IntenseWebs/WordPress
3
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

s/attribute_escape/attr/. see #9650

Browse Source 
git-svn-id: http://svn.automattic.com/wordpress/trunk@11109 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This commit is contained in:
ryan
2009-04-28 05:58:45 +00:00
parent 430a8cb2cf
commit 2d489767bb
84 changed files with 391 additions and 391 deletions
Download Patch File Download Diff File Expand all files Collapse all files
wp-admin/includes/bookmark.php
+1 -1
View File
@@ -59,7 +59,7 @@ function get_default_link_to_edit() {
$link->link_url = '';
if ( isset( $_GET['name'] ) )
$link->link_name = attribute_escape( $_GET['name']);
$link->link_name = attr( $_GET['name']);
else
$link->link_name = '';
wp-admin/includes/class-wp-upgrader.php
+12 -12
View File
@@ -820,8 +820,8 @@ class Plugin_Upgrader_Skin extends WP_Upgrader_Skin {
echo '<iframe style="border:0;overflow:hidden" width="100%" height="170px" src="' . wp_nonce_url('update.php?action=activate-plugin&plugin=' . $this->plugin, 'activate-plugin_' . $this->plugin) .'"></iframe>';
}
$update_actions = array(
'activate_plugin' => '<a href="' . wp_nonce_url('plugins.php?action=activate&amp;plugin=' . $this->plugin, 'activate-plugin_' . $this->plugin) . '" title="' . attribute_escape(__('Activate this plugin')) . '" target="_parent">' . __('Activate Plugin') . '</a>',
'plugins_page' => '<a href="' . admin_url('plugins.php') . '" title="' . attribute_escape(__('Goto plugins page')) . '" target="_parent">' . __('Return to Plugins page') . '</a>'
'activate_plugin' => '<a href="' . wp_nonce_url('plugins.php?action=activate&amp;plugin=' . $this->plugin, 'activate-plugin_' . $this->plugin) . '" title="' . attr(__('Activate this plugin')) . '" target="_parent">' . __('Activate Plugin') . '</a>',
'plugins_page' => '<a href="' . admin_url('plugins.php') . '" title="' . attr(__('Goto plugins page')) . '" target="_parent">' . __('Return to Plugins page') . '</a>'
);
if ( $this->plugin_active )
unset( $update_actions['activate_plugin'] );
@@ -871,13 +871,13 @@ class Plugin_Installer_Skin extends WP_Upgrader_Skin {
$plugin_file = $this->upgrader->plugin_info();
$install_actions = array(
'activate_plugin' => '<a href="' . wp_nonce_url('plugins.php?action=activate&amp;plugin=' . $plugin_file, 'activate-plugin_' . $plugin_file) . '" title="' . attribute_escape(__('Activate this plugin')) . '" target="_parent">' . __('Activate Plugin') . '</a>',
'activate_plugin' => '<a href="' . wp_nonce_url('plugins.php?action=activate&amp;plugin=' . $plugin_file, 'activate-plugin_' . $plugin_file) . '" title="' . attr(__('Activate this plugin')) . '" target="_parent">' . __('Activate Plugin') . '</a>',
);
if ( $this->type == 'web' )
$install_actions['plugins_page'] = '<a href="' . admin_url('plugin-install.php') . '" title="' . attribute_escape(__('Return to Plugin Installer')) . '" target="_parent">' . __('Return to Plugin Installer') . '</a>';
$install_actions['plugins_page'] = '<a href="' . admin_url('plugin-install.php') . '" title="' . attr(__('Return to Plugin Installer')) . '" target="_parent">' . __('Return to Plugin Installer') . '</a>';
else
$install_actions['plugins_page'] = '<a href="' . admin_url('plugins.php') . '" title="' . attribute_escape(__('Return to Plugins page')) . '" target="_parent">' . __('Return to Plugins page') . '</a>';
$install_actions['plugins_page'] = '<a href="' . admin_url('plugins.php') . '" title="' . attr(__('Return to Plugins page')) . '" target="_parent">' . __('Return to Plugins page') . '</a>';
if ( ! $this->result || is_wp_error($this->result) )
@@ -936,14 +936,14 @@ class Theme_Installer_Skin extends WP_Upgrader_Skin {
$activate_link = wp_nonce_url("themes.php?action=activate&amp;template=" . urlencode($template) . "&amp;stylesheet=" . urlencode($stylesheet), 'switch-theme_' . $template);
$install_actions = array(
'preview' => '<a href="' . $preview_link . '" class="thickbox thickbox-preview" title="' . attribute_escape(sprintf(__('Preview "%s"'), $name)) . '">' . __('Preview') . '</a>',
'activate' => '<a href="' . $activate_link . '" class="activatelink" title="' . attribute_escape( sprintf( __('Activate "%s"'), $name ) ) . '">' . __('Activate') . '</a>'
'preview' => '<a href="' . $preview_link . '" class="thickbox thickbox-preview" title="' . attr(sprintf(__('Preview "%s"'), $name)) . '">' . __('Preview') . '</a>',
'activate' => '<a href="' . $activate_link . '" class="activatelink" title="' . attr( sprintf( __('Activate "%s"'), $name ) ) . '">' . __('Activate') . '</a>'
);
if ( $this->type == 'web' )
$install_actions['themes_page'] = '<a href="' . admin_url('theme-install.php') . '" title="' . attribute_escape(__('Back to Theme Installer')) . '" target="_parent">' . __('Return to Theme Installer.') . '</a>';
$install_actions['themes_page'] = '<a href="' . admin_url('theme-install.php') . '" title="' . attr(__('Back to Theme Installer')) . '" target="_parent">' . __('Return to Theme Installer.') . '</a>';
else
$install_actions['themes_page'] = '<a href="' . admin_url('themes.php') . '" title="' . attribute_escape(__('Themes page')) . '" target="_parent">' . __('Return to Themes page') . '</a>';
$install_actions['themes_page'] = '<a href="' . admin_url('themes.php') . '" title="' . attr(__('Themes page')) . '" target="_parent">' . __('Return to Themes page') . '</a>';
if ( ! $this->result || is_wp_error($this->result) )
unset( $install_actions['activate'], $install_actions['preview'] );
@@ -995,9 +995,9 @@ class Theme_Upgrader_Skin extends WP_Upgrader_Skin {
$activate_link = wp_nonce_url("themes.php?action=activate&amp;template=" . urlencode($template) . "&amp;stylesheet=" . urlencode($stylesheet), 'switch-theme_' . $template);
$update_actions = array(
'preview' => '<a href="' . $preview_link . '" class="thickbox thickbox-preview" title="' . attribute_escape(sprintf(__('Preview "%s"'), $name)) . '">' . __('Preview') . '</a>',
'activate' => '<a href="' . $activate_link . '" class="activatelink" title="' . attribute_escape( sprintf( __('Activate "%s"'), $name ) ) . '">' . __('Activate') . '</a>',
