');
<p class="submit">
<input name="savepage" type="submit" id="savepage" tabindex="6" value="<?php $post_ID ? _e('Edit Page') :_e('Create New Page') ?> &raquo;" />
<input name="referredby" type="hidden" id="referredby" value="<?php if (isset($_SERVER['HTTP_REFERER'])) echo htmlspecialchars($_SERVER['HTTP_REFERER']); ?>" />
<input name="referredby" type="hidden" id="referredby" value="<?php if (isset($_SERVER['HTTP_REFERER'])) echo wp_specialchars($_SERVER['HTTP_REFERER']); ?>" />
</p>
<fieldset id="pageoptions">

8
wp-admin/edit.php
View File

@ -5,6 +5,8 @@ $title = __('Posts');
$parent_file = 'edit.php';
require_once('admin-header.php');
$_GET['m'] = (int) $_GET['m'];
get_currentuserinfo();
$drafts = $wpdb->get_results("SELECT ID, post_title FROM $wpdb->posts WHERE post_status = 'draft' AND post_author = $user_ID");
@ -65,7 +67,7 @@ if ($drafts || $other_drafts) {
if ( isset( $_GET['m'] ) ) {
echo $month[substr( $_GET['m'], 4, 2 )] . ' ' . substr( $_GET['m'], 0, 4 );
} elseif ( isset( $_GET['s'] ) ) {
printf(__('Search for &#8220;%s&#8221;'), htmlspecialchars($_GET['s']) );
printf(__('Search for &#8220;%s&#8221;'), wp_specialchars($_GET['s']) );
} else {
_e('Last 15 Posts');
}
@ -90,7 +92,7 @@ if ( isset( $_GET['m'] ) ) {
$arc_year = $arc_row->yyear;
$arc_month = $arc_row->mmonth;
if( isset($_GET['m']) && $arc_year . zeroise($arc_month, 2) == $_GET['m'] )
if( isset($_GET['m']) && $arc_year . zeroise($arc_month, 2) == (int) $_GET['m'] )
$default = 'selected="selected"';
else
$default = null;
@ -121,7 +123,7 @@ if ( isset( $_GET['m'] ) ) {
</tr>
<?php
$what_to_show = 'posts';
if ( empty($_GET['m']) && empty($_GET['s']) ) {
if ( empty($_GET['m']) || 0 == $_GET['m'] && empty($_GET['s']) ) {
$showposts = 15;
} else {
$nopaging = true;

36
wp-admin/link-add.php
View File

@ -1,25 +1,25 @@
<?php
require_once('admin.php');
$title = 'Add Link';
$title = __('Add Link');
$this_file = 'link-manager.php';
$parent_file = 'link-manager.php';
function category_dropdown($fieldname, $selected = 0) {
global $wpdb;
$results = $wpdb->get_results("SELECT cat_id, cat_name, auto_toggle FROM $wpdb->linkcategories ORDER BY cat_id");
echo ' <select name="'.$fieldname.'" size="1">'."\n";
foreach ($results as $row) {
echo " <option value=\"".$row->cat_id."\"";
if ($row->cat_id == $selected)
echo " selected";
echo ">".$row->cat_id.": ".htmlspecialchars($row->cat_name);
if ($row->auto_toggle == 'Y')
echo ' (auto toggle)';
echo "</option>\n";
}
echo " </select>\n";
global $wpdb;
$results = $wpdb->get_results("SELECT cat_id, cat_name, auto_toggle FROM $wpdb->linkcategories ORDER BY cat_id");
echo "\n<select name='$fieldname' size='1'>\n";
foreach ($results as $row) {
echo "\n\t<option value='$row->cat_id'";
if ($row->cat_id == $selected)
echo " selected='selected'";
echo ">$row->cat_id : " . wp_specialchars($row->cat_name);
if ($row->auto_toggle == 'Y')
echo ' (auto toggle)';
echo "</option>";
}
echo "\n</select>\n";
}
$wpvarstoreset = array('action', 'cat_id', 'linkurl', 'name', 'image',
@ -49,7 +49,7 @@ require('admin-header.php');
?>
<?php if ($_GET['added']) : ?>
<div class="updated"><p>Link added.</p></div>
<div class="updated"><p><?php _e('Link added.'); ?></p></div>
<?php endif; ?>
<div class="wrap">
<h2><?php _e('<strong>Add</strong> a link:') ?></h2>
@ -59,11 +59,11 @@ require('admin-header.php');
<table class="editform" width="100%" cellspacing="2" cellpadding="5">
<tr>
<th width="33%" scope="row"><?php _e('URI:') ?></th>
<td width="67%"><input type="text" name="linkurl" value="<?php echo $_GET['linkurl']; ?>" style="width: 95%;" /></td>
<td width="67%"><input type="text" name="linkurl" value="<?php echo wp_specialchars($_GET['linkurl'], 1); ?>" style="width: 95%;" /></td>
</tr>
<tr>
<th scope="row"><?php _e('Link Name:') ?></th>
<td><input type="text" name="name" value="<?php echo urldecode($_GET['name']); ?>" style="width: 95%" /></td>
<td><input type="text" name="name" value="<?php echo wp_specialchars( urldecode($_GET['name']), 1 ); ?>" style="width: 95%" /></td>
</tr>
<tr>
<th scope="row"><?php _e('Short description:') ?></th>

