Changeset 5121

Timestamp:

03/27/07 23:47:02 (1 year ago)

Author:

ryan

Message:

More clean_url and int casts for 2.0.

Files:

• branches/2.0/wp-admin/admin-functions.php (modified) (7 diffs)
• branches/2.0/wp-includes/functions.php (modified) (2 diffs)

branches/2.0/wp-admin/admin-functions.php

@@ -290 +290 @@
-        $text       = wp_specialchars(stripslashes(urldecode($_REQUEST['text'])));
-        $text       = funky_javascript_fix($text);
-attribute_escape
+clean_url
-        $post_content = '<a href="'.$popupurl.'">'.$post_title.'</a>'."\n$text";
-    }
@@ -340 +340 @@
-    $user->user_login   = attribute_escape($user->user_login);
-    $user->user_email   = attribute_escape($user->user_email);
-attribute_escape
+clean_url
-    $user->first_name   = attribute_escape($user->first_name);
-    $user->last_name    = attribute_escape($user->last_name);
@@ -364 +364 @@
-    if ($user_id != 0) {
-        $update = true;
-
+(int) 
-        $userdata = get_userdata($user_id);
-        $user->user_login = $wpdb->escape($userdata->user_login);
@@ -389 +389 @@
-        $user->user_email = wp_specialchars(trim($_POST['email']));
-    if (isset ($_POST['url'])) {
-wp_specialchars
+clean_url
-        $user->user_url = preg_match('/^(https?|ftps?|mailto|news|gopher):/is', $user->user_url) ? $user->user_url : 'http://'.$user->user_url;
-    }
@@ -867 +867 @@
-                <td valign='top'><input name='meta[{$entry['meta_id']}][key]' tabindex='6' type='text' size='20' value='{$entry['meta_key']}' /></td>
-                <td><textarea name='meta[{$entry['meta_id']}][value]' tabindex='6' rows='2' cols='30'>{$entry['meta_value']}</textarea></td>
-__('Update'
-__('Delete'
+attribute_escape(__('Update')
+attribute_escape(__('Delete')
-            </tr>
-        ";
@@ -932 +932 @@
-function add_meta($post_ID) {
-    global $wpdb;
+    $post_ID = (int) $post_ID;
-
-    $metakeyselect = $wpdb->escape(stripslashes(trim($_POST['metakeyselect'])));
@@ -958 +959 @@
-function delete_meta($mid) {
-    global $wpdb;
+    $mid = (int) $mid;
-
-    $result = $wpdb->query("DELETE FROM $wpdb->postmeta WHERE meta_id = '$mid'");

branches/2.0/wp-includes/functions.php

@@ -771 +771 @@
-        $_category = $category;
-    } else {
+        $category = (int) $category;
-        if ( ! $_category = wp_cache_get($category, 'category') ) {
-            $_category = $wpdb->get_row("SELECT * FROM $wpdb->categories WHERE cat_ID = '$category' LIMIT 1");
@@ -808 +809 @@
-        $_comment = & $comment_cache[$comment->comment_ID];
-    } else {
+        $comment = (int) $comment;
-        if ( !isset($comment_cache[$comment]) ) {
-            $_comment = $wpdb->get_row("SELECT * FROM $wpdb->comments WHERE comment_ID = '$comment' LIMIT 1");