Changes in branches/2.2 [5649:58137]

Location:

branches/2.2

Files:

• wp-admin/admin-ajax.php (modified) (1 diff)
• wp-admin/admin-db.php (modified) (3 diffs)
• wp-admin/admin-functions.php (modified) (8 diffs)
• wp-admin/edit-comments.php (modified) (1 diff)
• wp-admin/export.php (modified) (1 diff)
• wp-admin/import/wordpress.php (modified) (3 diffs)
• wp-admin/install-rtl.css (modified) (1 diff)
• wp-admin/install.php (modified) (1 diff)
• wp-admin/link-import.php (modified) (1 diff)
• wp-admin/options.php (modified) (6 diffs)
• wp-admin/rtl.css (modified) (6 diffs)
• wp-admin/upload-functions.php (modified) (4 diffs)
• wp-admin/users.php (modified) (1 diff)
• wp-admin/widgets-rtl.css (modified) (1 diff)
• wp-app.php (modified) (2 diffs)
• wp-content/themes/default/functions.php (modified) (1 diff)
• wp-includes/author-template.php (modified) (1 diff)
• wp-includes/bookmark-template.php (modified) (2 diffs)
• wp-includes/bookmark.php (modified) (1 diff)
• wp-includes/category-template.php (modified) (2 diffs)
• wp-includes/category.php (modified) (1 diff)
• wp-includes/class-phpmailer.php (modified) (1 diff)
• wp-includes/classes.php (modified) (2 diffs)
• wp-includes/comment-template.php (modified) (1 diff)
• wp-includes/comment.php (modified) (4 diffs)
• wp-includes/default-filters.php (modified) (1 diff)
• wp-includes/feed-rss2-comments.php (modified) (2 diffs)
• wp-includes/formatting.php (modified) (4 diffs)
• wp-includes/functions.php (modified) (10 diffs)
• wp-includes/general-template.php (modified) (3 diffs)
• wp-includes/link-template.php (modified) (2 diffs)
• wp-includes/pluggable.php (modified) (3 diffs)
• wp-includes/plugin.php (modified) (4 diffs)
• wp-includes/post-template.php (modified) (2 diffs)
• wp-includes/post.php (modified) (5 diffs)
• wp-includes/query.php (modified) (3 diffs)
• wp-includes/registration.php (modified) (1 diff)
• wp-includes/rewrite.php (modified) (1 diff)
• wp-includes/rss.php (modified) (2 diffs)
• wp-includes/theme.php (modified) (1 diff)
• wp-includes/vars.php (modified) (1 diff)
• wp-includes/version.php (modified) (1 diff)
• wp-includes/widgets.php (modified) (7 diffs)
• wp-mail.php (modified) (1 diff)
• wp-settings.php (modified) (1 diff)
• xmlrpc.php (modified) (8 diffs)

branches/2.2/wp-admin/admin-ajax.php

@@ -287 +287 @@
         }
     }
-    die($_POST['post_type']);
+    die('0');
 break;
 default :

branches/2.2/wp-admin/admin-db.php

@@ -83 +83 @@
     global $wpdb;
 
-    extract($catarr);
+    extract($catarr, EXTR_SKIP);
 
     if( trim( $cat_name ) == '' )
@@ -298 +298 @@
     global $wpdb, $current_user;
 
-    extract($linkdata);
+    extract($linkdata, EXTR_SKIP);
 
     $update = false;
@@ -420 +420 @@
 
     $wpdb->query("DELETE FROM $wpdb->link2cat WHERE link_id = '$link_id'");
-    return $wpdb->query("DELETE FROM $wpdb->links WHERE link_id = '$link_id'");
+    $wpdb->query("DELETE FROM $wpdb->links WHERE link_id = '$link_id'");
     
     do_action('deleted_link', $link_id);
+
+    return true;
 }
 

branches/2.2/wp-admin/admin-functions.php

@@ -106 +106 @@
         $_POST['post_date_gmt'] = get_gmt_from_date( $_POST['post_date'] );
     }
+    
+    unset($_POST['no_filter']);
 
     // Create the post.
@@ -284 +286 @@
     }
 
+    unset($_POST['no_filter']);
+    
     add_meta( $post_ID );
 
@@ -403 +407 @@
     $comment->comment_post_ID = (int) $comment->comment_post_ID;
 
-    $comment->comment_content = apply_filters( 'comment_text', $comment->comment_content );
     $comment->comment_content = format_to_edit( $comment->comment_content );
     $comment->comment_content = apply_filters( 'comment_edit_pre', $comment->comment_content);
@@ -903 +906 @@
     global $wpdb;
 
-    $start = (int) $start;
+    $start = abs( (int) $start );
     $num = (int) $num;
 
@@ -946 +949 @@
 if ( current_user_can('edit_post', $comment->comment_post_ID) ) {
     echo " <a href='comment.php?action=editcomment&amp;c=".$comment->comment_ID."'>" .  __('Edit') . '</a>';
-    echo ' | <a href="' . wp_nonce_url('ocomment.php?action=deletecomment&amp;p=' . $comment->comment_post_ID . '&amp;c=' . $comment->comment_ID, 'delete-comment_' . $comment->comment_ID) . '" onclick="return deleteSomething( \'comment\', ' . $comment->comment_ID . ', \'' . js_escape(sprintf(__("You are about to delete this comment by '%s'.\n'Cancel' to stop, 'OK' to delete."), $comment->comment_author)) . "', theCommentList );\">" . __('Delete') . '</a> ';
+    echo ' | <a href="' . wp_nonce_url('comment.php?action=deletecomment&amp;p=' . $comment->comment_post_ID . '&amp;c=' . $comment->comment_ID, 'delete-comment_' . $comment->comment_ID) . '" onclick="return deleteSomething( \'comment\', ' . $comment->comment_ID . ', \'' . js_escape(sprintf(__("You are about to delete this comment by '%s'.\n'Cancel' to stop, 'OK' to delete."), $comment->comment_author)) . "', theCommentList );\">" . __('Delete') . '</a> ';
     if ( ('none' != $comment_status) && ( current_user_can('moderate_comments') ) ) {
         echo '<span class="unapprove"> | <a href="' . wp_nonce_url('comment.php?action=unapprovecomment&amp;p=' . $comment->comment_post_ID . '&amp;c=' . $comment->comment_ID, 'unapprove-comment_' . $comment->comment_ID) . '" onclick="return dimSomething( \'comment\', ' . $comment->comment_ID . ', \'unapproved\', theCommentList );">' . __('Unapprove') . '</a> </span>';
@@ -1111 +1114 @@
     $post_ID = (int) $post_ID;
 
+    $protected = array( '_wp_attached_file', '_wp_attachment_metadata', '_wp_old_slug', '_wp_page_template' );
+
     $metakeyselect = $wpdb->escape( stripslashes( trim( $_POST['metakeyselect'] ) ) );
     $metakeyinput = $wpdb->escape( stripslashes( trim( $_POST['metakeyinput'] ) ) );
@@ -1125 +1130 @@
         if ( $metakeyinput)
             $metakey = $metakeyinput; // default
+
+        if ( in_array($metakey, $protected) )
+            return false;
 
         $result = $wpdb->query( "
@@ -1145 +1153 @@
 function update_meta( $mid, $mkey, $mvalue ) {
     global $wpdb;
+
+    $protected = array( '_wp_attached_file', '_wp_attachment_metadata', '_wp_old_slug', '_wp_page_template' );
+
+    if ( in_array($mkey, $protected) )
+        return false;
+
     $mvalue = maybe_serialize( stripslashes( $mvalue ));
     $mvalue = $wpdb->escape( $mvalue );

branches/2.2/wp-admin/edit-comments.php

@@ -77 +77 @@
 
 if ( isset( $_GET['apage'] ) )
-    $page = (int) $_GET['apage'];
+    $page = abs( (int) $_GET['apage'] );
 else
     $page = 1;

branches/2.2/wp-admin/export.php

@@ -148 +148 @@
 -->
 
-<!-- generator="wordpress/<?php bloginfo_rss('version') ?>" created="<?php echo date('Y-m-d H:m'); ?>"-->
+<!-- generator="wordpress/<?php bloginfo_rss('version') ?>" created="<?php echo date('Y-m-d H:i'); ?>"-->
 <rss version="2.0"
     xmlns:content="http://purl.org/rss/1.0/modules/content/"

branches/2.2/wp-admin/import/wordpress.php

@@ -38 +38 @@
         global $wpdb;
         preg_match("|<$tag.*?>(.*?)</$tag>|is", $string, $return);
-        $return = $wpdb->escape( trim( $return[1] ) );
+        $return = preg_replace('|^<!\[CDATA\[(.*)\]\]>$|s', '$1', $return[1]);
+        $return = $wpdb->escape( trim( $return ) );
         return $return;
     }
@@ -216 +217 @@
 
         while ( $c = array_shift($this->categories) ) {
-            $cat_name = trim(str_replace(array ('<![CDATA[', ']]>'), '', $this->get_tag( $c, 'wp:cat_name' )));
+            $cat_name = trim($this->get_tag( $c, 'wp:cat_name' ));
 