22
wp-admin/link-categories.php
View File

@ -28,7 +28,7 @@ switch ($action) {
if ($user_level < 5)
die (__("Cheatin' uh ?"));
$cat_name = addslashes($_POST['cat_name']);
$cat_name = wp_specialchars($_POST['cat_name']);
$auto_toggle = $_POST['auto_toggle'];
if ($auto_toggle != 'Y') {
$auto_toggle = 'N';
@ -79,7 +79,7 @@ switch ($action) {
} // end addcat
case 'Delete':
{
$cat_id = $_GET['cat_id'];
$cat_id = (int) $_GET['cat_id'];
$cat_name=get_linkcatname($cat_id);
if ($cat_id=="1")
@ -97,7 +97,7 @@ switch ($action) {
case 'Edit':
{
include_once ('admin-header.php');
$cat_id = $_GET['cat_id'];
$cat_id = (int) $_GET['cat_id'];
$row = $wpdb->get_row("SELECT cat_id, cat_name, auto_toggle, show_images, show_description, "
. " show_rating, show_updated, sort_order, sort_desc, text_before_link, text_after_link, "
. " text_after_all, list_limit FROM $wpdb->linkcategories WHERE cat_id=$cat_id");
@ -108,7 +108,7 @@ switch ($action) {
?>
<div class="wrap">
<h2>Edit &#8220;<?php echo htmlspecialchars($row->cat_name)?>&#8221; Category </h2>
<h2>Edit &#8220;<?php echo wp_specialchars($row->cat_name)?>&#8221; Category </h2>
<form name="editcat" method="post">
<input type="hidden" name="action" value="editedcat" />
@ -118,7 +118,7 @@ switch ($action) {
<table class="editform" width="100%" cellspacing="2" cellpadding="5">
<tr>
<th width="33%" scope="row"><?php _e('Name:') ?></th>
<td width="67%"><input name="cat_name" type="text" value="<?php echo htmlspecialchars($row->cat_name)?>" size="30" /></td>
<td width="67%"><input name="cat_name" type="text" value="<?php echo wp_specialchars($row->cat_name)?>" size="30" /></td>
</tr>
<tr>
<th scope="row"><?php _e('Show:') ?></th>
@ -176,15 +176,15 @@ switch ($action) {
<table class="editform" width="100%" cellspacing="2" cellpadding="5">
<tr>
<th width="33%" scope="row"><?php _e('Before Link:') ?></th>
<td width="67%"><input type="text" name="text_before_link" size="45" value="<?php echo htmlspecialchars($row->text_before_link)?>" /></td>
<td width="67%"><input type="text" name="text_before_link" size="45" value="<?php echo wp_specialchars($row->text_before_link)?>" /></td>
</tr>
<tr>
<th scope="row"><?php _e('Between Link and Description:') ?></th>
<td><input type="text" name="text_after_link" size="45" value="<?php echo htmlspecialchars($row->text_after_link)?>" /></td>
<td><input type="text" name="text_after_link" size="45" value="<?php echo wp_specialchars($row->text_after_link)?>" /></td>
</tr>
<tr>
<th scope="row"><?php _e('After Link:') ?></th>
<td><input type="text" name="text_after_all" size="45" value="<?php echo htmlspecialchars($row->text_after_all)?>"/></td>
<td><input type="text" name="text_after_all" size="45" value="<?php echo wp_specialchars($row->text_after_all)?>"/></td>
</tr>
</table>
</fieldset>
@ -204,9 +204,9 @@ switch ($action) {
$submit=$_POST["submit"];
if (isset($submit)) {
$cat_id=$_POST["cat_id"];
$cat_id = (int)$_POST["cat_id"];
$cat_name= $_POST["cat_name"];
$cat_name= wp_specialchars($_POST["cat_name"]);
$auto_toggle = $_POST["auto_toggle"];
if ($auto_toggle != 'Y') {
$auto_toggle = 'N';
@ -310,7 +310,7 @@ foreach ($results as $row) {
$style = ($i % 2) ? ' class="alternate"' : '';
?>
<tr valign="middle" align="center" <?php echo $style ?> style="border-bottom: 1px dotted #9C9A9C;">
<td><?php echo htmlspecialchars($row->cat_name)?></td>
<td><?php echo wp_specialchars($row->cat_name)?></td>
<td ><?php echo $row->cat_id?></td>
<td><?php echo $row->auto_toggle?></td>
<td><?php echo $row->show_images?></td>

