WordPress/wp-admin/categories.php
markjaquith 4d2d655490 Covering our XSS bases
git-svn-id: http://svn.automattic.com/wordpress/trunk@9233 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2008-10-17 20:06:22 +00:00

251 lines
6.5 KiB
PHP

<?php
/**
* Categories Management Panel
*
* @package WordPress
* @subpackage Administration
*/
/** Load WordPress Bootstrap */
require_once('admin.php');
$title = __('Categories');
wp_reset_vars( array('action', 'cat') );
if ( isset( $_GET['action'] ) && isset($_GET['delete']) && ( 'delete' == $_GET['action'] || 'delete' == $_GET['action2'] ) )
$action = 'bulk-delete';
switch($action) {
case 'addcat':
check_admin_referer('add-category');
if ( !current_user_can('manage_categories') )
wp_die(__('Cheatin&#8217; uh?'));
if( wp_insert_category($_POST ) ) {
wp_redirect('categories.php?message=1#addcat');
} else {
wp_redirect('categories.php?message=4#addcat');
}
exit;
break;
case 'delete':
$cat_ID = (int) $_GET['cat_ID'];
check_admin_referer('delete-category_' . $cat_ID);
if ( !current_user_can('manage_categories') )
wp_die(__('Cheatin&#8217; uh?'));
$cat_name = get_catname($cat_ID);
// Don't delete the default cats.
if ( $cat_ID == get_option('default_category') )
wp_die(sprintf(__("Can&#8217;t delete the <strong>%s</strong> category: this is the default one"), $cat_name));
wp_delete_category($cat_ID);
wp_redirect('categories.php?message=2');
exit;
break;
case 'bulk-delete':
check_admin_referer('bulk-categories');
if ( !current_user_can('manage_categories') )
wp_die( __('You are not allowed to delete categories.') );
foreach ( (array) $_GET['delete'] as $cat_ID ) {
$cat_name = get_catname($cat_ID);
// Don't delete the default cats.
if ( $cat_ID == get_option('default_category') )
wp_die(sprintf(__("Can&#8217;t delete the <strong>%s</strong> category: this is the default one"), $cat_name));
wp_delete_category($cat_ID);
}
$sendback = wp_get_referer();
$sendback = preg_replace('|[^a-z0-9-~+_.?#=&;,/:]|i', '', $sendback);
wp_redirect($sendback);
exit();
break;
case 'edit':
$title = __('Edit Category');
require_once ('admin-header.php');
$cat_ID = (int) $_GET['cat_ID'];
$category = get_category_to_edit($cat_ID);
include('edit-category-form.php');
break;
case 'editedcat':
$cat_ID = (int) $_POST['cat_ID'];
check_admin_referer('update-category_' . $cat_ID);
if ( !current_user_can('manage_categories') )
wp_die(__('Cheatin&#8217; uh?'));
if ( wp_update_category($_POST) )
wp_redirect('categories.php?message=3');
else
wp_redirect('categories.php?message=5');
exit;
break;
default:
if ( isset($_GET['_wp_http_referer']) && ! empty($_GET['_wp_http_referer']) ) {
wp_redirect( remove_query_arg( array('_wp_http_referer', '_wpnonce'), stripslashes($_SERVER['REQUEST_URI']) ) );
exit;
}
wp_enqueue_script( 'admin-categories' );
wp_enqueue_script('admin-forms');
if ( current_user_can('manage_categories') )
wp_enqueue_script('inline-edit-tax');
require_once ('admin-header.php');
$messages[1] = __('Category added.');
$messages[2] = __('Category deleted.');
$messages[3] = __('Category updated.');
$messages[4] = __('Category not added.');
$messages[5] = __('Category not updated.');
?>
<div id="edit-settings-wrap" class="hidden">
<h5><?php _e('Show on screen') ?></h5>
<form id="adv-settings" action="" method="get">
<div class="metabox-prefs">
<?php manage_columns_prefs('category') ?>