             // If the category exists we leave it alone
@@ -275 +276 @@
 
         $post_content = $this->get_tag( $post, 'content:encoded' );
-        $post_content = str_replace(array ('<![CDATA[', ']]>'), '', $post_content);
         $post_content = preg_replace('|<(/?[A-Z]+)|e', "'<' . strtolower('$1')", $post_content);
         $post_content = str_replace('<br>', '<br />', $post_content);

branches/2.2/wp-admin/install-rtl.css

@@ -1 @@
-body { font-family: Tahoma, Georgia, "Times New Roman", Times, serif; }
+body { font: 13px Tahoma, Georgia, "Times New Roman", Times, serif; }
 
 ul, ol { padding: 5px 20px 5px 5px; }
 
-.step, th { text-align: left; }
+h1, h2, h3 { font-family: "Times New Roman", Times, serif; font-weight: 700 }
+
+.step, th { text-align: left }
+
+input { font-family: "Times New Roman", Times, serif; padding: 1px }
+
+#logo { background: url(../wp-content/plugins/WP-Jalali/wp-fa-logo.png) center right no-repeat; text-align: left; }
+
+#admin_email {direction: ltr; text-align: left; }
+
+#footer { font-style: normal; }

branches/2.2/wp-admin/install.php

@@ -83 +83 @@
 <?php
     $result = wp_install($weblog_title, 'admin', $admin_email, $public);
-    extract($result);
+    extract($result, EXTR_SKIP);
 ?>
 

branches/2.2/wp-admin/link-import.php

@@ -74 +74 @@
 <h2><?php _e('Importing...') ?></h2>
 <?php
-        $cat_id = $_POST['cat_id'];
-        if ( $cat_id == '' || $cat_id == 0 )
+        $cat_id = abs( (int) $_POST['cat_id'] );
+        if ( $cat_id < 1 )
             $cat_id  = 1;
 

branches/2.2/wp-admin/options.php

@@ -10 +10 @@
 if ( !current_user_can('manage_options') )
     wp_die(__('Cheatin’ uh?'));
-
-function sanitize_option($option, $value) { // Remember to call stripslashes!
-
-    switch ($option) {
-        case 'admin_email':
-            $value = stripslashes($value);
-            $value = sanitize_email($value);
-            break;
-
-        case 'default_post_edit_rows':
-        case 'mailserver_port':
-        case 'comment_max_links':
-            $value = stripslashes($value);
-            $value = abs((int) $value);
-            break;
-
-        case 'posts_per_page':
-        case 'posts_per_rss':
-            $value = stripslashes($value);
-            $value = (int) $value;
-            if ( empty($value) ) $value = 1;
-            if ( $value < -1 ) $value = abs($value);
-            break;
-
-        case 'default_ping_status':
-        case 'default_comment_status':
-            $value = stripslashes($value);
-            // Options that if not there have 0 value but need to be something like "closed"
-            if ( $value == '0' || $value == '')
-                $value = 'closed';
-            break;
-
-        case 'blogdescription':
-        case 'blogname':
-            if (current_user_can('unfiltered_html') == false)
-                $value = wp_filter_post_kses( $value ); // calls stripslashes then addslashes
-            $value = stripslashes($value);
-            break;
-
-        case 'blog_charset':
-            $value = preg_replace('/[^a-zA-Z0-9_-]/', '', $value); // strips slashes
-            break;
-
-        case 'date_format':
-        case 'time_format':
-        case 'mailserver_url':
-        case 'mailserver_login':
-        case 'mailserver_pass':
-        case 'ping_sites':
-        case 'upload_path':
-            $value = strip_tags($value);
-            $value = wp_filter_kses($value); // calls stripslashes then addslashes
-            $value = stripslashes($value);
-            break;
-
-        case 'gmt_offset':
-            $value = preg_replace('/[^0-9:.-]/', '', $value); // strips slashes
-            break;
-
-        case 'siteurl':
-        case 'home':
-            $value = stripslashes($value);
-            $value = clean_url($value);
-            break;
-        default :
-            $value = stripslashes($value);
-            break;
-    }
-
-    return $value;
-}
 
 switch($action) {
@@ -101 +30 @@
         foreach ($options as $option) {
             $option = trim($option);
-            $value = trim($_POST[$option]);
-            $value = sanitize_option($option, $value); // This does stripslashes on those that need it
+            $value = $_POST[$option];
+            if(!is_array($value))   $value = trim($value);
+            $value = stripslashes_deep($value);
             update_option($option, $value);
         }
@@ -128 +58 @@
 foreach ( (array) $options as $option) :
     $disabled = '';
+    $option->option_name = attribute_escape($option->option_name);
     if ( is_serialized($option->option_value) ) {
         if ( is_serialized_string($option->option_value) ) {
             // this is a serialized string, so we should display it
-            $value = wp_specialchars(maybe_unserialize($option->option_value), 'single');
+            $value = maybe_unserialize($option->option_value);
             $options_to_update[] = $option->option_name;
             $class = 'all-options';
@@ -140 +71 @@
         }
     } else {
-        $value = wp_specialchars($option->option_value, 'single');
+        $value = $option->option_value;
         $options_to_update[] = $option->option_name;
         $class = 'all-options';
@@ -149 +80 @@
 <td>";
 
-    if (strpos($value, "\n") !== false) echo "<textarea class='$class' name='$option->option_name' id='$option->option_name' cols='30' rows='5'>$value</textarea>";
-    else echo "<input class='$class' type='text' name='$option->option_name' id='$option->option_name' size='30' value='" . $value . "'$disabled />";
+    if (strpos($value, "\n") !== false) echo "<textarea class='$class' name='$option->option_name' id='$option->option_name' cols='30' rows='5'>" . wp_specialchars($value) . "</textarea>";
+    else echo "<input class='$class' type='text' name='$option->option_name' id='$option->option_name' size='30' value='" . attribute_escape($value) . "'$disabled />";
 
     echo "</td>
@@ -159 +90 @@
   </table>
 <?php $options_to_update = implode(',', $options_to_update); ?>
-<p class="submit"><input type="hidden" name="page_options" value="<?php echo attribute_escape($options_to_update); ?>" /><input type="submit" name="Update" value="<?php _e('Update Options &raquo;') ?>" /></p>
+<p class="submit"><input type="hidden" name="page_options" value="<?php echo $options_to_update; ?>" /><input type="submit" name="Update" value="<?php _e('Update Options &raquo;') ?>" /></p>
   </form>
 </div>

branches/2.2/wp-admin/rtl.css

@@ -1 @@
-#viewarc, #viewcat, #namediv, #emaildiv, #uridiv, #planetnews li, #login ul li, #your-profile fieldset, 
-    #footer .logo, .alignleft .available-theme { float: right; }
-
-#templateside, .alignright { float: left; }
-
-#login #send, .readmore, .widefat th { text-align: right; }
-
-#postcustomsubmit, form#upload th, .submit, .editform th { text-align: left; }
-
-#devnews h4, #wphead h1, #your-profile legend, fieldset.options legend, 
-    #planetnews li .post { font-family: Tahoma, Georgia, "Times New Roman", Times, serif; }
-
-#wphead { padding: .8em 2em .8em 19em; }
-
-#wphead h1 { font-size: 2.4em; }
-
-#postdiv, #titlediv, #guiddiv, #tagdiv { margin: 0 0 0 8px; }
-
-#ed_toolbar input { margin: 3px 0 2px 2px; }
-
-#edButtons input, #edButtons input:active { margin: 0px 0 -1px 2px; }
-
-body, td { font: 13px Tahoma, "Lucida Grande", "Lucida Sans Unicode", Verdana; }
-
-h2 { font: normal 32px/5px serif; }
-
-textarea, input, select { font:  13px Tahoma, Verdana, Arial, Helvetica, sans-serif; }
-
-.quicktags, .search { font: 12px Tahoma, Georgia, "Times New Roman", Times, serif; }
-
-.updated, .confirm { padding: 0 3em 0 1em; }
+#viewarc, #viewcat, #namediv, #emaildiv, #uridiv, #planetnews li, #login ul li, #your-profile fieldset, #footer .logo, .alignleft .available-theme {
+    float: right;
+    }
+
+#templateside, .alignright {
+    float: left;
+    }
+
+#login #send, .readmore, .widefat th {
+    text-align: right;
+    }
+
+#postcustomsubmit, form#upload th, .submit, .editform th {
+    text-align: left;
+    }
+
+#devnews h4, #wphead h1, #your-profile legend, fieldset.options legend, #planetnews li .post {
+    font-family: Tahoma, Georgia, "Times New Roman", Times, serif;
+    }
+
+#wphead {
+    padding: .8em 2em .8em 19em;
+    }
+
+#wphead h1 {
+    font-size: 2.4em;
+    }
+
+#postdiv, #titlediv, #guiddiv, #tagdiv {
+    margin: 0 0 0 8px;
+    }
+
+#ed_toolbar input {
+    margin: 3px 0 2px 2px;
+    }
+
+#edButtons input, #edButtons input:active {
+    margin: 0px 0 -1px 2px;
+    }
+
+body, td {
+    font: 13px Tahoma, "Lucida Grande", "Lucida Sans Unicode", Verdana;
+    }
+
+h1, h2, h3, h4, h5 {
+    font-family: "Times New Roman", Times, serif;
+    }
+h3.dbx-handle {
+    font-family: tahoma, Verdana, Arial, Helvetica, sans-serif;
+    }
+
+textarea, input, select {
+    font:  13px Tahoma, Verdana, Arial, Helvetica, sans-serif;
+    }
+
+.quicktags, .search {
+    font: 12px Tahoma, Georgia, "Times New Roman", Times, serif;
+    }
+
+.updated, .confirm {
+    padding: 0 3em 0 1em;
+    }
 