69
wp-admin/link-manager.php
View File

@ -32,7 +32,7 @@ function category_dropdown($fieldname, $selected = 0) {
echo "\n\t<option value='$row->cat_id'";
if ($row->cat_id == $selected)
echo " selected='selected'";
echo ">$row->cat_id: ".htmlspecialchars($row->cat_name);
echo ">$row->cat_id: ".wp_specialchars($row->cat_name);
if ('Y' == $row->auto_toggle)
echo ' (auto toggle)';
echo "</option>\n";
@ -160,10 +160,10 @@ switch ($action) {
{
check_admin_referer();
$link_url = $_POST['linkurl'];
$link_url = wp_specialchars($_POST['linkurl']);
$link_url = preg_match('/^(https?|ftps?|mailto|news|gopher):/is', $link_url) ? $link_url : 'http://' . $link_url;
$link_name = $_POST['name'];
$link_image = $_POST['image'];
$link_name = wp_specialchars($_POST['name']);
$link_image = wp_specialchars($_POST['image']);
$link_target = $_POST['target'];
$link_category = $_POST['category'];
$link_description = $_POST['description'];
@ -171,7 +171,7 @@ switch ($action) {
$link_rating = $_POST['rating'];
$link_rel = $_POST['rel'];
$link_notes = $_POST['notes'];
$link_rss_uri = $_POST['rss_uri'];
$link_rss_uri = wp_specialchars($_POST['rss_uri']);
$auto_toggle = get_autotoggle($link_category);
if ($user_level < 5)
@ -207,12 +207,12 @@ switch ($action) {
check_admin_referer();
$link_id = $_POST['link_id'];
$link_url = $_POST['linkurl'];
$link_id = (int) $_POST['link_id'];
$link_url = wp_specialchars($_POST['linkurl']);
$link_url = preg_match('/^(https?|ftps?|mailto|news|gopher):/is', $link_url) ? $link_url : 'http://' . $link_url;
$link_name = $_POST['name'];
$link_image = $_POST['image'];
$link_target = $_POST['target'];
$link_name = wp_specialchars($_POST['name']);
$link_image = wp_specialchars($_POST['image']);
$link_target = wp_specialchars($_POST['target']);
$link_category = $_POST['category'];
$link_description = $_POST['description'];
$link_visible = $_POST['visible'];
@ -270,31 +270,30 @@ switch ($action) {
break;
} // end Delete
case 'linkedit':
{
case 'linkedit': {
$xfn = true;
include_once ('admin-header.php');
if ($user_level < 5) {
if ($user_level < 5)
die(__('You do not have sufficient permissions to edit the links for this blog.'));
}
$link_id = (int) $_GET['link_id'];
$row = $wpdb->get_row("SELECT *
FROM $wpdb->links
WHERE link_id = $link_id");
$row = $wpdb->get_row("SELECT * FROM $wpdb->links WHERE link_id = $link_id");
if ($row) {
$link_url = htmlspecialchars($row->link_url);
$link_name = htmlspecialchars($row->link_name);
$link_url = wp_specialchars($row->link_url, 1);
$link_name = wp_specialchars($row->link_name, 1);
$link_image = $row->link_image;
$link_target = $row->link_target;
$link_category = $row->link_category;
$link_description = htmlspecialchars($row->link_description);
$link_description = wp_specialchars($row->link_description);
$link_visible = $row->link_visible;
$link_rating = $row->link_rating;
$link_rel = $row->link_rel;
$link_notes = htmlspecialchars($row->link_notes);
$link_rss_uri = htmlspecialchars($row->link_rss);
}
$link_notes = wp_specialchars($row->link_notes);
$link_rss_uri = wp_specialchars($row->link_rss);
} else {
die( __('Link not found.') );
}
?>
@ -492,9 +491,9 @@ switch ($action) {
</fieldset>
<p class="submit"><input type="submit" name="submit" value="<?php _e('Save Changes &raquo;') ?>" />
<input type="hidden" name="action" value="editlink" />
<input type="hidden" name="link_id" value="<?php echo $link_id; ?>" />
<input type="hidden" name="order_by" value="<?php echo $order_by ?>" />
<input type="hidden" name="cat_id" value="<?php echo $cat_id ?>" /></p>
<input type="hidden" name="link_id" value="<?php echo (int) $link_id; ?>" />
<input type="hidden" name="order_by" value="<?php echo wp_specialchars($order_by, 1); ?>" />
<input type="hidden" name="cat_id" value="<?php echo (int) $cat_id ?>" /></p>
</form>
</div>
<?php
@ -598,7 +597,7 @@ function checkAll(form)
echo " <option value=\"".$row->cat_id."\"";
if ($row->cat_id == $cat_id)
echo " selected='selected'";
echo ">".$row->cat_id.": ".htmlspecialchars($row->cat_name);
echo ">".$row->cat_id.": ".wp_specialchars($row->cat_name);
if ($row->auto_toggle == 'Y')
echo ' (auto toggle)';
echo "</option>\n";
@ -630,8 +629,8 @@ function checkAll(form)
<input type="hidden" name="link_id" value="" />
<input type="hidden" name="action" value="" />
<input type="hidden" name="order_by" value="<?php echo $order_by ?>" />
<input type="hidden" name="cat_id" value="<?php echo $cat_id ?>" />
<input type="hidden" name="order_by" value="<?php echo wp_specialchars($order_by, 1); ?>" />
<input type="hidden" name="cat_id" value="<?php echo (int) $cat_id ?>" />
<table width="100%" cellpadding="3" cellspacing="3">
<tr>
<th width="15%"><?php _e('Name') ?></th>
@ -660,10 +659,10 @@ function checkAll(form)
$links = $wpdb->get_results($sql);
if ($links) {
foreach ($links as $link) {
$link->link_name = htmlspecialchars($link->link_name);
$link->link_category = htmlspecialchars($link->link_category);
$link->link_description = htmlspecialchars($link->link_description);
$link->link_url = htmlspecialchars($link->link_url);
$link->link_name = wp_specialchars($link->link_name);
$link->link_category = wp_specialchars($link->link_category);
$link->link_description = wp_specialchars($link->link_description);
$link->link_url = wp_specialchars($link->link_url);
$short_url = str_replace('http://', '', $link->link_url);
$short_url = str_replace('www.', '', $short_url);
if ('/' == substr($short_url, -1))
@ -753,6 +752,4 @@ LINKS;
} // end case
?>
<?php include('admin-footer.php'); ?>
<?php include('admin-footer.php'); ?>

4
wp-admin/options.php
View File

@ -48,7 +48,7 @@ case 'update':
// should we even bother checking?
if ($user_level >= $option->option_admin_level) {
$old_val = $option->option_value;
$new_val = $_POST[$option->option_name];
$new_val = wp_specialchars($_POST[$option->option_name]);
if (!$new_val) {
if (3 == $option->option_type)
$new_val = '';
@ -88,7 +88,7 @@ default:
$options = $wpdb->get_results("SELECT * FROM $wpdb->options ORDER BY option_name");
foreach ($options as $option) :
$value = htmlspecialchars($option->option_value);
$value = wp_specialchars($option->option_value);
echo "
<tr>
<th scope='row'><label for='$option->option_name'>$option->option_name</label></th>

