Changeset 920

Timestamp:

03/19/07 13:04:29 (2 years ago)

Author:

donncha

Message:

WP Merge to rev 5061

Files:

• trunk/wp-admin/admin-functions.php (modified) (7 diffs)
• trunk/wp-admin/admin-header.php (modified) (1 diff)
• trunk/wp-admin/bookmarklet.php (modified) (1 diff)
• trunk/wp-admin/categories.php (modified) (1 diff)
• trunk/wp-admin/edit-comments.php (modified) (6 diffs)
• trunk/wp-admin/edit-form-advanced.php (modified) (1 diff)
• trunk/wp-admin/edit-page-form.php (modified) (1 diff)
• trunk/wp-admin/import/b2.php (deleted)
• trunk/wp-admin/import/blogger.php (modified) (4 diffs)
• trunk/wp-admin/link-manager.php (modified) (1 diff)
• trunk/wp-admin/options-head.php (modified) (1 diff)
• trunk/wp-admin/page.php (modified) (1 diff)
• trunk/wp-admin/post.php (modified) (1 diff)
• trunk/wp-admin/upgrade.php (modified) (2 diffs)
• trunk/wp-admin/upload-functions.php (modified) (2 diffs)
• trunk/wp-admin/upload.php (modified) (1 diff)
• trunk/wp-admin/user-edit.php (modified) (1 diff)
• trunk/wp-comments-post.php (modified) (1 diff)
• trunk/wp-includes/bookmark-template.php (modified) (2 diffs)
• trunk/wp-includes/classes.php (modified) (1 diff)
• trunk/wp-includes/comment-template.php (modified) (1 diff)
• trunk/wp-includes/comment.php (modified) (1 diff)
• trunk/wp-includes/default-filters.php (modified) (1 diff)
• trunk/wp-includes/functions.php (modified) (4 diffs)
• trunk/wp-includes/general-template.php (modified) (5 diffs)
• trunk/wp-includes/link-template.php (modified) (5 diffs)
• trunk/wp-includes/post-template.php (modified) (1 diff)
• trunk/wp-includes/script-loader.php (modified) (1 diff)
• trunk/wp-includes/user.php (modified) (1 diff)
• trunk/xmlrpc.php (modified) (1 diff)

trunk/wp-admin/admin-functions.php

@@ -371 +371 @@
-                $text       = wp_specialchars( stripslashes( urldecode( $_REQUEST['text'] ) ) );
-                $text       = funky_javascript_fix( $text);
-attribute_escape
+clean_url
-        $post_content = '<a href="'.$popupurl.'">'.$post_title.'</a>'."\n$text";
-    }
@@ -430 +430 @@
-        $user->user_login   = attribute_escape($user->user_login);
-        $user->user_email   = attribute_escape($user->user_email);
-attribute_escape
+clean_url
-        $user->first_name   = attribute_escape($user->first_name);
-        $user->last_name    = attribute_escape($user->last_name);
@@ -575 +575 @@
-        $link = get_link( $link_id );
-
-attribute_escape
+clean_url
-        $link->link_name        = attribute_escape($link->link_name);
-        $link->link_image       = attribute_escape($link->link_image);
-        $link->link_description = attribute_escape($link->link_description);
-attribute_escape
+clean_url
-        $link->link_rel         = attribute_escape($link->link_rel);
-        $link->link_notes       =  wp_specialchars($link->link_notes);
@@ -589 +589 @@
-function get_default_link_to_edit() {
-        if ( isset( $_GET['linkurl'] ) )
-attribute_escape
+clean_url
-        else
-                $link->link_url = '';
@@ -808 +808 @@
-
-                if ( ($category->cat_ID != $default_cat_id ) && ($category->cat_ID != $default_link_cat_id ) )
-of its posts will go into the default category of '%s'\nAll of its bookmarks will go into the default category of '%s'
+posts that were only assigned to this category will be assigned to the '%s' category.\nAll links that were only assigned to this category will be assigned to the '%s' category
-                else
-                        $edit .= "<td style='text-align:center'>".__( "Default" );
@@ -892 +892 @@
-        $r .= "</td>\n\t\t<td>";
-        if ( ( is_site_admin() || $current_user->ID == $user_object->ID ) && current_user_can( 'edit_user', $user_object->ID ) ) {
-attribute_escape
+clean_url
-                $r .= "<a href='$edit_link' class='edit'>".__( 'Edit' )."</a>";
-        }
@@ -2101 +2101 @@
-        }
-
-
+
+
+
-        imagecopyresampled( $dst, $src, 0, 0, $src_x, $src_y, $dst_w, $dst_h, $src_w, $src_h );
-

