root/branches/2.1/wp-admin/edit-page-form.php

Revision 5057, 7.4 kB (checked in by markjaquith, 2 years ago)

use clean_url() instead of attribute_escape() when dealing with src/href to protect against XSS. props xknown. fixes #3986 for 2.1.

  • Property svn:eol-style set to native
  • Property svn:keywords set to Author Date Id Revision
Line 
1
2 <div class="wrap">
3 <h2 id="write-post"><?php _e('Write Page'); ?></h2>
4 <?php
5 if (0 == $post_ID) {
6     $form_action = 'post';
7     $nonce_action = 'add-page';
8     $temp_ID = -1 * time(); // don't change this formula without looking at wp_write_post()
9     $form_extra = "<input type='hidden' id='post_ID' name='temp_ID' value='$temp_ID' />";
10 } else {
11     $form_action = 'editpost';
12     $nonce_action = 'update-page_' . $post_ID;
13     $form_extra = "<input type='hidden' id='post_ID' name='post_ID' value='$post_ID' />";
14 }
15
16 $sendto = clean_url(stripslashes(wp_get_referer()));
17
18 if ( 0 != $post_ID && $sendto == get_permalink($post_ID) )
19     $sendto = 'redo';
20 ?>
21
22 <form name="post" action="page.php" method="post" id="post">
23
24 <?php
25 wp_nonce_field($nonce_action);
26
27 if (isset($mode) && 'bookmarklet' == $mode) {
28     echo '<input type="hidden" name="mode" value="bookmarklet" />';
29 }
30 ?>
31 <input type="hidden" name="user_ID" value="<?php echo $user_ID ?>" />
32 <input type="hidden" id="hiddenaction" name="action" value='<?php echo $form_action ?>' />
33 <input type="hidden" id="originalaction" name="originalaction" value="<?php echo $form_action ?>" />
34 <?php echo $form_extra ?>
35 <input type="hidden" id="post_type" name="post_type" value="page" />
36
37 <script type="text/javascript">
38 // <![CDATA[
39 function focusit() { // focus on first input field
40     document.post.title.focus();
41 }
42 addLoadEvent(focusit);
43 // ]]>
44 </script>
45 <div id="poststuff">
46
47 <div id="moremeta">
48 <div id="grabit" class="dbx-group">
49 <fieldset id="commentstatusdiv" class="dbx-box">
50 <h3 class="dbx-handle"><?php _e('Discussion') ?></h3>
51 <div class="dbx-content">
52 <input name="advanced_view" type="hidden" value="1" />
53 <label for="comment_status" class="selectit">
54 <input name="comment_status" type="checkbox" id="comment_status" value="open" <?php checked($post->comment_status, 'open'); ?> />
55 <?php _e('Allow Comments') ?></label>
56 <label for="ping_status" class="selectit"><input name="ping_status" type="checkbox" id="ping_status" value="open" <?php checked($post->ping_status, 'open'); ?> /> <?php _e('Allow Pings') ?></label>
57 </div>
58 </fieldset>
59
60 <fieldset class="dbx-box">
61 <h3 class="dbx-handle"><?php _e('Page Status') ?></h3>
62 <div class="dbx-content"><?php if ( current_user_can('publish_pages') ) : ?>
63 <label for="post_status_publish" class="selectit"><input id="post_status_publish" name="post_status" type="radio" value="publish" <?php checked($post->post_status, 'publish'); checked($post->post_status, 'future'); ?> /> <?php _e('Published') ?></label>
64 <?php endif; ?>
65       <label for="post_status_draft" class="selectit"><input id="post_status_draft" name="post_status" type="radio" value="draft" <?php checked($post->post_status, 'draft'); ?> /> <?php _e('Draft') ?></label>
66       <label for="post_status_private" class="selectit"><input id="post_status_private" name="post_status" type="radio" value="private" <?php checked($post->post_status, 'private'); ?> /> <?php _e('Private') ?></label></div>
67 </fieldset>
68
69 <fieldset id="passworddiv" class="dbx-box">
70 <h3 class="dbx-handle"><?php _e('Page Password') ?></h3>
71 <div class="dbx-content"><input name="post_password" type="text" size="13" id="post_password" value="<?php echo $post->post_password ?>" /></div>
72 </fieldset>
73
74 <fieldset id="pageparent" class="dbx-box">
75 <h3 class="dbx-handle"><?php _e('Page Parent') ?></h3>
76 <div class="dbx-content"><p><select name="parent_id">
77 <option value='0'><?php _e('Main Page (no parent)'); ?></option>
78 <?php parent_dropdown($post->post_parent); ?>
79 </select></p>
80 </div>
81 </fieldset>
82
83 <?php if ( 0 != count( get_page_templates() ) ) { ?>
84 <fieldset id="pagetemplate" class="dbx-box">
85 <h3 class="dbx-handle"><?php _e('Page Template') ?></h3>
86 <div class="dbx-content"><p><select name="page_template">