2
wp-admin/plugin-editor.php
View File

@ -67,7 +67,7 @@ default:
if (!$error) {
$f = fopen($real_file, 'r');
$content = fread($f, filesize($real_file));
$content = htmlspecialchars($content);
$content = wp_specialchars($content);
}
?>

4
wp-admin/post.php
View File

@ -656,7 +656,7 @@ default:
$post_pingback = get_settings('default_pingback_flag');
$default_post_cat = get_settings('default_category');
$content = htmlspecialchars($content);
$content = wp_specialchars($content);
$content = apply_filters('default_content', $content);
$edited_post_title = apply_filters('default_title', $edited_post_title);
$excerpt = apply_filters('default_excerpt', $excerpt);
@ -677,7 +677,7 @@ $bookmarklet_height= (get_settings('use_trackback')) ? 480 : 440;
if ($is_NS4 || $is_gecko) {
?>
<a href="javascript:if(navigator.userAgent.indexOf('Safari') >= 0){Q=getSelection();}else{Q=document.selection?document.selection.createRange().text:document.getSelection();}void(window.open('<?php echo get_settings('siteurl') ?>/wp-admin/bookmarklet.php?text='+encodeURIComponent(Q)+'&amp;popupurl='+encodeURIComponent(location.href)+'&amp;popuptitle='+encodeURIComponent(document.title),'<?php _e('WordPress bookmarklet') ?>','scrollbars=yes,width=600,height=460,left=100,top=150,status=yes'));"><?php printf(__('Press It - %s'), htmlspecialchars(get_settings('blogname'))); ?></a>
<a href="javascript:if(navigator.userAgent.indexOf('Safari') >= 0){Q=getSelection();}else{Q=document.selection?document.selection.createRange().text:document.getSelection();}void(window.open('<?php echo get_settings('siteurl') ?>/wp-admin/bookmarklet.php?text='+encodeURIComponent(Q)+'&amp;popupurl='+encodeURIComponent(location.href)+'&amp;popuptitle='+encodeURIComponent(document.title),'<?php _e('WordPress bookmarklet') ?>','scrollbars=yes,width=600,height=460,left=100,top=150,status=yes'));"><?php printf(__('Press It - %s'), wp_specialchars(get_settings('blogname'))); ?></a>
<?php
} else if ($is_winIE) {
?>

22
wp-admin/profile.php
View File

@ -1,10 +1,10 @@
<?php
require_once('admin.php');
$title = "Profile";
$title = 'Profile';
$parent_file = 'profile.php';
$wpvarstoreset = array('action','redirect','profile','user');
$wpvarstoreset = array('action', 'profile', 'user');
for ($i=0; $i<count($wpvarstoreset); $i += 1) {
$wpvar = $wpvarstoreset[$i];
if (!isset($$wpvar)) {
@ -66,18 +66,18 @@ case 'update':
setcookie('wordpresspass_' . COOKIEHASH, md5(md5($newuser_pass)), time() + 31536000, COOKIEPATH);
}
$newuser_firstname = $_POST['newuser_firstname'];
$newuser_lastname = $_POST['newuser_lastname'];
$newuser_firstname = wp_specialchars($_POST['newuser_firstname']);
$newuser_lastname = wp_specialchars($_POST['newuser_lastname']);
$newuser_nickname = $_POST['newuser_nickname'];
$newuser_nicename = sanitize_title($newuser_nickname);
$newuser_icq = $_POST['newuser_icq'];
$newuser_aim = $_POST['newuser_aim'];
$newuser_msn = $_POST['newuser_msn'];
$newuser_yim = $_POST['newuser_yim'];
$newuser_email = $_POST['newuser_email'];
$newuser_url = $_POST['newuser_url'];
$newuser_icq = wp_specialchars($_POST['newuser_icq']);
$newuser_aim = wp_specialchars($_POST['newuser_aim']);
$newuser_msn = wp_specialchars($_POST['newuser_msn']);
$newuser_yim = wp_specialchars($_POST['newuser_yim']);
$newuser_email = wp_specialchars($_POST['newuser_email']);
$newuser_url = wp_specialchars($_POST['newuser_url')];
$newuser_url = preg_match('/^(https?|ftps?|mailto|news|gopher):/is', $newuser_url) ? $newuser_url : 'http://' . $newuser_url;
$newuser_idmode=$_POST['newuser_idmode'];
$newuser_idmode = wp_specialchars($_POST['newuser_idmode']);
$user_description = $_POST['user_description'];
$result = $wpdb->query("UPDATE $wpdb->users SET user_firstname='$newuser_firstname', $updatepassword user_lastname='$newuser_lastname', user_nickname='$newuser_nickname', user_icq='$newuser_icq', user_email='$newuser_email', user_url='$newuser_url', user_aim='$newuser_aim', user_msn='$newuser_msn', user_yim='$newuser_yim', user_idmode='$newuser_idmode', user_description = '$user_description', user_nicename = '$newuser_nicename' WHERE ID = $user_ID");

2
wp-admin/sidebar.php
View File

@ -30,7 +30,7 @@ if ('b' == $_GET['a']) {
<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>WordPress &#8250; Sidebar</title>
<meta http-equiv="Content-Type" content="text/html; charset=<?php echo $blog_charset ?>" />
<meta http-equiv="Content-Type" content="text/html; charset=<?php bloginfo('blog_charset'); ?>" />
<link rel="stylesheet" href="wp-admin.css" type="text/css" />
<link rel="shortcut icon" href="../wp-images/wp-favicon.png" />
<style type="text/css" media="screen">