trunk/wp-admin/admin-header.php

@@ -3 +3 @@
-if (!isset($_GET["page"])) require_once('admin.php');
-if ( $editing ) {
-"dbx-admin-key?pagenow=$pagenow"
+'dbx-admin-key?pagenow=' . attribute_escape($pagenow)
-        if ( current_user_can('manage_categories') )
-                wp_enqueue_script( 'ajaxcat' );

trunk/wp-admin/bookmarklet.php

@@ -38 +38 @@
-
-$content  = wp_specialchars($_REQUEST['content']);
-attribute_escape
+clean_url
-if ( !empty($content) ) {
-        $post->post_content = wp_specialchars( stripslashes($_REQUEST['content']) );

trunk/wp-admin/categories.php

@@ -115 +115 @@
-<?php if ( current_user_can('manage_categories') ) : ?>
-<div class="wrap">
- Instead, posts in the deleted category are set to the category <strong>%s</strong> and links
+Instead, posts that were only assigned to the deleted category are set to the category <strong>%s</strong> and links that were only assigned to the deleted category
-</div>
-

trunk/wp-admin/edit-comments.php

@@ -102 +102 @@
-if ( 1 < $page ) {
-        $args['apage'] = ( 1 == $page - 1 ) ? FALSE : $page - 1;
-attribute_escape
+clean_url
-}
-if ( ( $total_pages = ceil( $total / 20 ) ) > 1 ) {
@@ -112 +112 @@
-                        if ( $page_num < 3 || ( $page_num >= $page - 3 && $page_num <= $page + 3 ) || $page_num > $total_pages - 3 ) :
-                                $args['apage'] = ( 1 == $page_num ) ? FALSE : $page_num;
-attribute_escape
+clean_url
-                                $in = true;
-                        elseif ( $in == true ) :
@@ -123 +123 @@
-if ( ( $page ) * 20 < $total || -1 == $total ) {
-        $args['apage'] = $page + 1;
-attribute_escape
+clean_url
-}
-echo "<p class='pagenav'>$r</p>";
@@ -249 +249 @@
-if ( 1 < $page ) {
-        $args['apage'] = ( 1 == $page - 1 ) ? FALSE : $page - 1;
-attribute_escape
+clean_url
-}
-if ( ( $total_pages = ceil( $total / 20 ) ) > 1 ) {
@@ -259 +259 @@
-                        if ( $page_num < 3 || ( $page_num >= $page - 3 && $page_num <= $page + 3 ) || $page_num > $total_pages - 3 ) :
-                                $args['apage'] = ( 1 == $page_num ) ? FALSE : $page_num;
-attribute_escape
+clean_url
-                                $in = true;
-                        elseif ( $in == true ) :
@@ -270 +270 @@
-if ( ( $page ) * 20 < $total || -1 == $total ) {
-        $args['apage'] = $page + 1;
-attribute_escape
+clean_url
-}
-echo "<p class='pagenav'>$r</p>";

trunk/wp-admin/edit-form-advanced.php

@@ -169 +169 @@
-<input name="referredby" type="hidden" id="referredby" value="<?php 
-if ( !empty($_REQUEST['popupurl']) )
-attribute_escape
+clean_url
-else if ( url_to_postid(wp_get_referer()) == $post_ID )
-        echo 'redo';
-else
-attribute_escape
+clean_url
-?>" /></p>
-

