Changeset 1139 for trunk/wp-admin/admin-ajax.php
- Timestamp:
- 10/30/07 16:49:38 (1 year ago)
- Files:
-
- trunk/wp-admin/admin-ajax.php (modified) (18 diffs)
Legend:
- Unmodified
- Added
- Removed
- Modified
- Copied
- Moved
trunk/wp-admin/admin-ajax.php
r1130 r1139 5 5 define('DOING_AJAX', true); 6 6 7 check_ajax_referer(); 7 8 if ( !is_user_logged_in() ) 8 9 die('-1'); … … 11 12 add_action( 'shutdown', 'get_out_now', -1 ); 12 13 14 function wp_ajax_meta_row( $pid, $mid, $key, $value ) { 15 $value = attribute_escape($value); 16 $key_js = addslashes(wp_specialchars($key, 'double')); 17 $key = attribute_escape($key); 18 $r .= "<tr id='meta-$mid'><td valign='top'>"; 19 $r .= "<input name='meta[$mid][key]' tabindex='6' onkeypress='return killSubmit(\"theList.ajaxUpdater('meta','meta-$mid');\",event);' type='text' size='20' value='$key' />"; 20 $r .= "</td><td><textarea name='meta[$mid][value]' tabindex='6' rows='2' cols='30'>$value</textarea></td><td align='center'>"; 21 $r .= "<input name='updatemeta' type='button' class='updatemeta' tabindex='6' value='".attribute_escape(__('Update'))."' onclick='return theList.ajaxUpdater('meta','meta-$mid');' /><br />"; 22 $r .= "<input name='deletemeta[$mid]' type='submit' onclick=\"return deleteSomething( 'meta', $mid, '"; 23 $r .= js_escape(sprintf(__("You are about to delete the '%s' custom field on this post.\n'OK' to delete, 'Cancel' to stop."), $key_js)); 24 $r .= "' );\" class='deletemeta' tabindex='6' value='".attribute_escape(__('Delete'))."' /></td></tr>"; 25 return $r; 26 } 27 13 28 $id = (int) $_POST['id']; 14 switch ( $action = $_POST['action'] ) : 15 case 'add-post' : 16 check_ajax_referer( 'add-post' ); 17 add_filter( 'post_limits', $limit_filter = create_function( '$a', '$b = split(" ",$a); if ( !isset($b[2]) ) return $a; $start = intval(trim($b[1])) / 20 * 15; if ( !is_int($start) ) return $a; $start += intval(trim($b[2])) - 1; return "LIMIT $start, 1";' ) ); 18 wp_edit_posts_query( $_POST ); 19 if ( !have_posts() ) 20 die('1'); 21 $posts_columns = wp_manage_posts_columns(); 22 ob_start(); 23 include( 'edit-post-rows.php' ); 24 $data = ob_get_contents(); 25 ob_end_clean(); 26 if ( !preg_match('|<tbody.+?>(.+)</tbody>|s', $data, $matches) ) 27 my_dump($data); 28 $data = trim($matches[1]); 29 $x = new WP_Ajax_Response( array( 'what' => 'post', 'id' => $id, 'data' => $data ) ); 30 $x->send(); 31 break; 29 switch ( $_POST['action'] ) : 32 30 case 'delete-comment' : 33 check_ajax_referer( "delete-comment_$id" );34 31 if ( !$comment = get_comment( $id ) ) 35 32 die('0'); … … 37 34 die('-1'); 38 35 39 if ( isset($_POST['spam']) && 1 == $_POST['spam'] ) 40 $r = wp_set_comment_status( $comment->comment_ID, 'spam' ); 41 else 42 $r = wp_delete_comment( $comment->comment_ID ); 43 44 die( $r ? '1' : '0' ); 36 if ( wp_delete_comment( $comment->comment_ID ) ) 37 die('1'); 38 else die('0'); 39 break; 40 case 'delete-comment-as-spam' : 41 if ( !