 .submit input, .submit input:focus, .button, .button:focus {
     border-left-color: #999;
     border-right-color: #ccc;
-}
+    }
 
 .submit input:active, .button:active {
     border-left-color: #ccc;
     border-right-color: #999;
-}
+    }
 
 #adminmenu {
     padding: .2em 2em .3em .2em;
     height: 28px;
-}
-
-#adminmenu li { line-height: 160%; }
+    }
 
 #adminmenu a {
@@ -52 +81 @@
     display: block;
     float: right;
-}
+    font: 700 16px/130% "Times New Roman", Times, serif;
+    }
 
 #adminmenu a.current {
     border-right: 0;
     border-left: 2px solid #4f96c8;
-}
-
-#submenu, #minisub { padding: 1px 3em 0 2em; }
-
-#submenu { height: 28px; }
-
-#submenu li { line-height: 160%; }
+    }
+
+#submenu, #minisub {
+    padding: 1px 3em 0 2em;
+    }
+
+#submenu {
+    height: 28px;
+    }
 
 #submenu a {
@@ -69 +101 @@
     display: block;
     float: right;
-}
+    line-height: 155%;
+    }
 
 #submenu .current {
     border-right: 0;
     border-left: 2px solid #045290;
-}
+    }
 
 #currenttheme img {
@@ -80 +113 @@
     margin-right: auto;
     margin-left: 1em;
-}
+    }
 
 #postdiv #quicktags {
     padding-right: 0;
     padding-left: 6px;
-}
+    }
 
 .readmore {
     margin-right: auto;
     margin-left: 5em;
-}
+    }
 
 #postexcerpt div, #attachmentlinks div {
     margin-right: auto;
     margin-left: 8px;
-}
+    }
 
 * html #postexcerpt .dbx-toggle-open {
     padding-right: 0;
     padding-left: 8px;
-}
+    }
 
 #searchform {
@@ -106 +139 @@
     margin-right: auto;
     margin-left: 1em;
-}
+    }
 
 #poststuff {
     margin-right: auto;
     margin-left: 16em;
-}
+    }
 
 #template div {
     margin-right: auto;
     margin-left: 190px;
-}
+    }
 
 * html #template div {
     margin-right: auto;
     margin-left: 0px;
-}
+    }
 
 #user_info {
     right: auto;
     left: 1em;
-}
-
+    }
+    
 #zeitgeist {
     float: left;
     margin-left: auto;
     margin-right: 1em;
-}
+    }
 
 #zeitgeist ul {
     margin: 0 .6em .3em 0;
     padding: 0 .6em 0 0;
-}
+    }
+
+.wrap ul {
+    margin-left: 500px;
+    }
 
 #categorydiv ul {
     margin-left: auto;
     margin-right: 10px;
-}
-
-#moremeta fieldset div { margin: 2px 0px 0 0; }
+    }
 
 #moremeta {
-    margin-right: auto;
+    margin-right: 0;
     margin-left: 15px;
     right: auto;
-    left: 5%;
-}
-
+    left: 6%;
+    }
+    
 #moremeta .dbx-content {
     background: url(images/box-butt.gif) no-repeat bottom left;
-    padding-right: 0;
-    padding-left: 2px;
-}
-
-#moremeta .dbx-handle { background: #2685af url(images/box-head.gif) no-repeat left; }
-
-#moremeta .dbx-box { background: url(images/box-bg.gif) repeat-y left; }
+    padding-right: 10px;
+    padding-left: 0;
+    text-align: right;
+    }
+    
+#moremeta .dbx-handle {
+    background: #2685af url(images/box-head.gif) no-repeat left;
+    margin-top: -2px;
+    }
+
+#moremeta .dbx-box {
+    background: url(images/box-bg.gif) repeat-y left;
+    padding-bottom: 0;
+    }
 
 a.dbx-toggle, a.dbx-toggle:visited {
     right: auto;
     left: 2px;
-}
-
-#advancedstuff a.dbx-toggle, #advancedstuff a.dbx-toggle-open:visited {
-    right: auto;
-    left: 5px;
-}
-
-#advancedstuff a.dbx-toggle-open, #advancedstuff a.dbx-toggle-open:visited {
-    right: auto;
-    left: 5px;
-}
+    }
+
 
 #categorychecklist {
     margin-right: auto;
     margin-left: 6px;
-}
+    }
 
 #ajax-response.alignleft {
     margin-left: auto;
     margin-right: 2em;
-}
+    }
 
 #postdivrich #edButtons {
     padding-left: 0;
     padding-right: 3px;
-}
+    }
 
 .page-numbers {
     margin-right: auto;
     margin-left: 3px;
-}
+    }
 
 a.view-link {
@@ -203 +236 @@
     margin-right:0;
     margin-left:220px;
-}
+    }
+#advancedstuff {
+    direction: ltr;
+    }
+#advancedstuff .dbx-handle {
+    text-align: right;
+    }
+#advancedstuff .dbx-content * {
+    direction: rtl;
+    }

branches/2.2/wp-admin/upload-functions.php

@@ -106 +106 @@
     global $post_id, $tab, $style;
     $enctype = $id ? '' : ' enctype="multipart/form-data"';
+    $post_id = (int) $post_id;
 ?>
-    <form<?php echo $enctype; ?> id="upload-file" method="post" action="<?php echo get_option('siteurl') . "/wp-admin/upload.php?style=$style&amp;tab=upload&amp;post_id=$post_id"; ?>">
+    <form<?php echo $enctype; ?> id="upload-file" method="post" action="<?php echo get_option('siteurl') . '/wp-admin/upload.php?style=' . attribute_escape($style . '&amp;tab=upload&amp;post_id=' . $post_id); ?>">
 <?php
     if ( $id ) :
@@ -202 +203 @@
         if ( !current_user_can( 'upload_files' ) )
             wp_die( __('You are not allowed to upload files.')
-                . " <a href='" . get_option('siteurl') . "/wp-admin/upload.php?style=$style&amp;tab=browse-all&amp;post_id=$post_id'>"
+                . " <a href='" . get_option('siteurl') . "/wp-admin/upload.php?style=" . attribute_escape($style . "&amp;tab=browse-all&amp;post_id=$post_id") . "'>"
                 . __('Browse Files') . '</a>'
             );
@@ -212 +213 @@
         if ( isset($file['error']) )
             wp_die($file['error'] . "<br /><a href='" . get_option('siteurl')
-            . "/wp-admin/upload.php?style=$style&amp;tab=$from_tab&amp;post_id=$post_id'>" . __('Back to Image Uploading') . '</a>'
+            . "/wp-admin/upload.php?style=" . attribute_escape($style . "&amp;tab=$from_tab&amp;post_id=$post_id") . "'>" . __('Back to Image Uploading') . '</a>'
         );
 
@@ -259 +260 @@
         if ( !current_user_can('edit_post', (int) $ID) )
             wp_die( __('You are not allowed to delete this attachment.')
-                . " <a href='" . get_option('siteurl') . "/wp-admin/upload.php?style=$style&amp;tab=$from_tab&amp;post_id=$post_id'>"
+                . " <a href='" . get_option('siteurl') . "/wp-admin/upload.php?style=" . attribute_escape($style . "&amp;tab=$from_tab&amp;post_id=$post_id") . "'>"
                 . __('Go back') . '</a>'
             );

branches/2.2/wp-admin/users.php

@@ -382 +382 @@
     <th colspan="7"><h3><?php echo $wp_roles->role_names[$role]; ?></h3></th>
 <?php else : ?>
-    <th colspan="7"><h3><em><?php _e('No role for this blog'); ?></h3></th>
+    <th colspan="7"><h3><em><?php _e('No role for this blog'); ?></em></h3></th>
 <?php endif; ?>
 </tr>

branches/2.2/wp-admin/widgets-rtl.css

@@ -5 +5 @@
 * html #palettediv ul { padding: 0 10px 0 0; }
 
-#palettediv ul { padding: 0 10px 0 0; }
+#palettediv ul { padding: 0 10px 0 0;
+ margin-left: 1px!important;}
 
 * .handle, #lastmodule span {

branches/2.2/wp-app.php

@@ -674 +674 @@
 
         $location = get_post_meta($entry['ID'], '_wp_attached_file', true);
-
-        if(!isset($location))
+        $filetype = wp_check_filetype($location);
+
+        if(!isset($location) || 'attachment' != $entry['post_type'] || empty($filetype['ext']))
             $this->internal_error(__('Error ocurred while accessing post metadata for file location.'));
 