trunk/wp-admin/edit-page-form.php

@@ -14 +14 @@
-}
-
-attribute_escape
+clean_url
-
-if ( 0 != $post_ID && $sendto == get_permalink($post_ID) )

trunk/wp-admin/import/blogger.php

@@ -85 +85 @@
-                        $headers = array(
-                                "GET /feeds/default/blogs HTTP/1.0",
-
+2
-                                "Authorization: AuthSub token=\"$this->token\""
-                        );
@@ -548 +548 @@
-
-                $comment_post_ID = $this->blogs[$importing_blog]['posts'][$entry->old_post_permalink];
-
+
+
+
-                $comment_date    = $this->convert_date( $entry->updated );
-                $comment_content = addslashes( $this->no_apos( html_entity_decode( $entry->content ) ) );
@@ -564 +566 @@
-                        ++$this->blogs[$importing_blog]['comments_skipped'];
-                } else {
-
+author_url', 'comment_
-
-                        $comment_id = wp_insert_comment($comment);
@@ -673 +675 @@
-        }
-
-
+2
-                if ( !$sock = @ fsockopen($host, 80, $errno, $errstr) ) {
-                        $this->uh_oh(

trunk/wp-admin/link-manager.php

@@ -134 +134 @@
-                $link->link_name = attribute_escape(apply_filters('link_title', $link->link_name));
-                $link->link_description = wp_specialchars(apply_filters('link_description', $link->link_description));
-attribute_escape
+clean_url
-                $link->link_category = wp_get_link_cats($link->link_id);
-                $short_url = str_replace('http://', '', $link->link_url);

trunk/wp-admin/options-head.php

@@ -1 +1 @@
-<?php wp_reset_vars(array('action', 'standalone', 'option_group_id')); ?>
-
-<br clear="all" />
-
-<?php if (isset($_GET['updated'])) : ?>

trunk/wp-admin/page.php

@@ -66 +66 @@
-        <div id='preview' class='wrap'>
-        <h2 id="preview-post"><?php _e('Page Preview (updated when page is saved)'); ?></h2>
-attribute_escape
+clean_url
-        </div>
-        <?php

trunk/wp-admin/post.php

@@ -70 +70 @@
-        <div id='preview' class='wrap'>
-        <h2 id="preview-post"><?php _e('Post Preview (updated when post is saved)'); ?></h2>
-attribute_escape
+clean_url
-        </div>
-        <?php

trunk/wp-admin/upgrade.php

@@ -36 +36 @@
-switch($step) :
-        case 0:
-attribute_escape
+clean_url
-?>
-<h2><?php _e('Database Upgrade Required'); ?></h2>
@@ -50 +50 @@
-                        $backto = __get_option('home') . '/';
-                else
-attribute_escape
+clean_url
-                if( $wpdb->get_row( "SELECT blog_id FROM wp_blog_versions WHERE blog_id = '{$wpdb->blogid}'" ) ) {
-                        $wpdb->query( "UPDATE wp_blog_versions SET db_version = '{$wp_db_version}' WHERE blog_id = '{$wpdb->blogid}'" );

trunk/wp-admin/upload-functions.php

@@ -84 +84 @@
-                                echo '<a href="' . get_permalink() . '">' . __('view') . '</a>';
-                                echo '&nbsp;|&nbsp;';
-attribute_escape
+clean_url
-                                echo '&nbsp;|&nbsp;';
-attribute_escape
+clean_url
-                                echo '&nbsp;]'; ?></span>
-                </div>
@@ -124 +124 @@
-                                echo '<a href="' . get_permalink() . '">' . __('view') . '</a>';
-                                echo '&nbsp;|&nbsp;';
-attribute_escape
+clean_url
-                                echo '&nbsp;|&nbsp;';
-attribute_escape
+clean_url
-                                echo '&nbsp;]'; ?></span>
-                </div>