$comment = get_comment( $id ) ) 42 die('0'); 43 if ( !current_user_can( 'edit_post', $comment->comment_post_ID ) ) 44 die('-1'); 45 46 if ( wp_set_comment_status( $comment->comment_ID, 'spam' ) ) 47 die('1'); 48 else die('0'); 45 49 break; 46 50 case 'delete-cat' : 47 check_ajax_referer( "delete-category_$id" );48 51 if ( !current_user_can( 'manage_categories' ) ) 49 52 die('-1'); … … 54 57 break; 55 58 case 'delete-link' : 56 check_ajax_referer( "delete-bookmark_$id" );57 59 if ( !current_user_can( 'manage_links' ) ) 58 60 die('-1'); … … 63 65 break; 64 66 case 'delete-meta' : 65 check_ajax_referer( 'change_meta' );66 67 if ( !$meta = get_post_meta_by_id( $id ) ) 67 68 die('0'); … … 73 74 break; 74 75 case 'delete-post' : 75 check_ajax_referer( "{$action}_$id" );76 76 if ( !current_user_can( 'delete_post', $id ) ) 77 77 die('-1'); … … 79 79 if ( wp_delete_post( $id ) ) 80 80 die('1'); 81 else 82 die('0'); 81 else die('0'); 83 82 break; 84 83 case 'delete-page' : 85 check_ajax_referer( "{$action}_$id" );86 84 if ( !current_user_can( 'delete_page', $id ) ) 87 85 die('-1'); … … 100 98 101 99 if ( 'unapproved' == wp_get_comment_status($comment->comment_ID) ) { 102 check_ajax_referer( "approve-comment_$id" );103 100 if ( wp_set_comment_status( $comment->comment_ID, 'approve' ) ) 104 101 die('1'); 105 102 } else { 106 check_ajax_referer( "unapprove-comment_$id" );107 103 if ( wp_set_comment_status( $comment->comment_ID, 'hold' ) ) 108 104 die('1'); … … 111 107 break; 112 108 case 'add-category' : // On the Fly 113 check_ajax_referer( $action );114 109 if ( !current_user_can( 'manage_categories' ) ) 115 110 die('-1'); … … 126 121 'what' => 'category', 127 122 'id' => $cat_id, 128 'data' => "<li id='category-$cat_id'><label for='in-category-$cat_id' class='selectit'><input value='$cat_id' type='checkbox' checked='checked' name='post_category[]' id='in-category-$cat_id'/> $cat_name</label></li>", 129 'position' => -1 123 'data' => "<li id='category-$cat_id'><label for='in-category-$cat_id' class='selectit'><input value='$cat_id' type='checkbox' checked='checked' name='post_category[]' id='in-category-$cat_id'/> $cat_name</label></li>" 130 124 ) ); 131 125 } … … 133 127 break; 134 128 case 'add-link-category' : // On the Fly 135 check_ajax_referer( $action );136 129 if ( !current_user_can( 'manage_categories' ) ) 137 130 die('-1'); … … 144 137 if ( !$cat_id = is_term( $cat_name, 'link_category' ) ) { 145 138 $cat_id = wp_insert_term( $cat_name, 'link_category' ); 139 $cat_id = $cat_id['term_id']; 146 140 } 147 $cat_id = $cat_id['term_id'];148 141 $cat_name = wp_specialchars(stripslashes($cat_name)); 149 142 $x->add( array( 150 143 'what' => 'link-category', 151 144 'id' => $cat_id, 152 'data' => "<li id='link-category-$cat_id'><label for='in-link-category-$cat_id' class='selectit'><input value='$cat_id' type='checkbox' checked='checked' name='link_category[]' id='in-link-category-$cat_id'/> $cat_name</label></li>", 153 'position' => -1 145 'data' => "<li id='link-category-$cat_id'><label for='in-link-category-$cat_id' class='selectit'><input value='$cat_id' type='checkbox' checked='checked' name='link_category[]' id='in-link-category-$cat_id'/> $cat_name</label></li>" 154 