6
wp-admin/templates.php
View File

@ -63,7 +63,7 @@ default:
if (!$error) {
$f = fopen($real_file, 'r');
$content = fread($f, filesize($real_file));
$content = htmlspecialchars($content);
$content = wp_specialchars($content);
}
?>
@ -73,9 +73,9 @@ default:
<div class="wrap">
<?php
if (is_writeable($real_file)) {
echo '<h2>' . sprintf(__('Editing <strong>%s</strong>'), $file) . '</h2>';
echo '<h2>' . sprintf(__('Editing <strong>%s</strong>'), wp_specialchars($file) ) . '</h2>';
} else {
echo '<h2>' . sprintf(__('Browsing <strong>%s</strong>'), $file) . '</h2>';
echo '<h2>' . sprintf(__('Browsing <strong>%s</strong>'), wp_specialchars($file) ) . '</h2>';
}
?>
<div id="templateside">

2
wp-admin/theme-editor.php
View File

@ -73,7 +73,7 @@ default:
if (!$error) {
$f = fopen($real_file, 'r');
$content = fread($f, filesize($real_file));
$content = htmlspecialchars($content);
$content = wp_specialchars($content);
}
?>

25
wp-admin/user-edit.php
View File

@ -45,19 +45,19 @@ if ($_POST['pass1'] == '') {
$updatepassword = "user_pass=MD5('$new_pass'), ";
}
$new_user_login = $_POST['new_user_login'];
$new_firstname = $_POST['new_firstname'];
$new_lastname = $_POST['new_lastname'];
$new_user_login = wp_specialchars($_POST['new_user_login']);
$new_firstname = wp_specialchars($_POST['new_firstname']);
$new_lastname = wp_specialchars($_POST['new_lastname']);
$new_nickname = $_POST['new_nickname'];
$new_nicename = sanitize_title($new_nickname, $user_id);
$new_icq = $_POST['new_icq'];
$new_aim = $_POST['new_aim'];
$new_msn = $_POST['new_msn'];
$new_yim = $_POST['new_yim'];
$new_email = $_POST['new_email'];
$new_url = $_POST['new_url'];
$new_icq = wp_specialchars($_POST['new_icq']);
$new_aim = wp_specialchars($_POST['new_aim']);
$new_msn = wp_specialchars($_POST['new_msn']);
$new_yim = wp_specialchars($_POST['new_yim']);
$new_email = wp_specialchars($_POST['new_email']);
$new_url = wp_specialchars($_POST['new_url']);
$new_url = preg_match('/^(https?|ftps?|mailto|news|gopher):/is', $new_url) ? $new_url : 'http://' . $new_url;
$new_idmode = $_POST['new_idmode'];
$new_idmode = wp_specialchars($_POST['new_idmode']);
$new_description = $_POST['new_description'];
$result = $wpdb->query("UPDATE $wpdb->users SET user_login = '$new_user_login', user_firstname = '$new_firstname', $updatepassword user_lastname='$new_lastname', user_nickname='$new_nickname', user_icq='$new_icq', user_email='$new_email', user_url='$new_url', user_aim='$new_aim', user_msn='$new_msn', user_yim='$new_yim', user_idmode='$new_idmode', user_description = '$new_description', user_nicename = '$new_nicename' WHERE ID = $user_id");
@ -195,7 +195,6 @@ if ($edituser->user_level >= $user_level) die( __('You do not have permission to
<?php
break;
}
/* </Team> */
include('admin-footer.php');
?>
?>

28
wp-admin/users.php
View File

@ -4,7 +4,7 @@ require_once('admin.php');
$title = __('Users');
$parent_file = 'users.php';
$wpvarstoreset = array('action','standalone','redirect','profile');
$wpvarstoreset = array('action');
for ($i=0; $i<count($wpvarstoreset); $i += 1) {
$wpvar = $wpvarstoreset[$i];
if (!isset($$wpvar)) {
@ -24,17 +24,13 @@ switch ($action) {
case 'adduser':
check_admin_referer();
function filter($value) {
return ereg('^[a-zA-Z0-9\_-\|]+$',$value);
}
$user_login = $_POST['user_login'];
$pass1 = $_POST['pass1'];
$pass2 = $_POST['pass2'];
$user_email = $_POST['email'];
$user_firstname = $_POST['firstname'];
$user_lastname = $_POST['lastname'];
$user_uri = $_POST['uri'];
$user_login = wp_specialchars($_POST['user_login']);
$pass1 = $_POST['pass1'];
$pass2 = $_POST['pass2'];
$user_email = wp_specialchars($_POST['email']);
$user_firstname = wp_specialchars($_POST['firstname']);
$user_lastname = wp_specialchars($_POST['lastname']);
$user_uri = wp_specialchars($_POST['uri']);
/* checking login has been typed */
if ($user_login == '') {
@ -130,7 +126,7 @@ case 'delete':
check_admin_referer();
$id = intval($_GET['id']);
$id = (int) $_GET['id'];
if (!$id) {
header('Location: users.php');
@ -228,8 +224,8 @@ default:
</div>
<?php
$users = $wpdb->get_results("SELECT * FROM $wpdb->users WHERE user_level = 0 ORDER BY ID");
if ($users) {
$users = $wpdb->get_results("SELECT * FROM $wpdb->users WHERE user_level = 0 ORDER BY ID");
if ($users) {
?>
<div class="wrap">
<h2><?php _e('Registered Users') ?></h2>
@ -330,4 +326,4 @@ break;
}
include('admin-footer.php');
?>
?>