'themes_page' => '<a href="' . admin_url('themes.php') . '" title="' . attribute_escape(__('Return to Themes page')) . '" target="_parent">' . __('Return to Themes page') . '</a>',
'preview' => '<a href="' . $preview_link . '" class="thickbox thickbox-preview" title="' . attr(sprintf(__('Preview "%s"'), $name)) . '">' . __('Preview') . '</a>',
'activate' => '<a href="' . $activate_link . '" class="activatelink" title="' . attr( sprintf( __('Activate "%s"'), $name ) ) . '">' . __('Activate') . '</a>',
'themes_page' => '<a href="' . admin_url('themes.php') . '" title="' . attr(__('Return to Themes page')) . '" target="_parent">' . __('Return to Themes page') . '</a>',
);
if ( ( ! $this->result || is_wp_error($this->result) ) || $stylesheet == get_stylesheet() )
unset($update_actions['preview'], $update_actions['activate']);
wp-admin/includes/dashboard.php
+5 -5
View File
@@ -371,7 +371,7 @@ function wp_dashboard_quick_press() {
<form name="post" action="<?php echo clean_url( admin_url( 'post.php' ) ); ?>" method="post" id="quick-press">
<h4 id="quick-post-title"><label for="title"><?php _e('Title') ?></label></h4>
<div class="input-text-wrap">
<input type="text" name="post_title" id="title" tabindex="1" autocomplete="off" value="<?php echo attribute_escape( $post->post_title ); ?>" />
<input type="text" name="post_title" id="title" tabindex="1" autocomplete="off" value="<?php echo attr( $post->post_title ); ?>" />
</div>
<?php if ( current_user_can( 'upload_files' ) ) : ?>
@@ -432,7 +432,7 @@ function wp_dashboard_recent_drafts( $drafts = false ) {
foreach ( $drafts as $draft ) {
$url = get_edit_post_link( $draft->ID );
$title = _draft_or_post_title( $draft->ID );
$item = "<h4><a href='$url' title='" . sprintf( __( 'Edit "%s"' ), attribute_escape( $title ) ) . "'>$title</a> <abbr title='" . get_the_time(__('Y/m/d g:i:s A'), $draft) . "'>" . get_the_time( get_option( 'date_format' ), $draft ) . '</abbr></h4>';
$item = "<h4><a href='$url' title='" . sprintf( __( 'Edit "%s"' ), attr( $title ) ) . "'>$title</a> <abbr title='" . get_the_time(__('Y/m/d g:i:s A'), $draft) . "'>" . get_the_time( get_option( 'date_format' ), $draft ) . '</abbr></h4>';
if ( $the_content = preg_split( '#\s#', strip_tags( $draft->post_content ), 11, PREG_SPLIT_NO_EMPTY ) )
$item .= '<p>' . join( ' ', array_slice( $the_content, 0, 10 ) ) . ( 10 < count( $the_content ) ? '&hellip;' : '' ) . '</p>';
$list[] = $item;
@@ -579,9 +579,9 @@ function _wp_dashboard_recent_comments_row( &$comment, $show_date = true ) {
<div id="inline-<?php echo $comment->comment_ID; ?>" class="hidden">
<textarea class="comment" rows="3" cols="10"><?php echo $comment->comment_content; ?></textarea>
<div class="author-email"><?php echo attribute_escape( $comment->comment_author_email ); ?></div>
<div class="author"><?php echo attribute_escape( $comment->comment_author ); ?></div>
<div class="author-url"><?php echo attribute_escape( $comment->comment_author_url ); ?></div>
<div class="author-email"><?php echo attr( $comment->comment_author_email ); ?></div>
<div class="author"><?php echo attr( $comment->comment_author ); ?></div>
<div class="author-url"><?php echo attr( $comment->comment_author_url ); ?></div>
<div class="comment_status"><?php echo $comment->comment_approved; ?></div>
</div>
</div>
wp-admin/includes/file.php
+5 -5
View File
@@ -731,12 +731,12 @@ jQuery(function($){
<table class="form-table">
<tr valign="top">
<th scope="row"><label for="hostname"><?php _e('Hostname') ?></label></th>
<td><input name="hostname" type="text" id="hostname" value="<?php echo attribute_escape($hostname); if ( !empty($port) ) echo ":$port"; ?>"<?php if( defined('FTP_HOST') ) echo ' disabled="disabled"' ?> size="40" /></td>
<td><input name="hostname" type="text" id="hostname" value="<?php echo attr($hostname); if ( !empty($port) ) echo ":$port"; ?>"<?php if( defined('FTP_HOST') ) echo ' disabled="disabled"' ?> size="40" /></td>
</tr>
<tr valign="top">
<th scope="row"><label for="username"><?php _e('Username') ?></label></th>
<td><input name="username" type="text" id="username" value="<?php echo attribute_escape($username) ?>"<?php if( defined('FTP_USER') ) echo ' disabled="disabled"' ?> size="40" /></td>
<td><input name="username" type="text" id="username" value="<?php echo attr($username) ?>"<?php if( defined('FTP_USER') ) echo ' disabled="disabled"' ?> size="40" /></td>
</tr>
<tr valign="top">
@@ -750,7 +750,7 @@ jQuery(function($){
<label for="public_key"><?php _e('Public Key:') ?></label ><br />
<label for="private_key"><?php _e('Private Key:') ?></label>
</div></th>
<td><br /><input name="public_key" type="text" id="public_key" value="<?php echo attribute_escape($public_key) ?>"<?php if( defined('FTP_PUBKEY') ) echo ' disabled="disabled"' ?> size="40" /><br /><input name="private_key" type="text" id="private_key" value="<?php echo attribute_escape($private_key) ?>"<?php if( defined('FTP_PRIKEY') ) echo ' disabled="disabled"' ?> size="40" />
<td><br /><input name="public_key" type="text" id="public_key" value="<?php echo attr($public_key) ?>"<?php if( defined('FTP_PUBKEY') ) echo ' disabled="disabled"' ?> size="40" /><br /><input name="private_key" type="text" id="private_key" value="<?php echo attr($private_key) ?>"<?php if( defined('FTP_PRIKEY') ) echo ' disabled="disabled"' ?> size="40" />
<div><?php _e('Enter the location on the server where the keys are located. If a passphrase is needed, enter that in the password field above.') ?></div></td>
</tr>
@@ -767,10 +767,10 @@ jQuery(function($){
</table>
<?php if ( isset( $_POST['version'] ) ) : ?>
<input type="hidden" name="version" value="<?php echo attribute_escape($_POST['version']) ?>" />
<input type="hidden" name="version" value="<?php echo attr($_POST['version']) ?>" />
<?php endif; ?>
<?php if ( isset( $_POST['locale'] ) ) : ?>
<input type="hidden" name="locale" value="<?php echo attribute_escape($_POST['locale']) ?>" />