trunk/wp-admin/upload.php

@@ -91 +91 @@
-        if ( isset($tab_array[4]) && is_array($tab_array[4]) )
-                add_query_arg( $tab_array[4], $href );
-attribute_escape
+clean_url
-        $page_links = '';
-        $class = 'upload-tab alignleft';

trunk/wp-admin/user-edit.php

@@ -62 +62 @@
-        <p><strong><?php _e('User updated.') ?></strong></p>
-        <?php if ( $wp_http_referer ) : ?>
-attribute_escape
+clean_url
-        <?php endif; ?>
-</div>

trunk/wp-comments-post.php

@@ -26 +26 @@
-// If the user is logged in
-$user = wp_get_current_user();
-:
+{
-        $comment_author       = $wpdb->escape($user->display_name);
-        $comment_author_email = $wpdb->escape($user->user_email);
-        $comment_author_url   = $wpdb->escape($user->user_url);
-
+
+
+
+
+
+
+
-        if ( get_option('comment_registration') )
-                wp_die( __('Sorry, you must be logged in to post a comment.') );
-
+
-
-$comment_type = '';

trunk/wp-includes/bookmark-template.php

@@ -97 +97 @@
-                $the_link = '#';
-                if ( !empty($row->link_url) )
-wp_specialchars
+clean_url
-                $rel = $row->link_rel;
-                if ( '' != $rel )
@@ -261 +261 @@
-                $the_link = '#';
-                if ( !empty($bookmark->link_url) )
-wp_specialchars
+clean_url
-
-                $rel = $bookmark->link_rel;

trunk/wp-includes/classes.php

@@ -150 +150 @@
-                                $this->query_vars[$wpvar] = $perma_query_vars[$wpvar];
-
-( empty( $this->query_vars[$wpvar] ) == false
+ ( !empty( $this->query_vars[$wpvar] )
-                                $this->query_vars[$wpvar] = (string) $this->query_vars[$wpvar];
-                }

trunk/wp-includes/comment-template.php

@@ -272 +272 @@
-}
-
+function wp_comment_form_unfiltered_html_nonce() {
+        global $post;
+        if ( current_user_can('unfiltered_html') )
+                wp_nonce_field('unfiltered-html-comment_' . $post->ID, '_wp_unfiltered_html_comment', false);
+}
+
-function comments_template( $file = '/comments.php' ) {
-        global $wp_query, $withcomments, $post, $wpdb, $id, $comment, $user_login, $user_ID, $user_identity;

trunk/wp-includes/comment.php

@@ -170 +170 @@
-                $comment_author_url = apply_filters('pre_comment_author_url', $_COOKIE['comment_author_url_'.COOKIEHASH]);
-                $comment_author_url = stripslashes($comment_author_url);
-attribute_escape
+clean_url
-                $_COOKIE['comment_author_url_'.COOKIEHASH] = $comment_author_url;
-        }

trunk/wp-includes/default-filters.php

@@ -31 +31 @@
-add_filter('pre_comment_author_email', 'wp_filter_kses');
-add_filter('pre_comment_author_url', 'wp_filter_kses');
+
+add_action('comment_form', 'wp_comment_form_unfiltered_html_nonce');
-
-// Default filters for these functions

trunk/wp-includes/functions.php

@@ -1020 +1020 @@
-}
-
-
-
-
+
+
+
+
+
-}
-
@@ -1290 +1292 @@
-        $adminurl = get_option('siteurl') . '/wp-admin';
-        if ( wp_get_referer() )
-attribute_escape
+clean_url
-
-        $title = __('WordPress Confirmation');
@@ -1298 +1300 @@
-                $q = http_build_query($_POST);
-                $q = explode( ini_get('arg_separator.output'), $q);
-$pagenow
+" . attribute_escape($pagenow) . "
-                foreach ( (array) $q as $a ) {
-                        $v = substr(strstr($a, '='), 1);
@@ -1307 +1309 @@
-                $html .= "\t\t<div id='message' class='confirm fade'>\n\t\t<p>" . wp_specialchars(wp_explain_nonce($action)) . "</p>\n\t\t<p><a href='$adminurl'>" . __('No') . "</a> <input type='submit' value='" . __('Yes') . "' /></p>\n\t\t</div>\n\t</form>\n";
-        } else {
-attribute_escape
+clean_url
-        }
-        $html .= "</body>\n</html>";