@@ -708 +709 @@
 
         $location = get_post_meta($entry['ID'], '_wp_attached_file', true);
-
-        if(!isset($location))
+        $filetype = wp_check_filetype($location);
+
+        if(!isset($location) || 'attachment' != $entry['post_type'] || empty($filetype['ext']))
             $this->internal_error(__('Error ocurred while accessing post metadata for file location.'));
 

branches/2.2/wp-content/themes/default/functions.php

@@ -385 +385 @@
         </div>
         <div id="jsForm">
-            <form style="display:inline;" method="post" name="hicolor" id="hicolor" action="<?php echo $_SERVER['REQUEST_URI']; ?>">
+            <form style="display:inline;" method="post" name="hicolor" id="hicolor" action="<?php echo attribute_escape($_SERVER['REQUEST_URI']); ?>">
                 <?php wp_nonce_field('kubrick-header'); ?>
     <input type="button" onclick="tgt=document.getElementById('fontcolor');colorSelect(tgt,'pick1');return false;" name="pick1" id="pick1" value="<?php echo attribute_escape(__('Font Color')); ?>"></input>

branches/2.2/wp-includes/author-template.php

@@ -184 +184 @@
         'feed' => '', 'feed_image' => '');
     $r = array_merge($defaults, $r);
-    extract($r);
+    extract($r, EXTR_SKIP);
     
     // TODO:  Move select to get_authors().

branches/2.2/wp-includes/bookmark-template.php

@@ -254 +254 @@
         'after' => '</li>', 'between' => "\n");
     $r = array_merge($defaults, $r);
-    extract($r);
+    extract($r, EXTR_SKIP);
 
     foreach ( (array) $bookmarks as $bookmark ) {
@@ -332 +332 @@
         'category_before' => '<li id="%id" class="%class">', 'category_after' => '</li>');
     $r = array_merge($defaults, $r);
-    extract($r);
+    extract($r, EXTR_SKIP);
 
     $output = '';

branches/2.2/wp-includes/bookmark.php

@@ -35 +35 @@
         'category_name' => '', 'hide_invisible' => 1, 'show_updated' => 0, 'include' => '', 'exclude' => '');
     $r = array_merge($defaults, $r);
-    extract($r);
+    extract($r, EXTR_SKIP);
 
     $key = md5( serialize( $r ) );

branches/2.2/wp-includes/category-template.php

@@ -192 +192 @@
     $r = array_merge($defaults, $r);
     $r['include_last_update_time'] = $r['show_last_update'];
-    extract($r);
+    extract($r, EXTR_SKIP);
 
     $categories = get_categories($r);
@@ -243 +243 @@
     if ( isset($r['show_date']) )
         $r['include_last_update_time'] = $r['show_date'];
-    extract($r);
+    extract($r, EXTR_SKIP);
 
     $categories = get_categories($r);

branches/2.2/wp-includes/category.php

@@ -29 +29 @@
         $r['orderby'] = "cat_" . $r['orderby'];  // restricts order by to cat_ID and cat_name fields
     $r['number'] = (int) $r['number'];
-    extract($r);
+    extract($r, EXTR_SKIP);
 
     $key = md5( serialize( $r ) );

branches/2.2/wp-includes/class-phpmailer.php

@@ -391 +391 @@
     function SendmailSend($header, $body) {
         if ($this->Sender != "")
-            $sendmail = sprintf("%s -oi -f %s -t", $this->Sendmail, $this->Sender);
+            $sendmail = sprintf("%s -oi -f %s -t", $this->Sendmail, escapeshellarg($this->Sender));
         else
             $sendmail = sprintf("%s -oi -t", $this->Sendmail);

branches/2.2/wp-includes/classes.php

@@ -507 +507 @@
         if ( $depth )
             $indent = str_repeat("\t", $depth);
-        extract($args);
+        extract($args, EXTR_SKIP);
         $css_class = 'page_item';
         $_current_page = get_page( $current_page );
@@ -697 +697 @@
 
         $r = array_merge($defaults, $r);
-        extract($r);
+        extract($r, EXTR_SKIP);
 
         if ( is_wp_error($id) ) {

branches/2.2/wp-includes/comment-template.php

@@ -286 +286 @@
     $req = get_option('require_name_email');
     $commenter = wp_get_current_commenter();
-    extract($commenter);
+    extract($commenter, EXTR_SKIP);
 
     // TODO: Use API instead of SELECTs.

branches/2.2/wp-includes/comment.php

@@ -179 +179 @@
 function wp_allow_comment($commentdata) {
     global $wpdb;
-    extract($commentdata);
+    extract($commentdata, EXTR_SKIP);
 
     // Simple duplicate check
@@ -326 +326 @@
 function wp_insert_comment($commentdata) {
     global $wpdb;
-    extract($commentdata);
+    extract($commentdata, EXTR_SKIP);
 
     if ( ! isset($comment_author_IP) )
@@ -458 +458 @@
 
     // Now extract the merged array.
-    extract($commentarr);
+    extract($commentarr, EXTR_SKIP);
 
     $comment_content = apply_filters('comment_save_pre', $comment_content);
@@ -518 +518 @@
     $pingback_href_original_pos = 27;
 
-    extract(parse_url($url));
+    extract(parse_url($url), EXTR_SKIP);
 
     if ( !isset($host) ) // Not an URL. This should never happen.

branches/2.2/wp-includes/default-filters.php

@@ -130 +130 @@
 add_filter('sanitize_title', 'sanitize_title_with_dashes');
 
+add_filter('wp_title', 'wp_specialchars');
+
 // RSS filters
 add_filter('the_title_rss', 'strip_tags');

branches/2.2/wp-includes/feed-rss2-comments.php

@@ -6 +6 @@
 <!-- generator="wordpress/<?php echo $wp_version ?>" -->
 <rss version="2.0" 
-    xmlns:content="http://purl.org/rss/1.0/modules/content/">
+    xmlns:content="http://purl.org/rss/1.0/modules/content/"
+    xmlns:dc="http://purl.org/dc/elements/1.1/"
+    >
 <channel>
     <title><?php
@@ -38 +40 @@
         ?></title>
         <link><?php comment_link() ?></link>
-        <author><?php echo get_comment_author_rss() ?></author>
+        <dc:creator><?php echo get_comment_author_rss() ?></dc:creator>
         <pubDate><?php echo mysql2date('D, d M Y H:i:s +0000', get_comment_time('Y-m-d H:i:s', true), false); ?></pubDate>
         <guid><?php comment_link() ?></guid>

branches/2.2/wp-includes/formatting.php

@@ -12 +12 @@
     if ( isset($wp_cockneyreplace) ) {
         $cockney = array_keys($wp_cockneyreplace);
-        $cockney_replace = array_values($wp_cockneyreplace);
+        $cockneyreplace = array_values($wp_cockneyreplace);
     } else {
         $cockney = array("'tain't","'twere","'twas","'tis","'twill","'til","'bout","'nuff","'round","'cause");
@@ -637 +637 @@
     // This is a pre save filter, so text is already escaped.
     $text = stripslashes($text);
-    $text = preg_replace('|<a (.+?)>|ie', "'<a ' . str_replace(' rel=\"nofollow\"','',stripslashes('$1')) . ' rel=\"nofollow\">'", $text);
+    $text = preg_replace_callback('|<a (.+?)>|i', 'wp_rel_nofollow_callback', $text);
     $text = $wpdb->escape($text);
     return $text;
+}
+
+function wp_rel_nofollow_callback( $matches ) {
+    $text = $matches[1];
+    $text = str_replace(array(' rel="nofollow"', " rel='nofollow'"), '', $text);
+    return "<a $text rel=\"nofollow\">";
 }
 
@@ -1104 +1110 @@
 function js_escape($text) {
     $safe_text = wp_specialchars($text, 'double');
-    $safe_text = str_replace('&#039;', "'", $safe_text);
+    $safe_text = preg_replace('/&#(x)?0*(?(1)27|39);?/i', "'", stripslashes($safe_text));
     $safe_text = preg_replace("/\r?\n/", "\\n", addslashes($safe_text));
     return apply_filters('js_escape', $safe_text, $text);
@@ -1119 +1125 @@
 }
 
+function sanitize_option($option, $value) { // Remember to call stripslashes!
+
+    switch ($option) {
+        case 'admin_email':
+            $value = sanitize_email($value);
+            break;
+
+        case 'default_post_edit_rows':
+        case 'mailserver_port':
+        case 'comment_max_links':
+        case 'page_on_front':
+        case 'rss_excerpt_length':
+        case 'default_category':
+        case 'default_email_category':
+        case 'default_link_category':
+            $value = abs((int) $value);
+            break;
+
+        case 'posts_per_page':
+        case 'posts_per_rss':
+            $value = (int) $value;
+            if ( empty($value) ) $value = 1;
+            if ( $value < -1 ) $value = abs($value);
+            break;
+
+        case 'default_ping_status':
+        case 'default_comment_status':
+            // Options that if not there have 0 value but need to be something like "closed"
+            if ( $value == '0' || $value == '')
+                $value = 'closed';
+            break;
+
+        case 'blogdescription':
+        case 'blogname':
+            $value = addslashes($value);
+            $value = wp_filter_post_kses( $value ); // calls stripslashes then addslashes
+            $value = stripslashes($value);
+            $value = wp_specialchars( $value );
+            break;
+
+        case 'blog_charset':
+            $value = preg_replace('/[^a-zA-Z0-9_-]/', '', $value); // strips slashes
+            break;
+
+        case 'date_format':
+        case 'time_format':
+        case 'mailserver_url':
+        case 'mailserver_login':
+        case 'mailserver_pass':
+        case 'ping_sites':
+        case 'upload_path':
+            $value = strip_tags($value);
+            $value = addslashes($value);
+            $value = wp_filter_kses($value); // calls stripslashes then addslashes
+            $value = stripslashes($value);
+            break;
+
+        case 'gmt_offset':
+            $value = preg_replace('/[^0-9:.-]/', '', $value); // strips slashes
+            break;
+
+        case 'siteurl':
+        case 'home':
+            $value = stripslashes($value);
+            $value = clean_url($value);
+            break;
+        default :
+            break;
+    }
+
+    return $value;
+}
+
+function wp_parse_str( $string, &$array ) {
+    parse_str( $string, $array );
+    if ( get_magic_quotes_gpc() )
+        $array = stripslashes_deep( $array ); // parse_str() adds slashes if magicquotes is on.  See: http://php.net/parse_str
+    $array = apply_filters( 'wp_parse_str', $array );
+}
+
 ?>

branches/2.2/wp-includes/functions.php

@@ -204 +204 @@
 /* Options functions */
 
+// expects $setting to already be SQL-escaped
 function get_option($setting) {
     global $wpdb;
@@ -303 +304 @@
 }
 