<input type="hidden" name="locale" value="<?php echo attr($_POST['locale']) ?>" />
<?php endif; ?>
<p class="submit">
<input id="upgrade" name="upgrade" type="submit" class="button" value="<?php _e('Proceed'); ?>" />
wp-admin/includes/manifest.php
+1 -1
View File
@@ -26,7 +26,7 @@ function add_filter() {}
/**
* @ignore
*/
function attribute_escape() {}
function attr() {}
/**
* @ignore
wp-admin/includes/media.php
+41 -41
View File
@@ -78,7 +78,7 @@ function the_media_upload_tabs() {
$class = " class='current'";
$href = add_query_arg(array('tab'=>$callback, 's'=>false, 'paged'=>false, 'post_mime_type'=>false, 'm'=>false));
$link = "<a href='" . clean_url($href) . "'$class>$text</a>";
echo "\t<li id='" . attribute_escape("tab-$callback") . "'>$link</li>\n";
echo "\t<li id='" . attr("tab-$callback") . "'>$link</li>\n";
}
echo "</ul>\n";
}
@@ -104,7 +104,7 @@ function get_image_send_to_editor($id, $alt, $title, $align, $url='', $rel = fal
$html = get_image_tag($id, $htmlalt, $title, $align, $size);
$rel = $rel ? ' rel="attachment wp-att-'.attribute_escape($id).'"' : '';
$rel = $rel ? ' rel="attachment wp-att-'.attr($id).'"' : '';
if ( $url )
$html = '<a href="' . clean_url($url) . "\"$rel>$html</a>";
@@ -424,7 +424,7 @@ function media_upload_form_handler() {
$html = $attachment['post_title'];
if ( !empty($attachment['url']) ) {
if ( strpos($attachment['url'], 'attachment_id') || false !== strpos($attachment['url'], get_permalink($_POST['post_id'])) )
$rel = " rel='attachment wp-att-".attribute_escape($send_id)."'";
$rel = " rel='attachment wp-att-".attr($send_id)."'";
$html = "<a href='{$attachment['url']}'$rel>$html</a>";
}
$html = apply_filters('media_send_to_editor', $html, $send_id, $attachment);
@@ -459,9 +459,9 @@ function media_upload_image() {
$src = $_POST['insertonly']['src'];
if ( !empty($src) && !strpos($src, '://') )
$src = "http://$src";
$alt = attribute_escape($_POST['insertonly']['alt']);
$alt = attr($_POST['insertonly']['alt']);
if ( isset($_POST['insertonly']['align']) ) {
$align = attribute_escape($_POST['insertonly']['align']);
$align = attr($_POST['insertonly']['align']);
$class = " class='align$align'";
}
if ( !empty($src) )
@@ -553,7 +553,7 @@ function media_upload_audio() {
$href = $_POST['insertonly']['href'];
if ( !empty($href) && !strpos($href, '://') )
$href = "http://$href";
$title = attribute_escape($_POST['insertonly']['title']);
$title = attr($_POST['insertonly']['title']);
if ( empty($title) )
$title = basename($href);
if ( !empty($title) && !empty($href) )
@@ -607,7 +607,7 @@ function media_upload_video() {
$href = $_POST['insertonly']['href'];
if ( !empty($href) && !strpos($href, '://') )
$href = "http://$href";
$title = attribute_escape($_POST['insertonly']['title']);
$title = attr($_POST['insertonly']['title']);
if ( empty($title) )
$title = basename($href);
if ( !empty($title) && !empty($href) )
@@ -661,7 +661,7 @@ function media_upload_file() {
$href = $_POST['insertonly']['href'];
if ( !empty($href) && !strpos($href, '://') )
$href = "http://$href";
$title = attribute_escape($_POST['insertonly']['title']);
$title = attr($_POST['insertonly']['title']);
if ( empty($title) )
$title = basename($href);
if ( !empty($title) && !empty($href) )
@@ -825,10 +825,10 @@ function image_link_input_fields($post, $url_type='') {
elseif ( $url_type == 'post' )
$url = $link;
return "<input type='text' class='urlfield' name='attachments[$post->ID][url]' value='" . attribute_escape($url) . "' /><br />
return "<input type='text' class='urlfield' name='attachments[$post->ID][url]' value='" . attr($url) . "' /><br />
<button type='button' class='button urlnone' title=''>" . __('None') . "</button>
<button type='button' class='button urlfile' title='" . attribute_escape($file) . "'>" . __('File URL') . "</button>
<button type='button' class='button urlpost' title='" . attribute_escape($link) . "'>" . __('Post URL') . "</button>
<button type='button' class='button urlfile' title='" . attr($file) . "'>" . __('File URL') . "</button>
<button type='button' class='button urlpost' title='" . attr($link) . "'>" . __('Post URL') . "</button>
";
}
@@ -988,7 +988,7 @@ function get_attachment_fields_to_edit($post, $errors = null) {
'image_url' => array(
'label' => __('File URL'),
'input' => 'html',
'html' => "<input type='text' class='urlfield' readonly='readonly' name='attachments[$post->ID][url]' value='" . attribute_escape($image_url) . "' /><br />",
'html' => "<input type='text' class='urlfield' readonly='readonly' name='attachments[$post->ID][url]' value='" . attr($image_url) . "' /><br />",
'value' => isset($edit_post->post_url) ? $edit_post->post_url : '',
'helps' => __('Location of the uploaded file.'),
)
@@ -1085,19 +1085,19 @@ function get_media_item( $attachment_id, $args = null ) {
$post = get_post($attachment_id);
$filename = basename($post->guid);
$title = attribute_escape($post->post_title);
$title = attr($post->post_title);
if ( $_tags = get_the_tags($attachment_id) ) {
foreach ( $_tags as $tag )
$tags[] = $tag->name;
$tags = attribute_escape(join(', ', $tags));
$tags = attr(join(', ', $tags));
}
$type = '';
if ( isset($post_mime_types) ) {
$keys = array_keys(wp_match_mime_types(array_keys($post_mime_types), $post->post_mime_type));
$type = array_shift($keys);
$type = "<input type='hidden' id='type-of-$attachment_id' value='" . attribute_escape( $type ) . "' />";
$type = "<input type='hidden' id='type-of-$attachment_id' value='" . attr( $type ) . "' />";
}
$form_fields = get_attachment_fields_to_edit($post, $errors);
@@ -1156,7 +1156,7 @@ function get_media_item( $attachment_id, $args = null ) {
$delete_href = wp_nonce_url("post.php?action=delete-post&amp;post=$attachment_id", 'delete-post_' . $attachment_id);
if ( $send )
$send = "<input type='submit' class='button' name='send[$attachment_id]' value='" . attribute_escape( __( 'Insert into Post' ) ) . "' />";
$send = "<input type='submit' class='button' name='send[$attachment_id]' value='" . attr( __( 'Insert into Post' ) ) . "' />";
if ( $delete )