trunk/wp-includes/general-template.php

@@ -298 +298 @@
-        $text = wptexturize($text);
-        $title_text = attribute_escape($text);
+        $url = clean_url($url);
-
-        if ('link' == $format)
@@ -416 +417 @@
-        } elseif ( ( 'postbypost' == $type ) || ('alpha' == $type) ) {
-                ('alpha' == $type) ? $orderby = "post_title ASC " : $orderby = "post_date DESC ";
-
+ORDER BY 
-                if ( $arcresults ) {
-                        foreach ( $arcresults as $arcresult ) {
@@ -987 +988 @@
-                if ( $add_args )
-                        $link = add_query_arg( $add_args, $link );
-attribute_escape
+clean_url
-        endif;
-        for ( $n = 1; $n <= $total; $n++ ) :
@@ -999 +1000 @@
-                                if ( $add_args )
-                                        $link = add_query_arg( $add_args, $link );
-attribute_escape
+clean_url
-                                $dots = true;
-                        elseif ( $dots && !$show_all ) :
@@ -1012 +1013 @@
-                if ( $add_args )
-                        $link = add_query_arg( $add_args, $link );
-attribute_escape
+clean_url
-        endif;
-        switch ( $type ) :

trunk/wp-includes/link-template.php

@@ -423 +423 @@
-        global $wp_rewrite;
-
-wp_specialchars($_SERVER['REQUEST_URI'])
+$_SERVER['REQUEST_URI']
-
-        $page_querystring = "paged";
@@ -491 +491 @@
-}
-
-next_posts($max_page = 0) { // original by cfactor at cooltux.org
+get_next_posts_page_link($max_page = 0) {
-        global $paged, $pagenow;
-
@@ -499 +499 @@
-                $nextpage = intval($paged) + 1;
-                if ( !$max_page || $max_page >= $nextpage )
-
-
+
+
+
+
+
+
-}
-
@@ -518 +522 @@
-}
-
-
-
+
-        global $paged, $pagenow;
-
@@ -526 +529 @@
-                if ( $nextpage < 1 )
-                        $nextpage = 1;
-
-
-
-
+
+
+
+
+
+
+
-
-function previous_posts_link($label='&laquo; Previous Page') {

trunk/wp-includes/post-template.php

@@ -282 +282 @@
-
-        $defaults = array('depth' => 0, 'show_date' => '', 'date_format' => get_option('date_format'),
-
+, 'sort_column' => 'menu_order, post_title'
-        $r = array_merge($defaults, $r);
-

trunk/wp-includes/script-loader.php

@@ -151 +151 @@
-                                        $src = 0 === strpos($this->scripts[$handle]->src, 'http://') ? $this->scripts[$handle]->src : get_option( 'siteurl' ) . $this->scripts[$handle]->src;
-                                        $src = add_query_arg('ver', $ver, $src);
-attribute_escape
+clean_url
-                                        echo "<script type='text/javascript' src='$src'></script>\n";
-                                        $this->print_scripts_l10n( $handle );

trunk/wp-includes/user.php

@@ -10 +10 @@
-function get_usernumposts($userid) {
-        global $wpdb;
+        $userid = (int) $userid;
-        return $wpdb->get_var("SELECT COUNT(*) FROM $wpdb->posts WHERE post_author = '$userid' AND post_type = 'post' AND post_status = 'publish'");
-}

trunk/xmlrpc.php

@@ -1429 +1429 @@
-                $upload = wp_upload_bits($name, $type, $bits, $overwrite);
-                if ( ! empty($upload['error']) ) {
-
-
+
+
+
-                }
-                // Construct the attachment array