+// expects $option_name to NOT be SQL-escaped
 function update_option($option_name, $newvalue) {
     global $wpdb;
@@ -308 +310 @@
     wp_protect_special_option($option_name);
 
+    $safe_option_name = $wpdb->escape($option_name);
+    $newvalue = sanitize_option($option_name, $newvalue);
+
     if ( is_string($newvalue) )
         $newvalue = trim($newvalue);
 
     // If the new and old values are the same, no need to update.
-    $oldvalue = get_option($option_name);
+    $oldvalue = get_option($safe_option_name);
     if ( $newvalue === $oldvalue ) {
         return false;
@@ -350 +355 @@
 
 // thx Alex Stapleton, http://alex.vort-x.net/blog/
+// expects $name to NOT be SQL-escaped
 function add_option($name, $value = '', $description = '', $autoload = 'yes') {
     global $wpdb;
 
     wp_protect_special_option($name);
-
-    // Make sure the option doesn't already exist we can check the cache before we ask for a db query
+    $safe_name = $wpdb->escape($name);
+
+    // Make sure the option doesn't already exist. We can check the 'notoptions' cache before we ask for a db query
     $notoptions = wp_cache_get('notoptions', 'options');
-    if ( is_array($notoptions) && isset($notoptions[$name]) ) {
-        unset($notoptions[$name]);
-        wp_cache_set('notoptions', $notoptions, 'options');
-    } elseif ( false !== get_option($name) ) {
+    if ( !is_array($notoptions) || !isset($notoptions[$name]) )
+        if ( false !== get_option($safe_name) )
             return;
-    }
 
     $value = maybe_serialize($value);
+    $autoload = ( 'no' === $autoload ) ? 'no' : 'yes';
 
     if ( 'yes' == $autoload ) {
@@ -372 +377 @@
     } else {
         wp_cache_set($name, $value, 'options');
+    }
+
+    // This option exists now
+    $notoptions = wp_cache_get('notoptions', 'options'); // yes, again... we need it to be fresh
+    if ( is_array($notoptions) && isset($notoptions[$name]) ) {
+        unset($notoptions[$name]);
+        wp_cache_set('notoptions', $notoptions, 'options');
     }
 
@@ -762 +774 @@
     $ret = '';
     if ( is_array(func_get_arg(0)) ) {
-        if ( @func_num_args() < 2 || '' == @func_get_arg(1) )
+        if ( @func_num_args() < 2 || false === @func_get_arg(1) )
             $uri = $_SERVER['REQUEST_URI'];
         else
             $uri = @func_get_arg(1);
     } else {
-        if ( @func_num_args() < 3 || '' == @func_get_arg(2) )
+        if ( @func_num_args() < 3 || false === @func_get_arg(2) )
             $uri = $_SERVER['REQUEST_URI'];
         else
@@ -802 +814 @@
     }
 
-    parse_str($query, $qs);
-    if ( get_magic_quotes_gpc() )
-        $qs = stripslashes_deep($qs); // parse_str() adds slashes if magicquotes is on.  See: http://php.net/parse_str
+    wp_parse_str($query, $qs);
     $qs = urlencode_deep($qs);
     if ( is_array(func_get_arg(0)) ) {
@@ -825 +835 @@
     $ret = trim($ret, '?');
     $ret = $protocol . $base . $ret . $frag;
-    $ret = trim($ret, '?');
+    $ret = rtrim($ret, '?');
     return $ret;
 }
@@ -839 +849 @@
 */
 
-function remove_query_arg($key, $query='') {
+function remove_query_arg($key, $query=FALSE) {
     if ( is_array($key) ) { // removing multiple keys
         foreach ( (array) $key as $k )
@@ -1482 +1492 @@
 
 function wp_parse_args( $args, $defaults = '' ) {
-    if ( is_array($args) ) :
+    if ( is_array( $args ) )
         $r =& $args;
-    else :
-        parse_str( $args, $r );
-        if ( get_magic_quotes_gpc() )
-            $r = stripslashes_deep( $r );
-    endif;
-
-    if ( is_array($defaults) ) :
-        extract($defaults);
-        extract($r);
-        return compact(array_keys($defaults)); // only those options defined in $defaults
-    else :
+    else
+        wp_parse_str( $args, $r );
+
+    if ( is_array( $defaults ) )
+        return array_merge( $defaults, $r );
+    else
         return $r;
-    endif;
 }
 

branches/2.2/wp-includes/general-template.php

@@ -323 +323 @@
     $defaults = array('type' => 'monthly', 'limit' => '', 'format' => 'html', 'before' => '', 'after' => '', 'show_post_count' => false);
     $r = array_merge($defaults, $r);
-    extract($r);
+    extract($r, EXTR_SKIP);
 
     if ( '' == $type )
@@ -814 +814 @@
         if ( get_user_option( 'rich_editing' ) == 'true' && 
             ( ( preg_match( '!AppleWebKit/(\d+)!', $_SERVER['HTTP_USER_AGENT'], $match ) && intval($match[1]) >= 420 ) || 
-                !preg_match( '!opera[ /][2-8]|konqueror|safari!i', $_SERVER['HTTP_USER_AGENT'] ) ) ) {
+                !preg_match( '!opera[ /][2-8]|konqueror|safari!i', $_SERVER['HTTP_USER_AGENT'] ) )
+                && 'comment.php' != $pagenow ) {
             $wp_rich_edit = true;
         } else {
@@ -958 +959 @@
 }
 
-function paginate_links( $arg = '' ) {
-    if ( is_array($arg) )
-        $a = &$arg;
-    else
-        parse_str($arg, $a);
-
-    // Defaults
-    $base = '%_%'; // http://example.com/all_posts.php%_% : %_% is replaced by format (below)
-    $format = '?page=%#%'; // ?page=%#% : %#% is replaced by the page number
-    $total = 1;
-    $current = 0;
-    $show_all = false;
-    $prev_next = true;
-    $prev_text = __('« Previous');
-    $next_text = __('Next »');
-    $end_size = 1; // How many numbers on either end including the end
-    $mid_size = 2; // How many numbers to either side of current not including current
-    $type = 'plain';
-    $add_args = false; // array of query args to aadd
-
-    extract($a);
+function paginate_links( $args = '' ) {
+    $defaults = array( 
+        'base' => '%_%', // http://example.com/all_posts.php%_% : %_% is replaced by format (below)
+        'format' => '?page=%#%', // ?page=%#% : %#% is replaced by the page number
+        'total' => 1,
+        'current' => 0,
+        'show_all' => false,
+        'prev_next' => true,
+        'prev_text' => __('« Previous'),
+        'next_text' => __('Next »'),
+        'end_size' => 1, // How many numbers on either end including the end
+        'mid_size' => 2, // How many numbers to either side of current not including current
+        'type' => 'plain',
+        'add_args' => false // array of query args to aadd
+    );
+
+    $args = wp_parse_args( $args, $defaults );
+    extract($args, EXTR_SKIP);
 
     // Who knows what else people pass in $args

branches/2.2/wp-includes/link-template.php

@@ -483 +483 @@
     if ( $permalink )
         $qstr = user_trailingslashit($qstr, 'paged');
-    $qstr = preg_replace('/&([^#])(?![a-z]{1,8};)/', '&$1', trailingslashit( get_option('home') ) . $qstr );
 
