Changeset 4112

Timestamp:

08/24/06 22:33:16 (2 years ago)

Author:

ryan

Message:

Make those chars feel special.

Files:

• trunk/wp-admin/admin-db.php (modified) (1 diff)
• trunk/wp-admin/admin-functions.php (modified) (5 diffs)
• trunk/wp-admin/edit-form-advanced.php (modified) (1 diff)
• trunk/wp-admin/options-misc.php (modified) (1 diff)
• trunk/wp-admin/options-permalink.php (modified) (2 diffs)
• trunk/wp-admin/options.php (modified) (2 diffs)
• trunk/wp-admin/profile.php (modified) (1 diff)
• trunk/wp-admin/user-edit.php (modified) (1 diff)
• trunk/wp-admin/users.php (modified) (3 diffs)
• trunk/wp-includes/default-filters.php (modified) (2 diffs)
• trunk/wp-includes/functions.php (modified) (1 diff)
• trunk/wp-includes/link-template.php (modified) (1 diff)
• trunk/wp-includes/query.php (modified) (1 diff)

trunk/wp-admin/admin-db.php

@@ -294 +294 @@
-
-    $update = false;
+
-    if ( !empty($link_id) )
-        $update = true;
-
+    if( trim( $link_name ) == '' )
+        return 0;
+    $link_name = apply_filters('pre_link_name', $link_name);
+
+    if( trim( $link_url ) == '' )
+        return 0;
+    $link_url = apply_filters('pre_link_url', $link_url);
+
-    if ( empty($link_rating) )
-        $link_rating = 0;
+    else
+        $link_rating = (int) $link_rating;
+
+    if ( empty($link_image) )
+        $link_image = '';
+    $link_image = apply_filters('pre_link_image', $link_image);
-
-    if ( empty($link_target) )
-        $link_target = '';
+    $link_target = apply_filters('pre_link_target', $link_target);
-
-    if ( empty($link_visible) )
-        $link_visible = 'Y';
+    $link_visibile = preg_replace('/[^YNyn]/', '', $link_visible);
-
-    if ( empty($link_owner) )
-        $link_owner = $current_user->id;
+    else
+        $link_owner = (int) $link_owner;
-
-    if ( empty($link_notes) )
-        $link_notes = '';
+    $link_notes = apply_filters('pre_link_notes', $link_notes);
+
+    if ( empty($link_description) )
+        $link_description = '';
+    $link_description = apply_filters('pre_link_description', $link_description);
+
+    if ( empty($link_rss) )
+        $link_rss = '';
+    $link_rss = apply_filters('pre_link_rss', $link_rss);
+
+    if ( empty($link_rel) )
+        $link_rel = '';
+    $link_rel = apply_filters('pre_link_rel', $link_rel);
-
-    // Make sure we set a valid category

trunk/wp-admin/admin-functions.php

@@ -302 +302 @@
-    $post->post_title = apply_filters('title_edit_pre', $post->post_title);
-
+    $post->post_password = format_to_edit($post->post_password);
+
-    if ($post->post_type == 'page')
-        $post->page_template = get_post_meta($id, '_wp_page_template', true);
@@ -381 +383 @@
-}
-
+
+function get_user_to_edit($user_id) {
+    $user = new WP_User($user_id);
+    $user->user_login = wp_specialchars($user->user_login, 1);
+    $user->user_email = wp_specialchars($user->user_email, 1);
+    $user->user_url = wp_specialchars($user->user_url, 1);
+    $user->first_name = wp_specialchars($user->first_name, 1);
+    $user->last_name = wp_specialchars($user->last_name, 1);
+    $user->display_name = wp_specialchars($user->display_name, 1);
+    $user->nickname = wp_specialchars($user->nickname, 1);
+    $user->aim = wp_specialchars($user->aim, 1);
+    $user->yim = wp_specialchars($user->yim, 1);
+    $user->jabber = wp_specialchars($user->jabber, 1);
+    $user->description = wp_specialchars($user->description);
+
+    return $user;
+}
-
-// Creates a new user from the "Users" form using $_POST information.
@@ -510 +529 @@
-    $link->link_url = wp_specialchars($link->link_url, 1);
-    $link->link_name = wp_specialchars($link->link_name, 1);
-
+
+
-    $link->link_notes = wp_specialchars($link->link_notes);
-
+
+
-    $link->post_category = $link->link_category;
-
@@ -960 +981 @@
-        if ('_' == $entry['meta_key'] { 0 })
-            $style .= ' hidden';
-addslashes(wp_specialchars( $entry['meta_key'], 'double' )
+js_escape($entry['meta_key']
-        $entry['meta_key'] = wp_specialchars( $entry['meta_key'], true );
-        $entry['meta_value'] = wp_specialchars( $entry['meta_value'], true );
@@ -1012 +1033 @@
-
-    foreach ($keys as $key) {
+        $key = wp_specialchars($key, 1);
-        echo "\n\t<option value='$key'>$key</option>";
-    }