2
wp-comments-popup.php
View File

@ -63,7 +63,7 @@ if (!empty($commentstatus->post_password) && $_COOKIE['wp-postpass_'. COOKIEHASH
<input type="text" name="author" id="author" class="textarea" value="<?php echo $comment_author; ?>" size="28" tabindex="1" />
<label for="author"><?php _e("Name"); ?></label>
<input type="hidden" name="comment_post_ID" value="<?php echo $id; ?>" />
<input type="hidden" name="redirect_to" value="<?php echo htmlspecialchars($_SERVER["REQUEST_URI"]); ?>" />
<input type="hidden" name="redirect_to" value="<?php echo wp_specialchars($_SERVER["REQUEST_URI"]); ?>" />
</p>
<p>

2
wp-comments.php
View File

@ -41,7 +41,7 @@
<input type="text" name="author" id="author" class="textarea" value="<?php echo $comment_author; ?>" size="28" tabindex="1" />
<label for="author"><?php _e('Name'); ?></label> <?php if ($req) _e('(required)'); ?>
<input type="hidden" name="comment_post_ID" value="<?php echo $post->ID; ?>" />
<input type="hidden" name="redirect_to" value="<?php echo htmlspecialchars($_SERVER['REQUEST_URI']); ?>" />
<input type="hidden" name="redirect_to" value="<?php echo wp_specialchars($_SERVER['REQUEST_URI']); ?>" />
</p>
<p>

54
wp-includes/classes.php
View File

@ -57,6 +57,7 @@ class WP_Query {
parse_str($query, $qv);
$this->query = $query;
$this->query_vars = $qv;
$qv['m'] = (int) $qv['m'];
if ('' != $qv['name']) {
$this->is_single = true;
@ -71,54 +72,53 @@ class WP_Query {
$this->is_single = false;
}
if ('' != $qv['second']) {
if ( (int) $qv['second']) {
$this->is_time = true;
$this->is_date = true;
}
if ('' != $qv['minute']) {
if ( (int) $qv['minute']) {
$this->is_time = true;
$this->is_date = true;
}
if ('' != $qv['hour']) {
if ( (int) $qv['hour']) {
$this->is_time = true;
$this->is_date = true;
$this->is_date = true;
}
if ('' != $qv['day']) {
if ( (int) $qv['day']) {
if (! $this->is_date) {
$this->is_day = true;
$this->is_date = true;
}
}
if ('' != $qv['monthnum']) {
if ( (int) $qv['monthnum']) {
if (! $this->is_date) {
$this->is_month = true;
$this->is_date = true;
}
}
if ('' != $qv['year']) {
if ( (int) $qv['year']) {
if (! $this->is_date) {
$this->is_year = true;
$this->is_date = true;
}
}
if ('' != $qv['m']) {
if ( (int) $qv['m']) {
$this->is_date = true;
if (strlen($qv['m']) > 9) {
$this->is_time = true;
} else if (strlen($qv['m']) > 7) {
$this->is_day = true;
} else if (strlen($qv['m']) > 5) {
$this->is_month = true;
} else {
$this->is_year = true;
}
$this->is_time = true;
} else if (strlen($qv['m']) > 7) {
$this->is_day = true;
} else if (strlen($qv['m']) > 5) {
$this->is_month = true;
} else {
$this->is_year = true;
}
}
if ('' != $qv['w']) {
@ -232,7 +232,7 @@ class WP_Query {
$wp_posts_post_date_field = "post_date"; // "DATE_ADD(post_date, INTERVAL '$add_hours:$add_minutes' HOUR_MINUTE)";
// If a month is specified in the querystring, load that month
if ('' != $q['m']) {
if ( (int) $q['m'] ) {
$q['m'] = '' . preg_replace('|[^0-9]|', '', $q['m']);
$where .= ' AND YEAR(post_date)=' . substr($q['m'], 0, 4);
if (strlen($q['m'])>5)
@ -247,32 +247,32 @@ class WP_Query {
$where .= ' AND SECOND(post_date)=' . substr($q['m'], 12, 2);
}
if ('' != $q['hour']) {
if ( (int) $q['hour'] ) {
$q['hour'] = '' . intval($q['hour']);
$where .= " AND HOUR(post_date)='" . $q['hour'] . "'";
}
if ('' != $q['minute']) {
if ( (int) $q['minute'] ) {
$q['minute'] = '' . intval($q['minute']);
$where .= " AND MINUTE(post_date)='" . $q['minute'] . "'";
}
if ('' != $q['second']) {
if ( (int) $q['second'] ) {
$q['second'] = '' . intval($q['second']);
$where .= " AND SECOND(post_date)='" . $q['second'] . "'";
}
if ('' != $q['year']) {
if ( (int) $q['year'] ) {
$q['year'] = '' . intval($q['year']);
$where .= " AND YEAR(post_date)='" . $q['year'] . "'";
}
if ('' != $q['monthnum']) {
if ( (int) $q['monthnum'] ) {
$q['monthnum'] = '' . intval($q['monthnum']);
$where .= " AND MONTH(post_date)='" . $q['monthnum'] . "'";
}
if ('' != $q['day']) {
if ( (int) $q['day'] ) {
$q['day'] = '' . intval($q['day']);
$where .= " AND DAYOFMONTH(post_date)='" . $q['day'] . "'";
}
@ -287,15 +287,15 @@ class WP_Query {
}
if ('' != $q['w']) {
if ( (int) $q['w'] ) {
$q['w'] = ''.intval($q['w']);
$where .= " AND WEEK(post_date, 1)='" . $q['w'] . "'";
}
// If a post number is specified, load that post
if (($q['p'] != '') && ($q['p'] != 'all')) {
$q['p'] = intval($q['p']);
$where = ' AND ID = '.$q['p'];
$q['p'] = (int) $q['p'];
$where = ' AND ID = ' . $q['p'];
}
if (($q['page_id'] != '') && ($q['page_id'] != 'all')) {

