Changeset 3765

Show
Ignore:
Timestamp:
05/06/06 04:41:21 (3 years ago)
Author:
ryan
Message:

Better nonces for inline uploading. Props mdawaffe. #2678

Files:

Legend:

Unmodified
Added
Removed
Modified
Copied
Moved
  • trunk/wp-admin/edit-comments.js

    r3736 r3765  
    44    else m.innerHTML = parseInt(m.innerHTML,10) - 1; 
    55}}); 
     6addLoadEvent(function() {theList.dimComplete = function(what,id,dimClass) { 
     7    var m = document.getElementById('awaitmod'); 
     8    if ( document.getElementById(what + '-' + id).className.match(dimClass) ) m.innerHTML = parseInt(m.innerHTML,10) + 1; 
     9    else m.innerHTML = parseInt(m.innerHTML,10) - 1; 
     10}}); 
  • trunk/wp-admin/inline-uploading.php

    r3759 r3765  
    22 
    33require_once('admin.php'); 
    4  
    5 check_admin_referer('inlineuploading'); 
    64 
    75header('Content-Type: text/html; charset=' . get_option('blog_charset')); 
     
    3735case 'delete': 
    3836 
     37check_admin_referer('inlineuploading'); 
     38 
    3939if ( !current_user_can('edit_post', (int) $attachment) ) 
    4040    die(__('You are not allowed to delete this attachment.').' <a href="'.basename(__FILE__)."?post=$post&amp;all=$all&amp;action=upload\">".__('Go back').'</a>'); 
     
    4242wp_delete_attachment($attachment); 
    4343 
    44 header("Location: ". wp_nonce_url(basename(__FILE__)."?post=$post&all=$all&action=view&start=$start", 'inlineuploading')); 
     44header("Location: " . basename(__FILE__) ."?post=$post&all=$all&action=view&start=$start"); 
    4545die; 
    4646 
    4747case 'save': 
     48 
     49check_admin_referer('inlineuploading'); 
    4850 
    4951$overrides = array('action'=>'save'); 
     
    101103} 
    102104 
    103 header("Location: ". wp_nonce_url(basename(__FILE__)."?post=$post&all=$all&action=view&start=0", 'inlineuploading')); 
     105header("Location: " . basename(__FILE__) . "?post=$post&all=$all&action=view&start=0"); 
    104106die(); 
    105107 
     
    140142 
    141143if ( count($attachments) == 0 ) { 
    142     header("Location: ". wp_nonce_url(basename(__FILE__)."?post=$post&action=upload", 'inlineuploading') ); 
     144    header("Location: " . basename(__FILE__) ."?post=$post&action=upload" ); 
    143145    die; 
    144146} elseif ( count($attachments) > $num ) { 
     
    214216"; 
    215217        $send_delete_cancel = "<a onclick=\"sendToEditor({$ID});return false;\" href=\"javascript:void()\">$__send_to_editor</a> 
    216 <a onclick=\"return confirm('$__confirmdelete')\" href=\"".basename(__FILE__)."?action=delete&amp;attachment={$ID}&amp;all=$all&amp;start=$start&amp;post=$post\">$__delete</a> 
     218<a onclick=\"return confirm('$__confirmdelete')\" href=\"" . wp_nonce_url( basename(__FILE__) . "?action=delete&amp;attachment={$ID}&amp;all=$all&amp;start=$start&amp;post=$post", inlineuploading) . "\">$__delete</a> 
    217219        <a onclick=\"popup.style.display='none';return false;\" href=\"javascript:void()\">$__close</a> 
    218220"; 
     