trunk/wp-admin/edit-form-advanced.php

@@ -40 +40 @@
-    $already_pinged = explode("\n", trim($post->pinged));
-    foreach ($already_pinged as $pinged_url) {
-$pinged_url
+" . wp_specialchars($pinged_url) . "
-    }
-    $pings .= '</ul>';

trunk/wp-admin/options-misc.php

@@ -18 +18 @@
-<tr valign="top">
-<th scope="row"><?php _e('Store uploads in this folder'); ?>:</th>
-str_replace(ABSPATH, '', get_settings('upload_path')
+wp_specialchars(str_replace(ABSPATH, '', get_settings('upload_path')), 1
-<br />
-<?php _e('Default is <code>wp-content/uploads</code>'); ?>

trunk/wp-admin/options-permalink.php

@@ -149 +149 @@
-<br />
-</p>
-$permalink_structure
+wp_specialchars($permalink_structure, 1)
-
-<h3><?php _e('Optional'); ?></h3>
@@ -158 +158 @@
-<?php endif; ?>
-    <p> 
-$category_base
+wp_specialchars($category_base, 1)
-     </p> 
-    <p class="submit"> 

trunk/wp-admin/options.php

@@ -10 +10 @@
-if ( !current_user_can('manage_options') )
-    wp_die(__('Cheatin’ uh?'));
+
+function sanitize_option($option, $value) {
+
+    switch ($option) {
+        case 'admin_email':
+            $value = sanitize_email($value);
+            break;
+
+        case 'default_post_edit_rows':
+        case 'mailserver_port':
+        case 'comment_max_links':
+            $value = abs((int) $value);
+            break;
+
+        case 'posts_per_page':
+        case 'posts_per_rss':
+            $value = (int) $value;
+            if ( empty($value) ) $value = 1;
+            if ( $value < -1 ) $value = abs($value);
+            break;
+
+        case 'default_ping_status':
+        case 'default_comment_status':
+            // Options that if not there have 0 value but need to be something like "closed"
+            if ( $value == '0' || $value == '')
+                $value = 'closed';
+            break;
+
+        case 'blogdescription':
+        case 'blogname':
+            if (current_user_can('unfiltered_html') == false)
+                $value = wp_filter_post_kses( $value );
+            break;
+
+        case 'blog_charset':
+            $value = preg_replace('/[^a-zA-Z0-9_-]/', '', $value);
+            break;
+
+        case 'date_format':
+        case 'time_format':
+        case 'mailserver_url':
+        case 'mailserver_login':
+        case 'mailserver_pass':
+        case 'ping_sites':
+        case 'upload_path':
+            $value = strip_tags($value);
+            $value = wp_filter_kses($value);
+            break;
+
+        case 'gmt_offset':
+            $value = preg_replace('/[^0-9:.-]/', '', $value);
+            break;
+
+        case 'siteurl':
+        case 'home':
+            $value = clean_url($value);
+            break;
+    }
+
+    return $value;  
+}
-
-switch($action) {
@@ -30 +91 @@
-    $old_home = get_settings('home');
-
-    // HACK
-    // Options that if not there have 0 value but need to be something like "closed"
-    $nonbools = array('default_ping_status', 'default_comment_status');
-    if ($options) {
-        foreach ($options as $option) {
-            $option = trim($option);
-            $value = trim(stripslashes($_POST[$option]));
-
-
-
-
-
-
+
-
-            if (update_option($option, $value) ) {

trunk/wp-admin/profile.php

@@ -9 +9 @@
-    $parent_file = 'profile.php';
-include_once('admin-header.php');
-new WP_User
+get_user_to_edit
-
-$bookmarklet_height= 440;