     // showing /page/1/ or ?paged=1 is redundant
@@ -491 +490 @@
         $qstr = remove_query_arg('paged', $qstr); // for query style
     }
+
+    $qstr = preg_replace('/&([^#])(?![a-z]{1,8};)/', '&$1', trailingslashit( get_option('home') ) . $qstr );
+
     return $qstr;
 }

branches/2.2/wp-includes/pluggable.php

@@ -158 +158 @@
 
 if ( !function_exists( 'wp_mail' ) ) :
-function wp_mail( $to, $subject, $message, $headers = '' ) {
+function wp_mail($to, $subject, $message, $headers = '') {
     global $phpmailer;
-    
-    // (Re)create it, if it's gone missing
-    if ( !is_object( $phpmailer ) || !is_a( $phpmailer, 'PHPMailer' ) ) {
-        require_once ABSPATH . WPINC . '/class-phpmailer.php';
-        require_once ABSPATH . WPINC . '/class-smtp.php';
+
+    if ( !is_object( $phpmailer ) ) {
+        require_once(ABSPATH . WPINC . '/class-phpmailer.php');
+        require_once(ABSPATH . WPINC . '/class-smtp.php');
         $phpmailer = new PHPMailer();
     }
-    
-    // Compact the input, apply the filters, and extract them back out
-    extract( apply_filters( 'wp_mail', compact( 'to', 'subject', 'message', 'headers' ) ) );
-    
-    // Default headers
-    if ( empty( $headers ) ) {
-        $headers = array(
-            'MIME-Version' => '1.0'
-        );
-    } elseif ( !is_array( $headers ) ) {
-        // Explode the headers out, so this function can take both 
-        // string headers and an array of headers.
-        $tempheaders = (array) explode( "\n", $headers );
-        $headers = array();
-        
-        // If it's actually got contents
-        if ( !empty( $tempheaders ) ) {
-            // Iterate through the raw headers
-            foreach ( $tempheaders as $header ) {
-                // Explode them out
-                list( $name, $content ) = explode( ':', trim( $header ), 2 );
-                
-                // Cleanup crew
-                $name = trim( $name );
-                $content = trim( $content );
-                
-                // Mainly for legacy -- process a From: header if it's there
-                if ( $name == 'From' ) {
-                    if ( strpos( '<', $content ) !== false ) {
-                        // So... making my life hard again?
-                        $from_name = substr( $content, 0, strpos( '<', $content ) - 1 );
-                        $from_name = str_replace( '"', '', $from_name );
-                        $from_name = trim( $from_name );
-                        
-                        $from_email = substr( $content, strpos( '<', $content ) + 1 );
-                        $from_email = str_replace( '>', '', $from_email );
-                        $from_email = trim( $from_email );
-                    } else {
-                        $from_name = trim( $content );
-                    }
-                } elseif ( $name == 'Content-Type' ) {
-                    if ( strpos( ';', $content ) !== false ) {
-                        list( $type, $charset ) = explode( ';', $content );
-                        $content_type = trim( $content_type );
-                        $charset = trim( str_replace( array( 'charset=', '"' ), '', $charset ) );
-                    } else {
-                        $content_type = trim( $content );
-                    }
+
+    $mail = compact('to', 'subject', 'message', 'headers');
+    $mail = apply_filters('wp_mail', $mail);
+    extract($mail, EXTR_SKIP);
+
+    if ( $headers == '' ) {
+        $headers = "MIME-Version: 1.0\n" .
+            "From: " . apply_filters('wp_mail_from', "wordpress@" . preg_replace('#^www\.#', '', strtolower($_SERVER['SERVER_NAME']))) . "\n" . 
+            "Content-Type: text/plain; charset=\"" . get_option('blog_charset') . "\"\n";
+    }
+
+    $phpmailer->ClearAddresses();
+    $phpmailer->ClearCCs();
+    $phpmailer->ClearBCCs();
+    $phpmailer->ClearReplyTos();
+    $phpmailer->ClearAllRecipients();
+    $phpmailer->ClearCustomHeaders();
+
+    $phpmailer->FromName = "WordPress";
+    $phpmailer->AddAddress("$to", "");
+    $phpmailer->Subject = $subject;
+    $phpmailer->Body    = $message;
+    $phpmailer->IsHTML(false);
+    $phpmailer->IsMail(); // set mailer to use php mail()
+
+    do_action_ref_array('phpmailer_init', array(&$phpmailer));
+
+    $mailheaders = (array) explode( "\n", $headers );
+    foreach ( $mailheaders as $line ) {
+        $header = explode( ":", $line );
+        switch ( trim( $header[0] ) ) {
+            case "From":
+                $from = trim( str_replace( '"', '', $header[1] ) );
+                if ( strpos( $from, '<' ) ) {
+                    $phpmailer->FromName = str_replace( '"', '', substr( $header[1], 0, strpos( $header[1], '<' ) - 1 ) );
+                    $from = trim( substr( $from, strpos( $from, '<' ) + 1 ) );
+                    $from = str_replace( '>', '', $from );
                 } else {
-                    // Add it to our grand headers array
-                    $headers[trim( $name )] = trim( $content );
+                    $phpmailer->FromName = $from;
                 }
-            }
+                $phpmailer->From = trim( $from );
+                break;
+            default:
+                if ( $line != '' && $header[0] != 'MIME-Version' && $header[0] != 'Content-Type' )
+                    $phpmailer->AddCustomHeader( $line );
+                break;
         }
     }
-    
-    // Empty out the values that may be set
-    $phpmailer->ClearAddresses();
-    $phpmailer->ClearAllRecipients();
-    $phpmailer->ClearAttachments();
-    $phpmailer->ClearBCCs();
-    $phpmailer->ClearCCs();
-    $phpmailer->ClearCustomHeaders();
-    $phpmailer->ClearReplyTos();
-    
-    // From email and name
-    // If we don't have a name from the input headers
-    if ( !isset( $from_name ) ) {
-        $from_name = 'WordPress';
-    }
-    
-    // If we don't have an email from the input headers
-    if ( !isset( $from_email ) ) {
-        // Get the site domain and get rid of www.
-        $sitename = strtolower( $_SERVER['SERVER_NAME'] );
-        if ( substr( $sitename, 0, 4 ) == 'www.' ) {
-            $sitename = substr( $sitename, 4 );
-        }
-        
-        $from_email = 'wordpress@' . $sitename;
-    }
-    
-    // Set the from name and email
-    $phpmailer->From = apply_filters( 'wp_mail_from', $from_email );
-    $phpmailer->FromName = apply_filters( 'wp_mail_from_name', $from_name );
-    
-    // Set destination address
-    $phpmailer->AddAddress( $to );
-    
-    // Set mail's subject and body
-    $phpmailer->Subject = $subject;
-    $phpmailer->Body = $message;
-    
-    // Set to use PHP's mail()
-    $phpmailer->IsMail();
-    
-    // Set Content-Type and charset
-    // If we don't have a content-type from the input headers
-    if ( !isset( $content_type ) ) {
-        $content_type = 'text/plain';
-    }
-    
-    // Set whether it's plaintext or not, depending on $content_type
-    if ( $content_type == 'text/html' ) {
-        $phpmailer->IsHTML( true );
-    } else {
-        $phpmailer->IsHTML( false );
-    }
-    
-    // If we don't have a charset from the input headers
-    if ( !isset( $charset ) ) {
-        $charset = get_bloginfo( 'charset' );
-    }
-    
-    // Set the content-type and charset
-    $phpmailer->ContentType = apply_filters( 'wp_mail_content_type', 'text/plain' );
-    $phpmailer->CharSet = apply_filters( 'wp_mail_charset', $charset );
-    
-    // Set custom headers
-    if ( !empty( $headers ) ) {
-        foreach ( $headers as $name => $content ) {
-            $phpmailer->AddCustomHeader( sprintf( '%1$s: %2$s', $name, $content ) );
-        }
-    }
-    
-    do_action_ref_array( 'phpmailer_init', array( &$phpmailer ) );
-    
-    // Send!
+
     $result = @$phpmailer->Send();
-    
+
     return $result;
 }
@@ -304 +224 @@
 function wp_login($username, $password, $already_md5 = false) {
     global $wpdb, $error;
+
+    $username = sanitize_user($username);
 
     if ( '' == $username )
@@ -399 +321 @@
     $location = wp_kses_no_null($location);
 
+    // remove %0d and %0a from location
     $strip = array('%0d', '%0a');
-    $location = str_replace($strip, '', $location);
+    $found = true;
+    while($found) {
+        $found = false;
+        foreach($strip as $val) {
+            while(strpos($location, $val) !== false) {
+                $found = true;
+                $location = str_replace($val, '', $location);
+            }
+        }
+    }
 
     if ( $is_IIS ) {

branches/2.2/wp-includes/plugin.php

@@ -20 +20 @@
 
     // So the format is wp_filter['tag']['array of priorities']['array of functions serialized']['array of ['array (functions, accepted_args)]']
-    $wp_filter[$tag][$priority][serialize($function_to_add)] = array('function' => $function_to_add, 'accepted_args' => $accepted_args);
+    $wp_filter[$tag][$priority][_wp_filter_build_unique_id($tag, $function_to_add, $priority)] = array('function' => $function_to_add, 'accepted_args' => $accepted_args);
     unset( $merged_filters[ $tag ] );
     return true;
@@ -99 +99 @@
 function remove_filter($tag, $function_to_remove, $priority = 10, $accepted_args = 1) {
     global $wp_filter, $merged_filters;
-
-    unset($GLOBALS['wp_filter'][$tag][$priority][serialize($function_to_remove)]);
+    
+    unset($GLOBALS['wp_filter'][$tag][$priority][_wp_filter_build_unique_id($tag, $function_to_remove, $priority)]);
     unset( $merged_filters[ $tag ] );
 
@@ -236 +236 @@
  */
 function plugin_basename($file) {
-    $file = preg_replace('|\\\\+|', '\\\\', $file);
-    $file = preg_replace('/^.*wp-content[\\\\\/]plugins[\\\\\/]/', '', $file);
+    $file = str_replace('\\','/',$file); // sanitize for Win32 installs
+    $file = preg_replace('|/+|','/', $file); // remove any duplicate slash
+    $file = preg_replace('|^.*/wp-content/plugins/|','',$file); // get relative path from plugins dir
     return $file;
 }
@@ -279 +280 @@
 }
 