$delete = "<a href=\"#\" class=\"del-link\" onclick=\"document.getElementById('del_attachment_$attachment_id').style.display='block';return false;\">" . __('Delete') . "</a>";
if ( ( $send || $delete ) && !isset($form_fields['buttons']) )
@@ -1194,7 +1194,7 @@ function get_media_item( $attachment_id, $args = null ) {
elseif ( $field['input'] == 'textarea' ) {
$item .= "<textarea type='text' id='$name' name='$name'" . $aria_required . ">" . wp_specialchars( $field['value'] ) . "</textarea>";
} else {
$item .= "<input type='text' id='$name' name='$name' value='" . attribute_escape( $field['value'] ) . "'" . $aria_required . "/>";
$item .= "<input type='text' id='$name' name='$name' value='" . attr( $field['value'] ) . "'" . $aria_required . "/>";
}
if ( !empty($field['helps']) )
$item .= "<p class='help'>" . join( "</p>\n<p class='help'>", array_unique((array) $field['helps']) ) . '</p>';
@@ -1222,7 +1222,7 @@ function get_media_item( $attachment_id, $args = null ) {
$item .= "\t</table>\n";
foreach ( $hidden_fields as $name => $value )
$item .= "\t<input type='hidden' name='$name' id='$name' value='" . attribute_escape( $value ) . "' />\n";
$item .= "\t<input type='hidden' name='$name' id='$name' value='" . attr( $value ) . "' />\n";
if ( $post->post_parent < 1 && isset($_REQUEST['post_id']) ) {
$parent = (int) $_REQUEST['post_id'];
@@ -1303,7 +1303,7 @@ SWFUpload.onload = function() {
button_width: "132",
button_image_url: '<?php echo includes_url('images/upload.png'); ?>',
button_placeholder_id: "flash-browse-button",
upload_url : "<?php echo attribute_escape( $flash_action_url ); ?>",
upload_url : "<?php echo attr( $flash_action_url ); ?>",
flash_url : "<?php echo includes_url('js/swfupload/swfupload.swf'); ?>",
file_post_name: "async-upload",
file_types: "<?php echo apply_filters('upload_file_glob', '*.*'); ?>",
@@ -1350,7 +1350,7 @@ SWFUpload.onload = function() {
<div id="html-upload-ui">
<?php do_action('pre-html-upload-ui'); ?>
<p id="async-upload-wrap">
<input type="file" name="async-upload" id="async-upload" /> <input type="submit" class="button" name="html-upload" value="<?php echo attribute_escape(__('Upload')); ?>" /> <a href="#" onclick="return top.tb_remove();"><?php _e('Cancel'); ?></a>
<input type="file" name="async-upload" id="async-upload" /> <input type="submit" class="button" name="html-upload" value="<?php echo attr(__('Upload')); ?>" /> <a href="#" onclick="return top.tb_remove();"><?php _e('Cancel'); ?></a>
</p>
<div class="clear"></div>
<?php if ( is_lighttpd_before_150() ): ?>
@@ -1380,7 +1380,7 @@ function media_upload_type_form($type = 'file', $errors = null, $id = null) {
$form_action_url = apply_filters('media_upload_form_url', $form_action_url, $type);
?>
<form enctype="multipart/form-data" method="post" action="<?php echo attribute_escape($form_action_url); ?>" class="media-upload-form type-form validate" id="<?php echo $type; ?>-form">
<form enctype="multipart/form-data" method="post" action="<?php echo attr($form_action_url); ?>" class="media-upload-form type-form validate" id="<?php echo $type; ?>-form">
<input type="hidden" name="post_id" id="post_id" value="<?php echo (int) $post_id; ?>" />
<?php wp_nonce_field('media-form'); ?>
@@ -1412,7 +1412,7 @@ if ( $id ) {
}
?>
</div>
<input type="submit" class="button savebutton" name="save" value="<?php echo attribute_escape( __( 'Save all changes' ) ); ?>" />
<input type="submit" class="button savebutton" name="save" value="<?php echo attr( __( 'Save all changes' ) ); ?>" />
<?php
}
@@ -1436,7 +1436,7 @@ function media_upload_type_url_form($type = 'file', $errors = null, $id = null)
$callback = "type_url_form_$type";
?>
<form enctype="multipart/form-data" method="post" action="<?php echo attribute_escape($form_action_url); ?>" class="media-upload-form type-form validate" id="<?php echo $type; ?>-form">
<form enctype="multipart/form-data" method="post" action="<?php echo attr($form_action_url); ?>" class="media-upload-form type-form validate" id="<?php echo $type; ?>-form">
<input type="hidden" name="post_id" id="post_id" value="<?php echo (int) $post_id; ?>" />
<?php wp_nonce_field('media-form'); ?>
@@ -1570,7 +1570,7 @@ jQuery(function($){
<a href="#" id="desc"><?php _e('Descending'); ?></a> |
<a href="#" id="clear"><?php _e('Clear'); ?></a>
</div>
<form enctype="multipart/form-data" method="post" action="<?php echo attribute_escape($form_action_url); ?>" class="media-upload-form validate" id="gallery-form">
<form enctype="multipart/form-data" method="post" action="<?php echo attr($form_action_url); ?>" class="media-upload-form validate" id="gallery-form">
<?php wp_nonce_field('media-form'); ?>
<?php //media_upload_form( $errors ); ?>
<table class="widefat" cellspacing="0">
@@ -1585,10 +1585,10 @@ jQuery(function($){
</div>
<p class="ml-submit">
<input type="submit" class="button savebutton" style="display:none;" name="save" id="save-all" value="<?php echo attribute_escape( __( 'Save all changes' ) ); ?>" />
<input type="submit" class="button savebutton" style="display:none;" name="save" id="save-all" value="<?php echo attr( __( 'Save all changes' ) ); ?>" />
<input type="hidden" name="post_id" id="post_id" value="<?php echo (int) $post_id; ?>" />
<input type="hidden" name="type" value="<?php echo attribute_escape( $GLOBALS['type'] ); ?>" />
<input type="hidden" name="tab" value="<?php echo attribute_escape( $GLOBALS['tab'] ); ?>" />
<input type="hidden" name="type" value="<?php echo attr( $GLOBALS['type'] ); ?>" />
<input type="hidden" name="tab" value="<?php echo attr( $GLOBALS['tab'] ); ?>" />
</p>
<div id="gallery-settings" style="display:none;">
@@ -1662,8 +1662,8 @@ jQuery(function($){
</tbody></table>
<p class="ml-submit">
<input type="button" class="button" style="display:none;" onmousedown="wpgallery.update();" name="insert-gallery" id="insert-gallery" value="<?php echo attribute_escape( __( 'Insert gallery' ) ); ?>" />
<input type="button" class="button" style="display:none;" onmousedown="wpgallery.update();" name="update-gallery" id="update-gallery" value="<?php echo attribute_escape( __( 'Update gallery settings' ) ); ?>" />