trunk/wp-admin/user-edit.php

@@ -41 +41 @@
-include ('admin-header.php');
-
-new WP_User
+get_user_to_edit
-
-if ( !current_user_can('edit_user', $user_id) )

trunk/wp-admin/users.php

@@ -98 +98 @@
-
-    function get_results() {
-
+(array) 
-    }
-
@@ -336 +336 @@
-
-    <?php if ( $wp_user_search->is_search() ) : ?>
-$wp_user_search->search_term
+wp_specialchars($wp_user_search->search_term)
-    <?php else : ?>
-        <h2><?php _e('User List by Role'); ?></h2>
@@ -342 +342 @@
-
-    <form action="" method="get" name="search" id="search">
-
+, 1
-    </form>
-

trunk/wp-includes/default-filters.php

@@ -55 +55 @@
-add_filter('pre_category_name', 'wp_specialchars', 30);
-add_filter('pre_category_description', 'wp_filter_kses');
+
+//Links
+add_filter('pre_link_name', 'strip_tags');
+add_filter('pre_link_name', 'trim');
+add_filter('pre_link_name', 'wp_filter_kses');
+add_filter('pre_link_name', 'wp_specialchars', 30);
+add_filter('pre_link_description', 'wp_filter_kses');
+add_filter('pre_link_notes', 'wp_filter_kses');
+add_filter('pre_link_url', 'strip_tags');
+add_filter('pre_link_url', 'trim');
+add_filter('pre_link_url', 'clean_url');
+add_filter('pre_link_image', 'strip_tags');
+add_filter('pre_link_image', 'trim');
+add_filter('pre_link_image', 'clean_url');
+add_filter('pre_link_rss', 'strip_tags');
+add_filter('pre_link_rss', 'trim');
+add_filter('pre_link_rss', 'clean_url');
+add_filter('pre_link_target', 'strip_tags');
+add_filter('pre_link_target', 'trim');
+add_filter('pre_link_target', 'wp_filter_kses');
+add_filter('pre_link_target', 'wp_specialchars', 30);
+add_filter('pre_link_rel', 'strip_tags');
+add_filter('pre_link_rel', 'trim');
+add_filter('pre_link_rel', 'wp_filter_kses');
+add_filter('pre_link_rel', 'wp_specialchars', 30);
-
-// Users
@@ -116 +141 @@
-// Misc filters
-add_filter('option_ping_sites', 'privacy_ping_filter');
+add_filter('option_blog_charset', 'wp_specialchars');
-
-// Actions

trunk/wp-includes/functions.php

@@ -200 +200 @@
-
-function form_option($option) {
-htmlspecialchars( get_option($option), ENT_QUOTES
+wp_specialchars( get_option($option), 1
-}
-

trunk/wp-includes/link-template.php

@@ -477 +477 @@
-    
-    if (isset($max_num_pages)) return $max_num_pages;
-
+
+
+
-    if ( 'posts' == get_query_var('what_to_show') ) {
-        preg_match('#FROM\s(.*)\sORDER BY#siU', $wp_query->request, $matches);
-        $fromwhere = $matches[1];
-        $numposts = $wpdb->get_var("SELECT COUNT(DISTINCT ID) FROM $fromwhere");
-get_option('posts_per_page')
+$posts_per
-    } else {
-        preg_match('#FROM\s(.*)\sORDER BY#siU', $wp_query->request, $matches);
-        $fromwhere = preg_replace('/( AND )?post_date >= (\'|\")(.*?)(\'|\")( AND post_date <= (\'\")(.*?)(\'\"))?/siU', '', $matches[1]);
-        $num_days = $wpdb->query("SELECT DISTINCT post_date FROM $fromwhere GROUP BY year(post_date), month(post_date), dayofmonth(post_date)");
-get_option('posts_per_page')
+$posts_per
-    }
-

trunk/wp-includes/query.php

@@ -552 +552 @@
-            $q['what_to_show'] = 'posts';
-        }
+        $q['posts_per_page'] = (int) $q['posts_per_page'];
+        if ( $q['posts_per_page'] < -1 )
+            $q['posts_per_page'] = abs($q['posts_per_page']);
+        else if ( $q['posts_per_page'] == 0 )
+            $q['posts_per_page'] = 1;
-
-        if ( $this->is_home && (empty($this->query) || $q['preview'] == 'true') && ( 'page' == get_option('show_on_front') ) && get_option('page_on_front') ) {