Show
Ignore:
Timestamp:
08/01/07 19:25:33 (1 year ago)
Author:
markjaquith
Message:

Sanitize option names in options.php, use current escaping functions. for 2.0.x

Files:

Legend:

Unmodified
Added
Removed
Modified
Copied
Moved

  • branches/2.0/wp-admin/options.php

    r4656 r5834  
    152152foreach ( (array) $options as $option) : 
    153153    $disabled = ''; 
     154    $option->option_name = attribute_escape($option->option_name); 
    154155    if ( is_serialized($option->option_value) ) { 
    155156        if ( is_serialized_string($option->option_value) ) { 
    156157            // this is a serialized string, so we should display it 
    157             $value = wp_specialchars(maybe_unserialize($option->option_value), 'single'); 
     158            $value = maybe_unserialize($option->option_value); 
    158159            $options_to_update[] = $option->option_name; 
    159160            $class = 'all-options'; 
    …… 
    164165        } 
    165166    } else { 
    166         $value = wp_specialchars($option->option_value, 'single'); 
     167        $value = $option->option_value; 
    167168        $options_to_update[] = $option->option_name; 
    168169        $class = 'all-options'; 
    …… 
    173174<td>"; 
    174175 
    175     if (stristr($value, "\n")) echo "<textarea class='$class' name='$option->option_name' id='$option->option_name' cols='30' rows='5'>$value</textarea>"; 
    176     else echo "<input class='$class' type='text' name='$option->option_name' id='$option->option_name' size='30' value='" . $value . "'$disabled />"; 
    177      
     176    if (strpos($value, "\n") !== false) echo "<textarea class='$class' name='$option->option_name' id='$option->option_name' cols='30' rows='5'>" . wp_specialchars($value) . "</textarea>"; 
     177    else echo "<input class='$class' type='text' name='$option->option_name' id='$option->option_name' size='30' value='" . attribute_escape($value) . "'$disabled />"; 
     178 
    178179    echo "</td> 
    179180    <td>$option->option_description</td> 
    …… 
    183184  </table> 
    184185<?php $options_to_update = implode(',', $options_to_update); ?> 
    185 <p class="submit"><input type="hidden" name="page_options" value="<?php echo attribute_escape($options_to_update); ?>" /><input type="submit" name="Update" value="<?php _e('Update Options &raquo;') ?>" /></p> 
     186<p class="submit"><input type="hidden" name="page_options" value="<?php echo $options_to_update; ?>" /><input type="submit" name="Update" value="<?php _e('Update Options &raquo;') ?>" /></p> 
    186187  </form> 
    187188</div>