<input type="button" class="button" style="display:none;" onmousedown="wpgallery.update();" name="insert-gallery" id="insert-gallery" value="<?php echo attr( __( 'Insert gallery' ) ); ?>" />
<input type="button" class="button" style="display:none;" onmousedown="wpgallery.update();" name="update-gallery" id="update-gallery" value="<?php echo attr( __( 'Update gallery settings' ) ); ?>" />
</p>
</div>
</form>
@@ -1699,15 +1699,15 @@ function media_upload_library_form($errors) {
?>
<form id="filter" action="" method="get">
<input type="hidden" name="type" value="<?php echo attribute_escape( $type ); ?>" />
<input type="hidden" name="tab" value="<?php echo attribute_escape( $tab ); ?>" />
<input type="hidden" name="type" value="<?php echo attr( $type ); ?>" />
<input type="hidden" name="tab" value="<?php echo attr( $tab ); ?>" />
<input type="hidden" name="post_id" value="<?php echo (int) $post_id; ?>" />
<input type="hidden" name="post_mime_type" value="<?php echo isset( $_GET['post_mime_type'] ) ? attribute_escape( $_GET['post_mime_type'] ) : ''; ?>" />
<input type="hidden" name="post_mime_type" value="<?php echo isset( $_GET['post_mime_type'] ) ? attr( $_GET['post_mime_type'] ) : ''; ?>" />
<p id="media-search" class="search-box">
<label class="hidden" for="media-search-input"><?php _e('Search Media');?>:</label>
<input type="text" id="media-search-input" name="s" value="<?php the_search_query(); ?>" />
<input type="submit" value="<?php echo attribute_escape( __( 'Search Media' ) ); ?>" class="button" />
<input type="submit" value="<?php echo attr( __( 'Search Media' ) ); ?>" class="button" />
</p>
<ul class="subsubsub">
@@ -1786,7 +1786,7 @@ foreach ($arc_result as $arc_row) {
else
$default = '';
echo "<option$default value='" . attribute_escape( $arc_row->yyear . $arc_row->mmonth ) . "'>";
echo "<option$default value='" . attr( $arc_row->yyear . $arc_row->mmonth ) . "'>";
echo wp_specialchars( $wp_locale->get_month($arc_row->mmonth) . " $arc_row->yyear" );
echo "</option>\n";
}
@@ -1794,7 +1794,7 @@ foreach ($arc_result as $arc_row) {
</select>
<?php } ?>
<input type="submit" id="post-query-submit" value="<?php echo attribute_escape( __( 'Filter &#187;' ) ); ?>" class="button-secondary" />
<input type="submit" id="post-query-submit" value="<?php echo attr( __( 'Filter &#187;' ) ); ?>" class="button-secondary" />
</div>
@@ -1802,7 +1802,7 @@ foreach ($arc_result as $arc_row) {
</div>
</form>
<form enctype="multipart/form-data" method="post" action="<?php echo attribute_escape($form_action_url); ?>" class="media-upload-form validate" id="library-form">
<form enctype="multipart/form-data" method="post" action="<?php echo attr($form_action_url); ?>" class="media-upload-form validate" id="library-form">
<?php wp_nonce_field('media-form'); ?>
<?php //media_upload_form( $errors ); ?>
@@ -1824,7 +1824,7 @@ jQuery(function($){
<?php echo get_media_items(null, $errors); ?>
</div>
<p class="ml-submit">
<input type="submit" class="button savebutton" name="save" value="<?php echo attribute_escape( __( 'Save all changes' ) ); ?>" />
<input type="submit" class="button savebutton" name="save" value="<?php echo attr( __( 'Save all changes' ) ); ?>" />
<input type="hidden" name="post_id" id="post_id" value="<?php echo (int) $post_id; ?>" />
</p>
</form>
@@ -1906,7 +1906,7 @@ function type_url_form_image() {
<tr>
<td></td>
<td>
<input type="button" class="button" id="go_button" style="color:#bbb;" onclick="addExtImage.insert()" value="' . attribute_escape(__('Insert into Post')) . '" />
<input type="button" class="button" id="go_button" style="color:#bbb;" onclick="addExtImage.insert()" value="' . attr(__('Insert into Post')) . '" />
</td>
</tr>
</tbody></table>
@@ -1942,7 +1942,7 @@ function type_url_form_audio() {
<tr>
<td></td>
<td>
<input type="submit" class="button" name="insertonlybutton" value="' . attribute_escape(__('Insert into Post')) . '" />
<input type="submit" class="button" name="insertonlybutton" value="' . attr(__('Insert into Post')) . '" />
</td>
</tr>
</tbody></table>
@@ -1977,7 +1977,7 @@ function type_url_form_video() {
<tr>
<td></td>
<td>
<input type="submit" class="button" name="insertonlybutton" value="' . attribute_escape(__('Insert into Post')) . '" />
<input type="submit" class="button" name="insertonlybutton" value="' . attr(__('Insert into Post')) . '" />
</td>
</tr>
</tbody></table>
@@ -2012,7 +2012,7 @@ function type_url_form_file() {
<tr>
<td></td>
<td>
<input type="submit" class="button" name="insertonlybutton" value="' . attribute_escape(__('Insert into Post')) . '" />
<input type="submit" class="button" name="insertonlybutton" value="' . attr(__('Insert into Post')) . '" />
</td>
</tr>
</tbody></table>
wp-admin/includes/plugin-install.php
+8 -8
View File
@@ -162,8 +162,8 @@ function install_search_form(){
<option value="author"<?php selected('author', $type) ?>><?php _e('Author') ?></option>
<option value="tag"<?php selected('tag', $type) ?>><?php _x('Tag', 'Plugin Installer') ?></option>
</select>
<input type="text" name="s" value="<?php echo attribute_escape($term) ?>" />
<input type="submit" name="search" value="<?php echo attribute_escape(__('Search')) ?>" class="button" />
<input type="text" name="s" value="<?php echo attr($term) ?>" />
<input type="submit" name="search" value="<?php echo attr(__('Search')) ?>" class="button" />
</form><?php
}
@@ -334,12 +334,12 @@ function display_plugins_table($plugins, $page = 1, $totalpages = 1){
$author = wp_kses($author, $plugins_allowedtags);
if( isset($plugin['homepage']) )
$title = '<a target="_blank" href="' . attribute_escape($plugin['homepage']) . '">' . $title . '</a>';
$title = '<a target="_blank" href="' . attr($plugin['homepage']) . '">' . $title . '</a>';
$action_links = array();
$action_links[] = '<a href="' . admin_url('plugin-install.php?tab=plugin-information&amp;plugin=' . $plugin['slug'] .
'&amp;TB_iframe=true&amp;width=600&amp;height=800') . '" class="thickbox onclick" title="' .