<?php wp_nonce_field( 'hiddencolumns', 'hiddencolumnsnonce', false ); ?>
<br class="clear" />
</div></form>
</div>
<?php
if ( isset($_GET['message']) && ( $msg = (int) $_GET['message'] ) ) : ?>
<div id="message" class="updated fade"><p><?php echo $messages[$msg]; ?></p></div>
<?php $_SERVER['REQUEST_URI'] = remove_query_arg(array('message'), $_SERVER['REQUEST_URI']);
endif; ?>
<div class="wrap">
<h2><?php echo wp_specialchars( $title ); ?></h2>
<ul class="subsubsub"><li class="current"><a class="current"><br /></a></li></ul>
<form class="search-form" action="" method="get">
<p class="search-box">
<label class="hidden" for="post-search-input"><?php _e('Search Categories'); ?>:</label>
<input type="text" class="search-input" id="post-search-input" name="s" value="<?php _admin_search_query(); ?>" />
<input type="submit" value="<?php _e( 'Search Categories' ); ?>" class="button" />
</p>
</form>
<br class="clear" />
<form id="posts-filter" action="" method="get">
<div class="tablenav">
<?php
$pagenum = isset( $_GET['pagenum'] ) ? absint( $_GET['pagenum'] ) : 0;
if ( empty($pagenum) )
$pagenum = 1;
if( ! isset( $catsperpage ) || $catsperpage < 0 )
$catsperpage = 20;
$page_links = paginate_links( array(
'base' => add_query_arg( 'pagenum', '%#%' ),
'format' => '',
'total' => ceil(wp_count_terms('category') / $catsperpage),
'current' => $pagenum
));
if ( $page_links )
echo "<div class='tablenav-pages'>$page_links</div>";
?>
<div class="alignleft">
<select name="action">
<option value="" selected="selected"><?php _e('Actions'); ?></option>
<option value="delete"><?php _e('Delete'); ?></option>
</select>
<input type="submit" value="<?php _e('Apply'); ?>" name="doaction" id="doaction" class="button-secondary action" />
<?php wp_nonce_field('bulk-categories'); ?>
</div>
<br class="clear" />
</div>
<div class="clear"></div>
<table class="widefat">
<thead>
<tr>
<?php print_column_headers('category'); ?>
</tr>
</thead>
<tfoot>
<tr>
<?php print_column_headers('category', false); ?>
</tr>
</tfoot>
<tbody id="the-list" class="list:cat">
<?php
cat_rows(0, 0, 0, $pagenum, $catsperpage);
?>
</tbody>
</table>
<div class="tablenav">
<?php
if ( $page_links )
echo "<div class='tablenav-pages'>$page_links</div>";
?>
<div class="alignleft">
<select name="action2">
<option value="" selected="selected"><?php _e('Actions'); ?></option>
<option value="delete"><?php _e('Delete'); ?></option>
</select>
<input type="submit" value="<?php _e('Apply'); ?>" name="doaction2" id="doaction2" class="button-secondary action" />
<?php wp_nonce_field('bulk-categories'); ?>
</div>
<br class="clear" />
</div>
<br class="clear" />
</form>
</div>
<?php if ( current_user_can('manage_categories') ) : ?>
<div class="wrap">
<p><?php printf(__('<strong>Note:</strong><br />Deleting a category does not delete the posts in that category. Instead, posts that were only assigned to the deleted category are set to the category <strong>%s</strong>.'), apply_filters('the_category', get_catname(get_option('default_category')))) ?></p>
<p><?php printf(__('Categories can be selectively converted to tags using the <a href="%s">category to tag converter</a>.'), 'admin.php?import=wp-cat2tag') ?></p>
</div>
<?php include('edit-category-form.php'); ?>
<?php inline_edit_term_row('category'); ?>
<?php endif; ?>
<?php
break;
}
include('admin-footer.php');
?>