Changeset 4952

Show
Ignore:
Timestamp:
02/27/07 07:16:15 (1 year ago)
Author:
markjaquith
Message:

attribute_escape() in nonce AYS

Files:

Legend:

Unmodified
Added
Removed
Modified
Copied
Moved

  • branches/2.1/wp-includes/functions.php

    r4876 r4952  
    11911191    $adminurl = get_option('siteurl') . '/wp-admin'; 
    11921192    if ( wp_get_referer() ) 
    1193         $adminurl = wp_get_referer(); 
     1193        $adminurl = attribute_escape(wp_get_referer()); 
    11941194 
    11951195    $title = __('WordPress Confirmation'); 
    …… 
    12081208        $html .= "\t\t<div id='message' class='confirm fade'>\n\t\t<p>" . wp_specialchars(wp_explain_nonce($action)) . "</p>\n\t\t<p><a href='$adminurl'>" . __('No') . "</a> <input type='submit' value='" . __('Yes') . "' /></p>\n\t\t</div>\n\t</form>\n"; 
    12091209    } else { 
    1210         $html .= "\t<div id='message' class='confirm fade'>\n\t<p>" . wp_specialchars(wp_explain_nonce($action)) . "</p>\n\t<p><a href='$adminurl'>" . __('No') . "</a> <a href='" . add_query_arg( '_wpnonce', wp_create_nonce($action), $_SERVER['REQUEST_URI'] ) . "'>" . __('Yes') . "</a></p>\n\t</div>\n"; 
     1210        $html .= "\t<div id='message' class='confirm fade'>\n\t<p>" . wp_specialchars(wp_explain_nonce($action)) . "</p>\n\t<p><a href='$adminurl'>" . __('No') . "</a> <a href='" . attribute_escape(add_query_arg( '_wpnonce', wp_create_nonce($action), $_SERVER['REQUEST_URI'] )) . "'>" . __('Yes') . "</a></p>\n\t</div>\n"; 
    12111211    } 
    12121212    $html .= "</body>\n</html>"; 

  • branches/2.1/wp-includes/version.php

    r4897 r4952  
    33// This holds the version number in a separate file so we can bump it without cluttering the SVN 
    44 
    5 $wp_version = '2.1.1'; 
     5$wp_version = '2.1.2-alpha'; 
    66$wp_db_version = 4773; 
    77