+function _wp_filter_build_unique_id($tag, $function, $priority = 10)
+{
+    global $wp_filter;
+    
+    // If function then just skip all of the tests and not overwrite the following.
+    if( is_string($function) )
+        return $function;
+    // Object Class Calling
+    else if(is_object($function[0]) )
+    {
+        $obj_idx = get_class($function[0]).$function[1];
+        if( is_null($function[0]->wp_filter_id) ) {
+            $count = count((array)$wp_filter[$tag][$priority]);
+            $function[0]->wp_filter_id = $count;
+            $obj_idx .= $count;
+            unset($count);
+        } else
+            $obj_idx .= $function[0]->wp_filter_id;
+        return $obj_idx;
+    }
+    // Static Calling
+    else if( is_string($function[0]) )
+        return $function[0].$function[1];
+}
+
 ?>

branches/2.2/wp-includes/post-template.php

@@ -142 +142 @@
             'previouspagelink' => __('Previous page'), 'pagelink' => '%', 'more_file' => '', 'echo' => 1);
     $r = array_merge($defaults, $r);
-    extract($r);
+    extract($r, EXTR_SKIP);
 
     global $id, $page, $numpages, $multipage, $more, $pagenow;
@@ -256 +256 @@
         'name' => 'page_id', 'show_option_none' => '');
     $r = array_merge($defaults, $r);
-    extract($r);
+    extract($r, EXTR_SKIP);
 
     $pages = get_pages($r);

branches/2.2/wp-includes/post.php

@@ -183 +183 @@
         'meta_key' => '', 'meta_value' =>'', 'post_type' => 'post', 'post_status' => 'publish', 'post_parent' => 0);
     $r = array_merge($defaults, $r);
-    extract($r);
+    extract($r, EXTR_SKIP);
     $numberposts = (int) $numberposts;
     $offset = (int) $offset;
@@ -491 +491 @@
 
     // export array as variables
-    extract($postarr);
+    extract($postarr, EXTR_SKIP);
 
     // Are we updating or creating?
@@ -882 +882 @@
 
         // import postdata as variables
-        extract($postdata);
+        extract($postdata, EXTR_SKIP);
 
         // form an excerpt
@@ -1068 +1068 @@
                 'hierarchical' => 1, 'exclude' => '', 'include' => '', 'meta_key' => '', 'meta_value' => '', 'authors' => '');
     $r = array_merge($defaults, $r);
-    extract($r);
+    extract($r, EXTR_SKIP);
 
     $key = md5( serialize( $r ) );
@@ -1222 +1222 @@
 
     // Export array as variables
-    extract($object);
+    extract($object, EXTR_SKIP);
 
     // Get the basics.

branches/2.2/wp-includes/query.php

@@ -414 +414 @@
         $qv = &$this->query_vars;
 
-        if ( ! empty($qv['robots']) ) {
+        if ( ! empty($qv['robots']) )
             $this->is_robots = true;
-            return;
-        }
-
-        if ('404' == $qv['error']) {
-            $this->is_404 = true;
-            if ( !empty($query) ) {
-                do_action_ref_array('parse_query', array(&$this));
-            }
-            return;
-        }
 
         $qv['p'] =  (int) $qv['p'];
@@ -607 +597 @@
         }
 
+        if ( !empty($qv['post_type']) )
+            $qv['post_type'] = sanitize_user($qv['post_type'], true);
+
+        if ( !empty($qv['post_status']) )
+            $qv['post_status'] = sanitize_user($qv['post_status'], true);
+
         if ( $this->is_posts_page && !$qv['withcomments'] )
             $this->is_comment_feed = false;
@@ -612 +608 @@
         $this->is_singular = $this->is_single || $this->is_page || $this->is_attachment;
         // Done correcting is_* for page_on_front and page_for_posts
+
+        if ('404' == $qv['error'])
+            $this->set_404();
 
         if ( !empty($query) )

branches/2.2/wp-includes/registration.php

@@ -33 +33 @@
     global $wpdb;
 
-    extract($userdata);
+    extract($userdata, EXTR_SKIP);
 
     // Are we updating or creating?

branches/2.2/wp-includes/rewrite.php

@@ -136 +136 @@
             // Substitute the substring matches into the query.
             eval("\$query = \"$query\";");
+            // Filter out non-public query vars
+            global $wp;
+            parse_str($query, $query_vars);
+            $query = array();
+            foreach ( $query_vars as $key => $value ) {
+                if ( in_array($key, $wp->public_query_vars) )
+                    $query[$key] = $value;
+            }
+            // Do the query
             $query = new WP_Query($query);
             if ( $query->is_single || $query->is_page )

branches/2.2/wp-includes/rss.php

@@ -10 +10 @@
 define('RSS', 'RSS');
 define('ATOM', 'Atom');
-define('MAGPIE_USER_AGENT', 'WordPress/' . $wp_version);
+define('MAGPIE_USER_AGENT', 'WordPress/' . $GLOBALS['wp_version']);
 
 class MagpieRSS {
@@ -592 +592 @@
 
     if ( !defined('MAGPIE_USER_AGENT') ) {
-        $ua = 'WordPress/' . $wp_version;
+        $ua = 'WordPress/' . $GLOBALS['wp_version'];
 
         if ( MAGPIE_CACHE_ON ) {

branches/2.2/wp-includes/theme.php

@@ -80 +80 @@
     $theme = $name;
     $theme_uri = trim( $theme_uri[1] );
+    $template = trim( $template[1] );
 
     if ( '' == $author_uri[1] ) {

branches/2.2/wp-includes/vars.php

@@ -2 +2 @@
 
 // On which page are we ?
-if ( preg_match('#([^/]+\.php)$#', $PHP_SELF, $self_matches) ) {
+if ( is_admin() ) {
+    // wp-admin pages are checked more carefully
+    preg_match('#/wp-admin/?(.*?)$#i', $PHP_SELF, $self_matches);
     $pagenow = $self_matches[1];
-} elseif ( strpos($PHP_SELF, '?') !== false ) {
-    $pagenow = explode('/', $PHP_SELF);
-    $pagenow = trim($pagenow[(sizeof($pagenow)-1)]);
-    $pagenow = explode('?', $pagenow);
-    $pagenow = $pagenow[0];
+    $pagenow = preg_replace('#\?.*?$#', '', $pagenow);
+    if ( '' === $pagenow || 'index' === $pagenow || 'index.php' === $pagenow ) {
+        $pagenow = 'index.php';
+    } else {
+        preg_match('#(.*?)(/|$)#', $pagenow, $self_matches);
+        $pagenow = strtolower($self_matches[1]);
+        if ( '.php' !== substr($pagenow, -4, 4) )
+            $pagenow .= '.php'; // for Options +Multiviews: /wp-admin/themes/index.php (themes.php is queried)
+    }
 } else {
-    $pagenow = 'index.php';
+    if ( preg_match('#([^/]+\.php)([?/].*?)?$#i', $PHP_SELF, $self_matches) )
+        $pagenow = strtolower($self_matches[1]);
+    else
+        $pagenow = 'index.php';
 }
 

branches/2.2/wp-includes/version.php

@@ -3 +3 @@
 // This holds the version number in a separate file so we can bump it without cluttering the SVN
 
-$wp_version = '2.2.1-beta';
+$wp_version = '2.2.3';
 $wp_db_version = 5183;
 

branches/2.2/wp-includes/widgets.php

@@ -333 +333 @@
     $title = empty( $options['title'] ) ? __( 'Pages' ) : $options['title'];
     $sortby = empty( $options['sortby'] ) ? 'menu_order' : $options['sortby'];
-    $exclude = empty( $options['exclude'] ) ? '' : '&exclude=' . $options['exclude'];
+    $exclude = empty( $options['exclude'] ) ? '' : $options['exclude'];
     
     if ( $sortby == 'menu_order' ) {
@@ -339 +339 @@
     }
     
-    $out = wp_list_pages( 'title_li=&echo=0&sort_column=' . $sortby . $exclude );
+    $out = wp_list_pages( array('title_li' => '', 'echo' => 0, 'sort_column' => $sortby, 'exclude' => $exclude) );
     
     if ( !empty( $out ) ) {
@@ -379 +379 @@
                 <select name="pages-sortby" id="pages-sortby">
                     <option value="post_title"<?php selected( $options['sortby'], 'post_title' ); ?>><?php _e('Page title'); ?></option>
-                    <option value="menu_order"<?php selected( $options['sortby'], 'menu_order' ); ?>><?php _e('Menu order'); ?></option>
+                    <option value="menu_order"<?php selected( $options['sortby'], 'menu_order' ); ?>><?php _e('Page order'); ?></option>
                     <option value="ID"<?php selected( $options['sortby'], 'ID' ); ?>><?php _e( 'Page ID' ); ?></option>
                 </select></label></p>
@@ -390 +390 @@
 function wp_widget_links($args) {
     global $wp_db_version;
-    extract($args);
+    extract($args, EXTR_SKIP);
     if ( $wp_db_version < 3582 ) {
         // This ONLY works with li/h2 sidebars.
@@ -631 +631 @@
     function onCatChange() {
         if ( dropdown.options[dropdown.selectedIndex].value > 0 ) {
-            location.href = "<?php echo get_option('siteurl'); ?>/?cat="+dropdown.options[dropdown.selectedIndex].value;
+            location.href = "<?php echo get_option('home'); ?>/?cat="+dropdown.options[dropdown.selectedIndex].value;
         }
     }
@@ -806 +806 @@
 function wp_widget_rss($args, $number = 1) {
     require_once(ABSPATH . WPINC . '/rss.php');
-    extract($args);
+    extract($args, EXTR_SKIP);
     $options = get_option('widget_rss');
     if ( isset($options['error']) && $options['error'] )
@@ -861 +861 @@
         }
     } else {
-        echo __('<li>An error has occured; the feed is probably down. Try again later.</li>');
+        echo '<li>' . __( 'An error has occurred; the feed is probably down. Try again later.' ) . '</li>';
     }
 ?>