146 ) ); 155 147 } … … 157 149 break; 158 150 case 'add-cat' : // From Manage->Categories 159 check_ajax_referer( 'add-category' );160 151 if ( !current_user_can( 'manage_categories' ) ) 161 152 die('-1'); … … 165 156 die('0'); 166 157 $level = 0; 167 $cat_full_name = $cat-> name;158 $cat_full_name = $cat->cat_name; 168 159 $_cat = $cat; 169 while ( $_cat-> parent ) {170 $_cat = get_category( $_cat-> parent );171 $cat_full_name = $_cat-> name . ' — ' . $cat_full_name;160 while ( $_cat->category_parent ) { 161 $_cat = get_category( $_cat->category_parent ); 162 $cat_full_name = $_cat->cat_name . ' — ' . $cat_full_name; 172 163 $level++; 173 164 } … … 176 167 $x = new WP_Ajax_Response( array( 177 168 'what' => 'cat', 178 'id' => $cat-> term_id,169 'id' => $cat->cat_ID, 179 170 'data' => _cat_row( $cat, $level, $cat_full_name ), 180 'supplemental' => array('name' => $cat_full_name, 'show-link' => sprintf(__( 'Category <a href="#%s">%s</a> added' ), "cat-$cat-> term_id", $cat_full_name))171 'supplemental' => array('name' => $cat_full_name, 'show-link' => sprintf(__( 'Category <a href="#%s">%s</a> added' ), "cat-$cat->cat_ID", $cat_full_name)) 181 172 ) ); 182 173 $x->send(); 183 174 break; 184 175 case 'add-comment' : 185 check_ajax_referer( $action );186 176 if ( !current_user_can( 'edit_post', $id ) ) 187 177 die('-1'); 188 178 $search = isset($_POST['s']) ? $_POST['s'] : false; 189 $start = isset($_POST['page']) ? intval($_POST['page']) * 25 - 1: 24;179 $start = isset($_POST['page']) ? intval($_POST['page']) * 25 : 25; 190 180 191 181 list($comments, $total) = _wp_get_comment_list( $search, $start, 1 ); … … 209 199 break; 210 200 case 'add-meta' : 211 check_ajax_referer( 'change_meta' ); 212 $c = 0; 213 $pid = (int) $_POST['post_id']; 214 if ( isset($_POST['addmeta']) ) { 215 if ( !current_user_can( 'edit_post', $pid ) ) 216 die('-1'); 217 if ( $pid < 0 ) { 218 $now = current_time('timestamp', 1); 219 if ( $pid = wp_insert_post( array( 220 'post_title' => sprintf('Draft created on %s at %s', date(get_option('date_format'), $now), date(get_option('time_format'), $now)) 221 ) ) ) { 222 if ( is_wp_error( $pid ) ) { 223 $x = new WP_Ajax_Response( array( 224 'what' => 'meta', 225 'data' => $pid 226 ) ); 227 $x->send(); 228 } 229 $mid = add_meta( $pid ); 230 } else { 231 die('0'); 232 } 233 } else if ( !$mid = add_meta( $pid ) ) { 201 if ( !current_user_can( 'edit_post', $id ) ) 202 die('-1'); 203 if ( $id < 0 ) { 204 $now = current_time('timestamp', 1); 205 if ( $pid = wp_insert_post( array( 206 'post_title' => sprintf('Draft created on %s at %s', date(get_option('date_format'), $now), date(get_option('time_format'), $now)) 207 ) ) ) { 208 if ( is_wp_error( $pid ) ) 209 return $pid; 210 $mid = add_meta( $pid ); 211 } 212 else 234 213 die('0'); 235 } 236 237 $meta = get_post_meta_by_id( $mid ); 238 $pid = (int) $meta->post_id; 239 $meta = get_object_vars( $meta ); 240 $x = new WP_Ajax_Response( array( 241 'what' => 'meta', 242 'id' => $mid, 243 'data' => _list_meta_row( $meta, $c ), 244 'position' => 1, 245 'supplemental' => array('postid' => $pid) 246 ) ); 247 } else { 248 $mid = (int) array_pop(array_keys($_POST['meta'])); 249 $key = $_POST['meta'][$mid]['key']; 250 $value = $_POST['meta'][$mid]['value']; 251 if ( !