attribute_escape($name) . '">' . __('Install') . '</a>';
attr($name) . '">' . __('Install') . '</a>';
$action_links = apply_filters('plugin_install_action_links', $action_links, $plugin);
?>
@@ -348,7 +348,7 @@ function display_plugins_table($plugins, $page = 1, $totalpages = 1){
<td class="vers"><?php echo $version; ?></td>
<td class="vers">
<div class="star-holder" title="<?php printf(_n('(based on %s rating)', '(based on %s ratings)', $plugin['num_ratings']), number_format_i18n($plugin['num_ratings'])) ?>">
<div class="star star-rating" style="width: <?php echo attribute_escape($plugin['rating']) ?>px"></div>
<div class="star star-rating" style="width: <?php echo attr($plugin['rating']) ?>px"></div>
<div class="star star5"><img src="<?php echo admin_url('images/star.gif'); ?>" alt="<?php _e('5 stars') ?>" /></div>
<div class="star star4"><img src="<?php echo admin_url('images/star.gif'); ?>" alt="<?php _e('4 stars') ?>" /></div>
<div class="star star3"><img src="<?php echo admin_url('images/star.gif'); ?>" alt="<?php _e('3 stars') ?>" /></div>
@@ -416,7 +416,7 @@ function install_plugin_information() {
$class = ( $section_name == $section ) ? ' class="current"' : '';
$href = add_query_arg( array('tab' => $tab, 'section' => $section_name) );
$href = clean_url($href);
$san_title = attribute_escape(sanitize_title_with_dashes($title));
$san_title = attr(sanitize_title_with_dashes($title));
echo "\t<li><a name='$san_title' target='' href='$href'$class>$title</a></li>\n";
}
echo "</ul>\n";
@@ -505,7 +505,7 @@ function install_plugin_information() {
</ul>
<h2><?php _e('Average Rating') ?></h2>
<div class="star-holder" title="<?php printf(_n('(based on %s rating)', '(based on %s ratings)', $api->num_ratings), number_format_i18n($api->num_ratings)); ?>">
<div class="star star-rating" style="width: <?php echo attribute_escape($api->rating) ?>px"></div>
<div class="star star-rating" style="width: <?php echo attr($api->rating) ?>px"></div>
<div class="star star5"><img src="<?php echo admin_url('images/star.gif'); ?>" alt="<?php _e('5 stars') ?>" /></div>
<div class="star star4"><img src="<?php echo admin_url('images/star.gif'); ?>" alt="<?php _e('4 stars') ?>" /></div>
<div class="star star3"><img src="<?php echo admin_url('images/star.gif'); ?>" alt="<?php _e('3 stars') ?>" /></div>
@@ -530,7 +530,7 @@ function install_plugin_information() {
$content = links_add_base_url($content, 'http://wordpress.org/extend/plugins/' . $api->slug . '/');
$content = links_add_target($content, '_blank');
$san_title = attribute_escape(sanitize_title_with_dashes($title));
$san_title = attr(sanitize_title_with_dashes($title));
$display = ( $section_name == $section ) ? 'block' : 'none';
wp-admin/includes/taxonomy.php
+1 -1
View File
@@ -222,7 +222,7 @@ function get_terms_to_edit( $post_id, $taxonomy = 'post_tag' ) {
foreach ( $tags as $tag )
$tag_names[] = $tag->name;
$tags_to_edit = join( ',', $tag_names );
$tags_to_edit = attribute_escape( $tags_to_edit );
$tags_to_edit = attr( $tags_to_edit );
$tags_to_edit = apply_filters( 'terms_to_edit', $tags_to_edit, $taxonomy );
return $tags_to_edit;
wp-admin/includes/template.php
+32 -32
View File
@@ -118,7 +118,7 @@ function _cat_row( $category, $level, $name_override = false ) {
$name = ( $name_override ? $name_override : $pad . ' ' . $category->name );
$edit_link = "categories.php?action=edit&amp;cat_ID=$category->term_id";
if ( current_user_can( 'manage_categories' ) ) {
$edit = "<a class='row-title' href='$edit_link' title='" . attribute_escape(sprintf(__('Edit "%s"'), $category->name)) . "'>" . attribute_escape( $name ) . '</a><br />';
$edit = "<a class='row-title' href='$edit_link' title='" . attr(sprintf(__('Edit "%s"'), $category->name)) . "'>" . attr( $name ) . '</a><br />';
$actions = array();
$actions['edit'] = '<a href="' . $edit_link . '">' . __('Edit') . '</a>';
$actions['inline hide-if-no-js'] = '<a href="#" class="editinline">' . __('Quick&nbsp;Edit') . '</a>';
@@ -257,7 +257,7 @@ function inline_edit_term_row($type) {
<p class="inline-edit-save submit">
<a accesskey="c" href="#inline-edit" title="<?php _e('Cancel'); ?>" class="cancel button-secondary alignleft"><?php _e('Cancel'); ?></a>
<?php $update_text = ( $is_tag ) ? __( 'Update Tag' ) : __( 'Update Category' ); ?>
<a accesskey="s" href="#inline-edit" title="<?php echo attribute_escape( $update_text ); ?>" class="save button-primary alignright"><?php echo $update_text; ?></a>
<a accesskey="s" href="#inline-edit" title="<?php echo attr( $update_text ); ?>" class="save button-primary alignright"><?php echo $update_text; ?></a>
<img class="waiting" style="display:none;" src="images/loading.gif" alt="" />
<span class="error" style="display:none;"></span>
<?php wp_nonce_field( 'taxinlineeditnonce', '_inline_edit', false ); ?>
@@ -289,7 +289,7 @@ function link_cat_row( $category, $name_override = false ) {
$name = ( $name_override ? $name_override : $category->name );
$edit_link = "link-category.php?action=edit&amp;cat_ID=$category->term_id";
if ( current_user_can( 'manage_categories' ) ) {
$edit = "<a class='row-title' href='$edit_link' title='" . attribute_escape(sprintf(__('Edit "%s"'), $category->name)) . "'>$name</a><br />";
$edit = "<a class='row-title' href='$edit_link' title='" . attr(sprintf(__('Edit "%s"'), $category->name)) . "'>$name</a><br />";
$actions = array();
$actions['edit'] = '<a href="' . $edit_link . '">' . __('Edit') . '</a>';
$actions['inline hide-if-no-js'] = '<a href="#" class="editinline">' . __('Quick&nbsp;Edit') . '</a>';
@@ -649,7 +649,7 @@ function _tag_row( $tag, $class = '', $taxonomy = 'post_tag' ) {
$out .= '<th scope="row" class="check-column"> <input type="checkbox" name="delete_tags[]" value="' . $tag->term_id . '" /></th>';
break;
case 'name':
$out .= '<td ' . $attributes . '><strong><a class="row-title" href="' . $edit_link . '" title="' . attribute_escape(sprintf(__('Edit "%s"'), $name)) . '">' . $name . '</a></strong><br />';
$out .= '<td ' . $attributes . '><strong><a class="row-title" href="' . $edit_link . '" title="' . attr(sprintf(__('Edit "%s"'), $name)) . '">' . $name . '</a></strong><br />';
$actions = array();
$actions['edit'] = '<a href="' . $edit_link . '">' . __('Edit') . '</a>';
$actions['inline hide-if-no-js'] = '<a href="#" class="editinline">' . __('Quick&nbsp;Edit') . '</a>';
@@ -1247,12 +1247,12 @@ function inline_edit_row( $type ) {
wp_nonce_field( 'inlineeditnonce', '_inline_edit', false );
$update_text = ( $is_page ) ? __( 'Update Page' ) : __( 'Update Post' );
?>
<a accesskey="s" href="#inline-edit" title="<?php _e('Update'); ?>" class="button-primary save alignright"><?php echo attribute_escape( $update_text ); ?></a>
<a accesskey="s" href="#inline-edit" title="<?php _e('Update'); ?>" class="button-primary save alignright"><?php echo attr( $update_text ); ?></a>