    642644<body> 
    643645<ul id="upload-menu"> 
    644 <li<?php echo $current_1; ?>><a href="<?php echo basename(__FILE__); ?>?action=upload&amp;post=<?php echo $post; ?>&amp;all=<?php echo $all; ?>&amp;start=<?php echo $start; ?>"><?php _e('Upload'); ?></a></li> 
     646<li<?php echo $current_1; ?>><a href="<?php echo basename(__FILE__) . "?action=upload&amp;post=$post&amp;all=$all&amp;start=$start"; ?>"><?php _e('Upload'); ?></a></li> 
    645647<?php if ( $attachments = $wpdb->get_results("SELECT ID FROM $wpdb->posts WHERE post_parent = '$post'") ) { ?> 
    646 <li<?php echo $current_2; ?>><a href="<?php echo basename(__FILE__); ?>?action=view&amp;post=<?php echo $post; ?>&amp;all=false"><?php _e('Browse'); ?></a></li> 
     648<li<?php echo $current_2; ?>><a href="<?php echo basename(__FILE__) . "?action=view&amp;post=$post&amp;all=false"; ?>"><?php _e('Browse'); ?></a></li> 
    647649<?php } ?> 
    648650<?php if ($wpdb->get_var("SELECT count(ID) FROM $wpdb->posts WHERE post_type = 'attachment'")) { ?> 
    649 <li<?php echo $current_3; ?>><a href="<?php echo basename(__FILE__); ?>?action=view&amp;post=<?php echo $post; ?>&amp;all=true"><?php _e('Browse All'); ?></a></li> 
     651<li<?php echo $current_3; ?>><a href="<?php echo basename(__FILE__) . "?action=view&amp;post=$post&amp;all=true"; ?>"><?php _e('Browse All'); ?></a></li> 
    650652<?php } ?> 
    651653<li> </li> 
    652654<?php if ( $action == 'view' ) { ?> 
    653655<?php if ( false !== $back ) : ?> 
    654 <li class="spacer"><a href="<?php echo basename(__FILE__); ?>?action=<?php echo $action; ?>&amp;post=<?php echo $post; ?>&amp;all=<?php echo $all; ?>&amp;start=0" title="<?php _e('First'); ?>">|&laquo;</a></li> 
    655 <li><a href="<?php echo basename(__FILE__); ?>?action=<?php echo $action; ?>&amp;post=<?php echo $post; ?>&amp;all=<?php echo $all; ?>&amp;start=<?php echo $back; ?>"">&laquo; <?php _e('Back'); ?></a></li> 
     656<li class="spacer"><a href="<?php echo basename(__FILE__) . "?action=$action&amp;post=$post&amp;all=$all&amp;start=0"; ?>" title="<?php _e('First'); ?>">|&laquo;</a></li> 
     657<li><a href="<?php echo basename(__FILE__) . "?action=$action&amp;post=$post&amp;all=$all&amp;start=$back"; ?>">&laquo; <?php _e('Back'); ?></a></li> 
    656658<?php else : ?> 
    657659<li class="inactive spacer">|&laquo;</li> 
     
    659661<?php endif; ?> 
    660662<?php if ( false !== $next ) : ?> 
    661 <li><a href="<?php echo basename(__FILE__); ?>?action=<?php echo $action; ?>&amp;post=<?php echo $post; ?>&amp;all=<?php echo $all; ?>&amp;start=<?php echo $next; ?>"><?php _e('Next &raquo;'); ?></a></li> 
    662 <li><a href="<?php echo basename(__FILE__); ?>?action=<?php echo $action; ?>&amp;post=<?php echo $post; ?>&amp;all=<?php echo $all; ?>&amp;last=true" title="<?php _e('Last'); ?>">&raquo;|</a></li> 
     663<li><a href="<?php echo basename(__FILE__) . "?action=$action&amp;post=$post&amp;all=$all&amp;start=$next"; ?>"><?php _e('Next &raquo;'); ?></a></li> 
     664<li><a href="<?php echo basename(__FILE__) . "?action=$action&amp;post=$post&amp;all=$all&amp;last=true"; ?>" title="<?php _e('Last'); ?>">&raquo;|</a></li> 
    663665<?php else : ?> 
    664666<li class="inactive"><?php _e('Next &raquo;'); ?></li> 
     
    698700<input type="hidden" name="all" value="<?php echo $all; ?>" /> 
    699701<input type="hidden" name="start" value="<?php echo $start; ?>" /> 
     702<?php wp_nonce_field( 'inlineuploading' ); ?> 
    700703<div id="submit"> 
    701704<input type="submit" value="<?php _e('Upload'); ?>" />