12
wp-includes/functions-formatting.php
View File

@ -97,6 +97,18 @@ function seems_utf8($Str) { # by bmorel at ssi dot fr
return true;
}
function wp_specialchars( $text, $quotes = 0 ) {
// Like htmlspecialchars except don't double-encode HTML entities
$text = preg_replace('/&([^#])(?![a-z12]{1,8};)/', '&#038;$1', $text);-
$text = str_replace('<', '&lt;', $text);
$text = str_replace('>', '&gt;', $text);
if ( $quotes ) {
$text = str_replace('"', '&quot;', $text);
$text = str_replace('"', '&#039;', $text);
}
return $text;
}
function utf8_uri_encode( $utf8_string ) {
$unicode = '';
$values = array();

4
wp-includes/functions-post.php
View File

@ -389,12 +389,12 @@ function wp_new_comment($commentdata) {
$comment_post_ID = (int) $comment_post_ID;
$comment_author = strip_tags($comment_author);
$comment_author = htmlspecialchars($comment_author);
$comment_author = wp_specialchars($comment_author);
$comment_author_email = preg_replace('/[^a-z+_.@-]/i', '', $comment_author_email);
$comment_author_url = strip_tags($comment_author_url);
$comment_author_url = htmlspecialchars($comment_author_url);
$comment_author_url = wp_specialchars($comment_author_url);
$comment_content = apply_filters('comment_content_presave', $comment_content);

2
wp-includes/functions.php
View File

@ -361,7 +361,7 @@ function get_option($option) {
}
function form_option($option) {
echo htmlspecialchars( get_option($option) );
echo htmlspecialchars( get_option($option), ENT_QUOTES );
}
function get_alloptions() {

6
wp-includes/links.php
View File

@ -176,14 +176,14 @@ function get_links($category = -1, $before = '', $after = '<br />',
}
$the_link = '#';
if (($row->link_url != null) && ($row->link_url != '')) {
$the_link = htmlspecialchars($row->link_url);
$the_link = wp_specialchars($row->link_url);
}
$rel = $row->link_rel;
if ($rel != '') {
$rel = " rel='$rel'";
}
$desc = htmlspecialchars($row->link_description, ENT_QUOTES);
$name = htmlspecialchars($row->link_name, ENT_QUOTES);
$desc = wp_specialchars($row->link_description, ENT_QUOTES);
$name = wp_specialchars($row->link_name, ENT_QUOTES);
$title = $desc;

4
wp-includes/template-functions-author.php
View File

@ -72,7 +72,7 @@ function the_author_posts() {
function the_author_posts_link($idmode='') {
global $id, $authordata;
echo '<a href="' . get_author_link(0, $authordata->ID, $authordata->user_nicename) . '" title="' . sprintf(__("Posts by %s"), htmlspecialchars(the_author($idmode, false))) . '">' . the_author($idmode, false) . '</a>';
echo '<a href="' . get_author_link(0, $authordata->ID, $authordata->user_nicename) . '" title="' . sprintf(__("Posts by %s"), wp_specialchars(the_author($idmode, false))) . '">' . the_author($idmode, false) . '</a>';
}
@ -141,7 +141,7 @@ function list_authors($optioncount = false, $exclude_admin = true, $show_fullnam
if ($posts == 0) {
if (! $hide_empty) echo $name;
} else {
$link = '<a href="' . get_author_link(0, $author->ID, $author->user_nicename) . '" title="' . sprintf(__("Posts by %s"), htmlspecialchars($author->user_nickname)) . '">' . $name . '</a>';
$link = '<a href="' . get_author_link(0, $author->ID, $author->user_nicename) . '" title="' . sprintf(__("Posts by %s"), wp_specialchars($author->user_nickname)) . '">' . $name . '</a>';
if ( (! empty($feed_image)) || (! empty($feed)) ) {

4
wp-includes/template-functions-category.php
View File

@ -356,9 +356,9 @@ function list_cats($optionall = 1, $all = 'All', $sort_column = 'ID', $sort_orde
$num_found++;
$link = '<a href="'.get_category_link(0, $category->cat_ID, $category->category_nicename).'" ';
if ($use_desc_for_title == 0 || empty($category->category_description)) {
$link .= 'title="'. sprintf(__("View all posts filed under %s"), htmlspecialchars($category->cat_name)) . '"';
$link .= 'title="'. sprintf(__("View all posts filed under %s"), wp_specialchars($category->cat_name)) . '"';
} else {
$link .= 'title="' . htmlspecialchars($category->category_description) . '"';
$link .= 'title="' . wp_specialchars($category->category_description) . '"';
}
$link .= '>';
$link .= apply_filters('list_cats', $category->cat_name).'</a>';

4
wp-includes/template-functions-comment.php
View File

@ -282,7 +282,7 @@ function comment_author_rss() {
if (empty($comment->comment_author)) {
echo 'Anonymous';
} else {
echo htmlspecialchars(apply_filters('comment_author', $comment->comment_author));
echo wp_specialchars(apply_filters('comment_author', $comment->comment_author));
}
}
@ -292,7 +292,7 @@ function comment_text_rss() {
$comment_text = str_replace('<pingback />', '', $comment_text);
$comment_text = apply_filters('comment_text', $comment_text);
$comment_text = strip_tags($comment_text);
$comment_text = htmlspecialchars($comment_text);
$comment_text = wp_specialchars($comment_text);
echo $comment_text;
}