<img class="waiting" style="display:none;" src="images/loading.gif" alt="" />
<?php } else {
$update_text = ( $is_page ) ? __( 'Update Pages' ) : __( 'Update Posts' );
?>
<input accesskey="s" class="button-primary alignright" type="submit" name="bulk_edit" value="<?php echo attribute_escape( $update_text ); ?>" />
<input accesskey="s" class="button-primary alignright" type="submit" name="bulk_edit" value="<?php echo attr( $update_text ); ?>" />
<?php } ?>
<input type="hidden" name="post_view" value="<?php echo $m; ?>" />
<br class="clear" />
@@ -1278,7 +1278,7 @@ function get_inline_data($post) {
if ( ! current_user_can('edit_' . $post->post_type, $post->ID) )
return;
$title = attribute_escape($post->post_title);
$title = attr($post->post_title);
echo '
<div class="hidden" id="inline_' . $post->ID . '">
@@ -1427,22 +1427,22 @@ function _post_row($a_post, $pending_comments, $mode) {
case 'title':
$attributes = 'class="post-title column-title"' . $style;
?>
<td <?php echo $attributes ?>><strong><?php if ( current_user_can( 'edit_post', $post->ID ) ) { ?><a class="row-title" href="<?php echo $edit_link; ?>" title="<?php echo attribute_escape(sprintf(__('Edit "%s"'), $title)); ?>"><?php echo $title ?></a><?php } else { echo $title; }; _post_states($post); ?></strong>
<td <?php echo $attributes ?>><strong><?php if ( current_user_can( 'edit_post', $post->ID ) ) { ?><a class="row-title" href="<?php echo $edit_link; ?>" title="<?php echo attr(sprintf(__('Edit "%s"'), $title)); ?>"><?php echo $title ?></a><?php } else { echo $title; }; _post_states($post); ?></strong>
<?php
if ( 'excerpt' == $mode )
the_excerpt();
$actions = array();
if ( current_user_can('edit_post', $post->ID) ) {
$actions['edit'] = '<a href="' . get_edit_post_link($post->ID, true) . '" title="' . attribute_escape(__('Edit this post')) . '">' . __('Edit') . '</a>';
$actions['inline hide-if-no-js'] = '<a href="#" class="editinline" title="' . attribute_escape(__('Edit this post inline')) . '">' . __('Quick&nbsp;Edit') . '</a>';
$actions['delete'] = "<a class='submitdelete' title='" . attribute_escape(__('Delete this post')) . "' href='" . wp_nonce_url("post.php?action=delete&amp;post=$post->ID", 'delete-post_' . $post->ID) . "' onclick=\"if ( confirm('" . js_escape(sprintf( ('draft' == $post->post_status) ? __("You are about to delete this draft '%s'\n 'Cancel' to stop, 'OK' to delete.") : __("You are about to delete this post '%s'\n 'Cancel' to stop, 'OK' to delete."), $post->post_title )) . "') ) { return true;}return false;\">" . __('Delete') . "</a>";
$actions['edit'] = '<a href="' . get_edit_post_link($post->ID, true) . '" title="' . attr(__('Edit this post')) . '">' . __('Edit') . '</a>';
$actions['inline hide-if-no-js'] = '<a href="#" class="editinline" title="' . attr(__('Edit this post inline')) . '">' . __('Quick&nbsp;Edit') . '</a>';
$actions['delete'] = "<a class='submitdelete' title='" . attr(__('Delete this post')) . "' href='" . wp_nonce_url("post.php?action=delete&amp;post=$post->ID", 'delete-post_' . $post->ID) . "' onclick=\"if ( confirm('" . js_escape(sprintf( ('draft' == $post->post_status) ? __("You are about to delete this draft '%s'\n 'Cancel' to stop, 'OK' to delete.") : __("You are about to delete this post '%s'\n 'Cancel' to stop, 'OK' to delete."), $post->post_title )) . "') ) { return true;}return false;\">" . __('Delete') . "</a>";
}
if ( in_array($post->post_status, array('pending', 'draft')) ) {
if ( current_user_can('edit_post', $post->ID) )
$actions['view'] = '<a href="' . get_permalink($post->ID) . '" title="' . attribute_escape(sprintf(__('Preview "%s"'), $title)) . '" rel="permalink">' . __('Preview') . '</a>';
$actions['view'] = '<a href="' . get_permalink($post->ID) . '" title="' . attr(sprintf(__('Preview "%s"'), $title)) . '" rel="permalink">' . __('Preview') . '</a>';
} else {
$actions['view'] = '<a href="' . get_permalink($post->ID) . '" title="' . attribute_escape(sprintf(__('View "%s"'), $title)) . '" rel="permalink">' . __('View') . '</a>';
$actions['view'] = '<a href="' . get_permalink($post->ID) . '" title="' . attr(sprintf(__('View "%s"'), $title)) . '" rel="permalink">' . __('View') . '</a>';
}
$actions = apply_filters('post_row_actions', $actions, $post);
$action_count = count($actions);
@@ -1643,19 +1643,19 @@ foreach ($posts_columns as $column_name=>$column_display_name) {
$attributes = 'class="post-title page-title column-title"' . $style;
$edit_link = get_edit_post_link( $page->ID );
?>
<td <?php echo $attributes ?>><strong><?php if ( current_user_can( 'edit_post', $page->ID ) ) { ?><a class="row-title" href="<?php echo $edit_link; ?>" title="<?php echo attribute_escape(sprintf(__('Edit "%s"'), $title)); ?>"><?php echo $pad; echo $title ?></a><?php } else { echo $pad; echo $title; }; _post_states($page); echo isset($parent_name) ? ' | ' . __('Parent Page: ') . wp_specialchars($parent_name) : ''; ?></strong>
<td <?php echo $attributes ?>><strong><?php if ( current_user_can( 'edit_post', $page->ID ) ) { ?><a class="row-title" href="<?php echo $edit_link; ?>" title="<?php echo attr(sprintf(__('Edit "%s"'), $title)); ?>"><?php echo $pad; echo $title ?></a><?php } else { echo $pad; echo $title; }; _post_states($page); echo isset($parent_name) ? ' | ' . __('Parent Page: ') . wp_specialchars($parent_name) : ''; ?></strong>
<?php
$actions = array();
if ( current_user_can('edit_page', $page->ID) ) {
$actions['edit'] = '<a href="' . $edit_link . '" title="' . attribute_escape(__('Edit this page')) . '">' . __('Edit') . '</a>';
$actions['edit'] = '<a href="' . $edit_link . '" title="' . attr(__('Edit this page')) . '">' . __('Edit') . '</a>';
$actions['inline'] = '<a href="#" class="editinline">' . __('Quick&nbsp;Edit') . '</a>';
$actions['delete'] = "<a class='submitdelete' title='" . attribute_escape(__('Delete this page')) . "' href='" . wp_nonce_url("page.php?action=delete&amp;post=$page->ID", 'delete-page_' . $page->ID) . "' onclick=\"if ( confirm('" . js_escape(sprintf( ('draft' == $page->post_status) ? __("You are about to delete this draft '%s'\n 'Cancel' to stop, 'OK' to delete.") : __("You are about to delete this page '%s'\n 'Cancel' to stop, 'OK' to delete."), $page->post_title )) . "') ) { return true;}return false;\">" . __('Delete') . "</a>";
$actions['delete'] = "<a class='submitdelete' title='" . attr(__('Delete this page')) . "' href='" . wp_nonce_url("page.php?action=delete&amp;post=$page->ID", 'delete-page_' . $page->ID) . "' onclick=\"if ( confirm('" . js_escape(sprintf( ('draft' == $page->post_status) ? __("You are about to delete this draft '%s'\n 'Cancel' to stop, 'OK' to delete.") : __("You are about to delete this page '%s'\n 'Cancel' to stop, 'OK' to delete."), $page->post_title )) . "') ) { return true;}return false;\">" . __('Delete') . "</a>";
}
if ( in_array($post->post_status, array('pending', 'draft')) ) {