$meta = get_post_meta_by_id( $mid ) ) 252 die('0'); // if meta doesn't exist 253 if ( !current_user_can( 'edit_post', $meta->post_id ) ) 254 die('-1'); 255 if ( !$u = update_meta( $mid, $key, $value ) ) 256 die('1'); // We know meta exists; we also know it's unchanged (or DB error, in which case there are bigger problems). 214 } else if ( !$mid = add_meta( $id ) ) { 215 die('0'); 216 } 217 218 $meta = get_post_meta_by_id( $mid ); 219 $key = $meta->meta_key; 220 $value = $meta->meta_value; 221 $pid = (int) $meta->post_id; 222 223 $x = new WP_Ajax_Response( array( 224 'what' => 'meta', 225 'id' => $mid, 226 'data' => wp_ajax_meta_row( $pid, $mid, $key, $value ), 227 'supplemental' => array('postid' => $pid) 228 ) ); 229 $x->send(); 230 break; 231 case 'update-meta' : 232 $mid = (int) array_pop(array_keys($_POST['meta'])); 233 $key = $_POST['meta'][$mid]['key']; 234 $value = $_POST['meta'][$mid]['value']; 235 if ( !$meta = get_post_meta_by_id( $mid ) ) 236 die('0'); // if meta doesn't exist 237 if ( !current_user_can( 'edit_post', $meta->post_id ) ) 238 die('-1'); 239 if ( $u = update_meta( $mid, $key, $value ) ) { 257 240 $key = stripslashes($key); 258 241 $value = stripslashes($value); 259 242 $x = new WP_Ajax_Response( array( 260 243 'what' => 'meta', 261 'id' => $mid, 'old_id' => $mid, 262 'data' => _list_meta_row( array( 263 'meta_key' => $key, 264 'meta_value' => $value, 265 'meta_id' => $mid 266 ), $c ), 267 'position' => 0, 244 'id' => $mid, 245 'data' => wp_ajax_meta_row( $meta->post_id, $mid, $key, $value ), 268 246 'supplemental' => array('postid' => $meta->post_id) 269 247 ) ); 270 } 271 $x->send(); 248 $x->send(); 249 } 250 die('1'); // We know meta exists; we also know it's unchanged (or DB error, in which case there are bigger problems). 272 251 break; 273 252 case 'add-user' : 274 check_ajax_referer( $action );275 253 if ( !current_user_can('edit_users') ) 276 254 die('-1'); … … 284 262 } 285 263 $user_object = new WP_User( $user_id ); 286 287 264 $x = new WP_Ajax_Response( array( 288 265 'what' => 'user', 289 266 'id' => $user_id, 290 267 'data' => user_row( $user_object ), 291 'supplemental' => array( 292 'show-link' => sprintf(__( 'User <a href="#%s">%s</a> added' ), "user-$user_id", $user_object->user_login), 293 'role' => $user_object->roles[0] 294 ) 268 'supplemental' => array('show-link' => sprintf(__( 'User <a href="#%s">%s</a> added' ), "user-$user_id", $user_object->user_login)) 295 269 ) ); 296 270 $x->send(); 297 271 break; 298 272 case 'autosave' : // The name of this action is hardcoded in edit_post() 299 check_ajax_referer( $action );300 273 $_POST['post_content'] = $_POST['content']; 301 274 $_POST['post_excerpt'] = $_POST['excerpt']; … … 328 301 break; 329 302 case 'autosave-generate-nonces' : 330 check_ajax_referer( $action );331 303 $ID = (int) $_POST['post_ID']; 332 304 if($_POST['post_type'] == 'post') {