2
wp-includes/template-functions-general.php
View File

@ -235,7 +235,7 @@ function single_month_title($prefix = '', $display = true ) {
/* link navigation hack by Orien http://icecode.com/ */
function get_archives_link($url, $text, $format = 'html', $before = '', $after = '') {
$text = wptexturize($text);
$title_text = htmlspecialchars($text, ENT_QUOTES);
$title_text = wp_specialchars($text, 1);
if ('link' == $format) {
return "\t<link rel='archives' title='$title_text' href='$url' />\n";

6
wp-includes/template-functions-post.php
View File

@ -69,7 +69,7 @@ function the_content_rss($more_link_text='(more...)', $stripteaser=0, $more_file
$encode_html = 2;
}
if ($encode_html == 1) {
$content = htmlspecialchars($content);
$content = wp_specialchars($content);
$cut = 0;
} elseif ($encode_html == 0) {
$content = make_url_footnote($content);
@ -146,7 +146,7 @@ function the_excerpt_rss($cut = 0, $encode_html = 0) {
$encode_html = 2;
}
if ($encode_html == 1) {
$output = htmlspecialchars($output);
$output = wp_specialchars($output);
$cut = 0;
} elseif ($encode_html == 0) {
$output = make_url_footnote($output);
@ -334,7 +334,7 @@ function wp_list_pages($args = '') {
$title = apply_filters('the_title', $page->post_title);
echo '<a href="' . get_page_link($page->ID) . '" title="' . htmlspecialchars($title) . '">' . $title . '</a>';
echo '<a href="' . get_page_link($page->ID) . '" title="' . wp_specialchars($title) . '">' . $title . '</a>';
echo '</li>';
}
}

2
wp-includes/vars.php
View File

@ -182,7 +182,7 @@ foreach($wpsmiliestrans as $smiley => $img) {
define('COOKIEPATH', preg_replace('|https?://[^/]+|i', '', get_settings('home') . '/' ) );
// Some default filters
add_filter('bloginfo','htmlspecialchars');
add_filter('bloginfo','wp_specialchars');
add_filter('category_description', 'wptexturize');
add_filter('list_cats', 'wptexturize');
add_filter('comment_author', 'wptexturize');

4
wp-links-opml.php
View File

@ -43,12 +43,12 @@ FROM $wpdb->links
<?php
} // end if not first time
?>
<outline type="category" title="<?php echo(htmlspecialchars(stripslashes($result->cat_name))) ?>">
<outline type="category" title="<?php echo wp_specialchars($result->cat_name); ?>">
<?php
$prev_cat_id = $result->link_category;
} // end if new category
?>
<outline title="<?php echo(htmlspecialchars(stripslashes($result->link_name))) ?>" type="link" xmlUrl="<?php echo $result->link_rss; ?>" htmlUrl="<?php echo($result->link_url) ?>"/>
<outline title="<?php echo wp_specialchars($result->link_name); ?>" type="link" xmlUrl="<?php echo $result->link_rss; ?>" htmlUrl="<?php echo($result->link_url) ?>"/>
<?php
} // end foreach
} // end if

4
wp-trackback.php
View File

@ -82,11 +82,11 @@ if ( !empty($tb_url) && !empty($title) && !empty($tb_url) ) {
if ('closed' == $pingstatus)
trackback_response(1, 'Sorry, trackbacks are closed for this item.');
$title = strip_tags( htmlspecialchars( $title ) );
$title = wp_specialchars( strip_tags( $title ) );
$title = (strlen($title) > 250) ? substr($title, 0, 250) . '...' : $title;
$excerpt = strip_tags($excerpt);
$excerpt = (strlen($excerpt) > 255) ? substr($excerpt, 0, 252) . '...' : $excerpt;
$blog_name = htmlspecialchars($blog_name);
$blog_name = wp_specialchars($blog_name);
$blog_name = (strlen($blog_name) > 250) ? substr($blog_name, 0, 250) . '...' : $blog_name;
$comment_post_ID = $tb_id;

6
xmlrpc.php
View File

@ -763,8 +763,8 @@ class wp_xmlrpc_server extends IXR_Server {
$struct['categoryId'] = $cat['cat_ID'];
$struct['description'] = $cat['cat_name'];
$struct['categoryName'] = $cat['cat_name'];
$struct['htmlUrl'] = htmlspecialchars(get_category_link(false, $cat['cat_ID'], $cat['cat_name']));
$struct['rssUrl'] = htmlspecialchars(get_category_rss_link(false, $cat['cat_ID'], $cat['cat_name']));
$struct['htmlUrl'] = wp_specialchars(get_category_link(false, $cat['cat_ID'], $cat['cat_name']));
$struct['rssUrl'] = wp_specialchars(get_category_rss_link(false, $cat['cat_ID'], $cat['cat_name']));
$categories_struct[] = $struct;
}
@ -1213,7 +1213,7 @@ class wp_xmlrpc_server extends IXR_Server {
$title = (!strlen($matchtitle[1])) ? $pagelinkedfrom : $matchtitle[1];
$original_context = strip_tags($context);
$context = '[...] ';
$context = htmlspecialchars($original_context);
$context = wp_specialchars($original_context);
$context .= ' [...]';
$original_pagelinkedfrom = $pagelinkedfrom;
$pagelinkedfrom = addslashes($pagelinkedfrom);