87         <option value='default'><?php _e('Default Template'); ?></option>
88         <?php page_template_dropdown($post->page_template); ?>
89         </select></p>
90 </div>
91 </fieldset>
92 <?php } ?>
93
94 <fieldset id="slugdiv" class="dbx-box">
95 <h3 class="dbx-handle"><?php _e('Page Slug') ?></h3>
96 <div class="dbx-content"><input name="post_name" type="text" size="13" id="post_name" value="<?php echo $post->post_name ?>" /></div>
97 </fieldset>
98
99 <?php if ( $authors = get_editable_authors( $current_user->id ) ) : // TODO: ROLE SYSTEM ?>
100 <fieldset id="authordiv" class="dbx-box">
101 <h3 class="dbx-handle"><?php _e('Page Author'); ?>:</h3>
102 <div class="dbx-content">
103 <select name="post_author_override" id="post_author_override">
104 <?php
105 foreach ($authors as $o) :
106 $o = get_userdata( $o->ID );
107 if ( $post->post_author == $o->ID || ( empty($post_ID) && $user_ID == $o->ID ) ) $selected = 'selected="selected"';
108 else $selected = '';
109 echo "<option value='$o->ID' $selected>$o->display_name</option>";
110 endforeach;
111 ?>
112 </select>
113 </div>
114 </fieldset>
115 <?php endif; ?>
116
117 <fieldset id="pageorder" class="dbx-box">
118 <h3 class="dbx-handle"><?php _e('Page Order') ?></h3>
119 <div class="dbx-content"><p><input name="menu_order" type="text" size="4" id="menu_order" value="<?php echo $post->menu_order ?>" /></p></div>
120 </fieldset>
121
122 <?php do_action('dbx_page_sidebar'); ?>
123
124 </div>
125 </div>
126
127 <fieldset id="titlediv">
128   <legend><?php _e('Page Title') ?></legend>
129   <div><input type="text" name="post_title" size="30" tabindex="1" value="<?php echo $post->post_title; ?>" id="title" /></div>
130 </fieldset>
131
132
133 <fieldset id="<?php echo user_can_richedit() ? 'postdivrich' : 'postdiv'; ?>">
134     <legend><?php _e('Page Content') ?></legend>
135     <?php the_editor($post->post_content); ?>
136 </fieldset>
137
138 <p class="submit">
139 <span id="autosave"></span>
140 <input name="save" type="submit" id="save" tabindex="3" value="<?php _e('Save and Continue Editing'); ?>" />
141 <input type="submit" name="submit" value="<?php _e('Save') ?>" style="font-weight: bold;" tabindex="4" />
142 <?php
143 if ('publish' != $post->post_status || 0 == $post_ID):
144 ?>
145 <?php if ( current_user_can('publish_pages') ) : ?>
146     <input name="publish" type="submit" id="publish" tabindex="5" accesskey="p" value="<?php _e('Publish') ?>" />
147 <?php endif; endif;?>
148 <input name="referredby" type="hidden" id="referredby" value="<?php echo $sendto; ?>" />
149 </p>
150
151 <?php do_action('edit_page_form'); ?>
152
153 <?php
154 if (current_user_can('upload_files')) {
155     $uploading_iframe_ID = (0 == $post_ID ? $temp_ID : $post_ID);
156     $uploading_iframe_src = wp_nonce_url("upload.php?style=inline&amp;tab=upload&amp;post_id=$uploading_iframe_ID", 'inlineuploading');
157     $uploading_iframe_src = apply_filters('uploading_iframe_src', $uploading_iframe_src);
158     if ( false != $uploading_iframe_src )
159         echo '<iframe id="uploading" frameborder="0" src="' . $uploading_iframe_src . '">' . __('This feature requires iframe support.') . '</iframe>';
160 }
161 ?>
162
163 <div id="advancedstuff" class="dbx-group">
164
165 <fieldset id="postcustom" class="dbx-box">
166 <h3 class="dbx-handle"><?php _e('Custom Fields') ?></h3>
167 <div id="postcustomstuff" class="dbx-content">
168 <table cellpadding="3">
169 <?php
170 $metadata = has_meta($post_ID);
171 list_meta($metadata);
172 ?>
173
174 </table>
175 <?php
176     meta_form();
177 ?>
178 </div>
179 <div id="ajax-response"></div>
180 </fieldset>
181
182 <?php do_action('dbx_page_advanced'); ?>
183
184 </div>
185
186 <?php if ('edit' == $action) :
187     $delete_nonce = wp_create_nonce( 'delete-page_' . $post_ID );
188     if ( current_user_can('delete_page', $post->ID) ) ?>
189         <input name="deletepost" class="button delete" type="submit" id="deletepost" tabindex="10" value="<?php _e('Delete this page') ?>" <?php echo "onclick=\"if ( confirm('" . js_escape(sprintf(__("You are about to delete this page '%s'\n  'Cancel' to stop, 'OK' to delete."), $post->post_title )) . "') ) { document.forms.post._wpnonce.value = '$delete_nonce'; return true;}return false;\""; ?> />
190 <?php endif; ?>
191 </div>
192
193 </form>
194
195 </div>
196
Note: See TracBrowser for help on using the browser.