branches/2.2/wp-mail.php

@@ -65 +65 @@
             if (preg_match('/From: /', $line) | preg_match('/Reply-To: /', $line))  {
                 $author=trim($line);
-            if ( ereg("([a-zA-Z0-9\_\-\.]+@[\a-zA-z0-9\_\-\.]+)", $author , $regs) ) {
-                $author = $regs[1];
-                echo "Author = {$author} <p>";
-                $author = $wpdb->escape($author);
-                $result = $wpdb->get_row("SELECT ID FROM $wpdb->users WHERE user_email='$author' LIMIT 1");
-                if (!$result)
+                if ( ereg("([a-zA-Z0-9\_\-\.]+@[\a-zA-z0-9\_\-\.]+)", $author , $regs) ) {
+                    $author = $regs[1];
+                    echo "Author = {$author} <p>";
+                    $author = $wpdb->escape($author);
+                    $result = $wpdb->get_row("SELECT ID FROM $wpdb->users WHERE user_email='$author' LIMIT 1");
+                    if (!$result)
+                        $post_author = 1;
+                    else
+                        $post_author = $result->ID;
+                } else
                     $post_author = 1;
-                else
-                    $post_author = $result->ID;
-            } else
-                $post_author = 1;
             }
 

branches/2.2/wp-settings.php

@@ -49 +49 @@
     $_SERVER['PHP_SELF'] = $PHP_SELF = preg_replace("/(\?.*)?$/",'',$_SERVER["REQUEST_URI"]);
 
-if ( !(phpversion() >= '4.1') )
-    die( 'Your server is running PHP version ' . phpversion() . ' but WordPress requires at least 4.1' );
+if ( !(phpversion() >= '4.2') )
+    die( 'Your server is running PHP version ' . phpversion() . ' but WordPress requires at least 4.2.' );
 
 if ( !extension_loaded('mysql') && !file_exists(ABSPATH . 'wp-content/db.php') )

branches/2.2/xmlrpc.php

@@ -850 +850 @@
         return new IXR_Error(401, __('Sorry, you do not have the right to edit this post.'));
 
-      extract($actual_post);
+      extract($actual_post, EXTR_SKIP);
 
       if ( ('publish' == $post_status) && !current_user_can('publish_posts') )
@@ -930 +930 @@
       }
 
+      $cap = ($publish) ? 'publish_posts' : 'edit_posts';
       $user = set_current_user(0, $user_login);
-      if ( !current_user_can('publish_posts') )
+      if ( !current_user_can($cap) )
         return new IXR_Error(401, __('Sorry, you can not post on this weblog or category.'));
 
@@ -1000 +1001 @@
 
         if(isset($content_struct["mt_allow_comments"])) {
-            switch((int) $content_struct["mt_allow_comments"]) {
-                case 0:
-                    $comment_status = "closed";
-                    break;
-                case 1:
-                    $comment_status = "open";
-                    break;
-                default:
-                    $comment_status = get_option("default_comment_status");
-                    break;
+            if(!is_numeric($content_struct["mt_allow_comments"])) {
+                switch($content_struct["mt_allow_comments"]) {
+                    case "closed":
+                        $comment_status = "closed";
+                        break;
+                    case "open":
+                        $comment_status = "open";
+                        break;
+                    default:
+                        $comment_status = get_option("default_comment_status");
+                        break;
+                }
             }
+            else {
+                switch((int) $content_struct["mt_allow_comments"]) {
+                    case 0:
+                        $comment_status = "closed";
+                        break;
+                    case 1:
+                        $comment_status = "open";
+                        break;
+                    default:
+                        $comment_status = get_option("default_comment_status");
+                        break;
+                }
+            }
+        }
+        else {
+            $comment_status = get_option("default_comment_status");
         }
 
         if(isset($content_struct["mt_allow_pings"])) {
-            switch((int) $content_struct["mt_allow_pings"]) {
-                case 0:
-                    $ping_status = "closed";
-                    break;
-                case 1:
-                    $ping_status = "open";
-                    break;
-                default:
-                    $ping_status = get_option("default_ping_status");
-                    break;
+            if(!is_numeric($content_struct["mt_allow_pings"])) {
+                switch($content_struct["mt_allow_pings"]) {
+                    case "closed":
+                        $ping_status = "closed";
+                        break;
+                    case "open":
+                        $ping_status = "open";
+                        break;
+                    default:
+                        $ping_status = get_option("default_ping_status");
+                        break;
+                }
             }
+            else {
+                switch((int) $content_struct["mt_allow_pings"]) {
+                    case 0:
+                        $ping_status = "closed";
+                        break;
+                    case 1:
+                        $ping_status = "open";
+                        break;
+                    default:
+                        $ping_status = get_option("default_ping_status");
+                        break;
+                }
+            }
+        }
+        else {
+            $ping_status = get_option("default_ping_status");
         }
 
@@ -1127 +1164 @@
         }
 
-      extract($postdata);
         $this->escape($postdata);
+        extract($postdata, EXTR_SKIP);
 
         // Let WordPress manage slug if none was provided.
@@ -1178 +1215 @@
         }
 
-        // Only set ping_status if it was provided.
+        if(isset($content_struct["mt_allow_comments"])) {
+            if(!is_numeric($content_struct["mt_allow_comments"])) {
+                switch($content_struct["mt_allow_comments"]) {
+                    case "closed":
+                        $comment_status = "closed";
+                        break;
+                    case "open":
+                        $comment_status = "open";
+                        break;
+                    default:
+                        $comment_status = get_option("default_comment_status");
+                        break;
+                }
+            }
+            else {
+                switch((int) $content_struct["mt_allow_comments"]) {
+                    case 0:
+                        $comment_status = "closed";
+                        break;
+                    case 1:
+                        $comment_status = "open";
+                        break;
+                    default:
+                        $comment_status = get_option("default_comment_status");
+                        break;
+                }
+            }
+        }
+
         if(isset($content_struct["mt_allow_pings"])) {
-            switch((int) $content_struct["mt_allow_pings"]) {
-                case 0:
-                    $ping_status = "closed";
-                    break;
-                case 1:
-                    $ping_status = "open";
-                    break;
+            if(!is_numeric($content_struct["mt_allow_pings"])) {
+                switch($content_struct["mt_allow_pings"]) {
+                    case "closed":
+                        $ping_status = "closed";
+                        break;
+                    case "open":
+                        $ping_status = "open";
+                        break;
+                    default:
+                        $ping_status = get_option("default_ping_status");
+                        break;
+                }
+            }
+            else {
+                switch((int) $content_struct["mt_allow_pings"]) {
+                    case 0:
+                        $ping_status = "closed";
+                        break;
+                    case 1:
+                        $ping_status = "open";
+                        break;
+                    default:
+                        $ping_status = get_option("default_ping_status");
+                        break;
+                }
             }
         }
@@ -1221 +1304 @@
         $to_ping = implode(' ', $to_ping);
 
-      if(isset($content_struct["mt_allow_comments"])) {
-        $comment_status = (int) $content_struct["mt_allow_comments"];
-      }
-      
       // Do some timestamp voodoo
       $dateCreatedd = $content_struct['dateCreated'];
@@ -1437 +1516 @@
         $bits = $data['bits'];
 
+        logIO('O', '(MW) Received '.strlen($bits).' bytes');
+
+        if ( !$this->login_pass_ok($user_login, $user_pass) )
+            return $this->error;
+
+        set_current_user(0, $user_login);
+        if ( !current_user_can('upload_files') ) {
+            logIO('O', '(MW) User does not have upload_files capability');
+            $this->error = new IXR_Error(401, __('You are not allowed to upload files to this site.'));
+            return $this->error;
+        }
+
+        if ( $upload_err = apply_filters( "pre_upload_error", false ) )
+            return new IXR_Error(500, $upload_err);
+
         if(!empty($data["overwrite"]) && ($data["overwrite"] == true)) {
             // Get postmeta info on the object.
@@ -1454 +1548 @@
             $name = "wpid{$old_file->ID}-{$filename}";
         }
-
-        logIO('O', '(MW) Received '.strlen($bits).' bytes');
-
-        if ( !$this->login_pass_ok($user_login, $user_pass) )
-            return $this->error;
-
-        set_current_user(0, $user_login);
-        if ( !current_user_can('upload_files') ) {
-            logIO('O', '(MW) User does not have upload_files capability');
-            $this->error = new IXR_Error(401, __('You are not allowed to upload files to this site.'));
-            return $this->error;
-        }
-
-        if ( $upload_err = apply_filters( "pre_upload_error", false ) )
-            return new IXR_Error(500, $upload_err);
 
         $upload = wp_upload_bits($name, $type, $bits, $overwrite);