if ( current_user_can('edit_page', $page->ID) )
$actions['view'] = '<a href="' . get_permalink($page->ID) . '" title="' . attribute_escape(sprintf(__('Preview "%s"'), $title)) . '" rel="permalink">' . __('Preview') . '</a>';
$actions['view'] = '<a href="' . get_permalink($page->ID) . '" title="' . attr(sprintf(__('Preview "%s"'), $title)) . '" rel="permalink">' . __('Preview') . '</a>';
} else {
$actions['view'] = '<a href="' . get_permalink($page->ID) . '" title="' . attribute_escape(sprintf(__('View "%s"'), $title)) . '" rel="permalink">' . __('View') . '</a>';
$actions['view'] = '<a href="' . get_permalink($page->ID) . '" title="' . attr(sprintf(__('View "%s"'), $title)) . '" rel="permalink">' . __('View') . '</a>';
}
$actions = apply_filters('page_row_actions', $actions, $page);
$action_count = count($actions);
@@ -2114,9 +2114,9 @@ function _wp_comment_row( $comment_id, $mode, $comment_status, $checkbox = true,
comment_text(); ?>
<div id="inline-<?php echo $comment->comment_ID; ?>" class="hidden">
<textarea class="comment" rows="3" cols="10"><?php echo $comment->comment_content; ?></textarea>
<div class="author-email"><?php if ( $user_can ) echo attribute_escape( $comment->comment_author_email ); ?></div>
<div class="author"><?php if ( $user_can ) echo attribute_escape( $comment->comment_author ); ?></div>
<div class="author-url"><?php echo attribute_escape( $comment->comment_author_url ); ?></div>
<div class="author-email"><?php if ( $user_can ) echo attr( $comment->comment_author_email ); ?></div>
<div class="author"><?php if ( $user_can ) echo attr( $comment->comment_author ); ?></div>
<div class="author-url"><?php echo attr( $comment->comment_author_url ); ?></div>
<div class="comment_status"><?php echo $comment->comment_approved; ?></div>
</div>
<?php
@@ -2417,7 +2417,7 @@ function _list_meta_row( $entry, &$count ) {
}
}
$entry['meta_key'] = attribute_escape($entry['meta_key']);
$entry['meta_key'] = attr($entry['meta_key']);
$entry['meta_value'] = htmlspecialchars($entry['meta_value']); // using a <textarea />
$entry['meta_id'] = (int) $entry['meta_id'];
@@ -2427,8 +2427,8 @@ function _list_meta_row( $entry, &$count ) {
$r .= "\n\t\t<td class='left'><label class='hidden' for='meta[{$entry['meta_id']}][key]'>" . __( 'Key' ) . "</label><input name='meta[{$entry['meta_id']}][key]' id='meta[{$entry['meta_id']}][key]' tabindex='6' type='text' size='20' value='{$entry['meta_key']}' />";
$r .= "\n\t\t<div class='submit'><input name='deletemeta[{$entry['meta_id']}]' type='submit' ";
$r .= "class='delete:the-list:meta-{$entry['meta_id']}::_ajax_nonce=$delete_nonce deletemeta' tabindex='6' value='".attribute_escape(__( 'Delete' ))."' />";
$r .= "\n\t\t<input name='updatemeta' type='submit' tabindex='6' value='".attribute_escape(__( 'Update' ))."' class='add:the-list:meta-{$entry['meta_id']}::_ajax_nonce=$update_nonce updatemeta' /></div>";
$r .= "class='delete:the-list:meta-{$entry['meta_id']}::_ajax_nonce=$delete_nonce deletemeta' tabindex='6' value='".attr(__( 'Delete' ))."' />";
$r .= "\n\t\t<input name='updatemeta' type='submit' tabindex='6' value='".attr(__( 'Update' ))."' class='add:the-list:meta-{$entry['meta_id']}::_ajax_nonce=$update_nonce updatemeta' /></div>";
$r .= wp_nonce_field( 'change-meta', '_ajax_nonce', false, false );
$r .= "</td>";
@@ -2472,7 +2472,7 @@ function meta_form() {
<?php
foreach ( $keys as $key ) {
$key = attribute_escape( $key );
$key = attr( $key );
echo "\n<option value='$key'>$key</option>";
}
?>
@@ -2782,7 +2782,7 @@ function wp_import_upload_form( $action ) {
<p><strong><?php echo $upload_dir['error']; ?></strong></p></div><?php
else :
?>
<form enctype="multipart/form-data" id="import-upload-form" method="post" action="<?php echo attribute_escape($action) ?>">
<form enctype="multipart/form-data" id="import-upload-form" method="post" action="<?php echo attr($action) ?>">
<p>
<?php wp_nonce_field('import-upload'); ?>
<label for="upload"><?php _e( 'Choose a file from your computer:' ); ?></label> (<?php printf( __('Maximum size: %s' ), $size ); ?>)
@@ -2805,7 +2805,7 @@ function wp_import_upload_form( $action ) {
*/
function wp_remember_old_slug() {
global $post;
$name = attribute_escape($post->post_name); // just in case
$name = attr($post->post_name); // just in case
if ( strlen($name) )
echo '<input type="hidden" id="wp-old-slug" name="wp-old-slug" value="' . $name . '" />';
}
@@ -3171,15 +3171,15 @@ function find_posts_div($found_action = '') {
/**
* Display the post password.
*
* The password is passed through {@link attribute_escape()} to ensure that it
* The password is passed through {@link attr()} to ensure that it
* is safe for placing in an html attribute.
*
* @uses attribute_escape
* @uses attr
* @since 2.7.0
*/
function the_post_password() {
global $post;
if ( isset( $post->post_password ) ) echo attribute_escape( $post->post_password );
if ( isset( $post->post_password ) ) echo attr( $post->post_password );
}
/**
@@ -3297,12 +3297,12 @@ function _draft_or_post_title($post_id = 0)
* A simple wrapper to display the "s" parameter in a GET URI. This function
* should only be used when {@link the_search_query()} cannot.
*
* @uses attribute_escape
* @uses attr
* @since 2.7.0
*
*/
function _admin_search_query() {
echo isset($_GET['s']) ? attribute_escape( stripslashes( $_GET['s'] ) ) : '';
echo isset($_GET['s']) ? attr( stripslashes( $_GET['s'] ) ) : '';
}
/**
wp-admin/includes/theme-install.php
+8 -8
View File
@@ -158,8 +158,8 @@ function install_theme_search_form() {
<option value="author" <?php selected('author', $type) ?>><?php _e('Author'); ?></option>
<option value="tag" <?php selected('tag', $type) ?>><?php _e('Tag'); ?></option>
</select>
<input type="text" name="s" size="30" value="<?php echo attribute_escape($term) ?>" />
<input type="submit" name="search" value="<?php echo attribute_escape(__('Search')); ?>" class="button" />
<input type="text" name="s" size="30" value="<?php echo attr($term) ?>" />
<input type="submit" name="search" value="<?php echo attr(__('Search')); ?>" class="button" />
</form>
<?php
}
@@ -202,7 +202,7 @@ function install_themes_dashboard() {
if ( isset($trans[$feature]) )
$feature_name = $trans[$feature];
$feature_name = wp_specialchars( $feature_name );
$feature = attribute_escape($feature);
$feature = attr($feature);
?>
<li>
@@ -218,7 +218,7 @@ function install_themes_dashboard() {
</div>
<br class="clear" />
<input type="submit" name="search" value="<?php echo attribute_escape(__('Find Themes')); ?>" class="button" />
<input type="submit" name="search" value="<?php echo attr(__('Find Themes')); ?>" class="button" />
</form>
<?php
}
@@ -301,8 +301,8 @@ function display_theme($theme, $actions = null, $show_details = true) {
if ( !is_array($actions) ) {
$actions = array();
$actions[] = '<a href="' . admin_url('theme-install.php?tab=theme-information&amp;theme=' . $theme->slug .
'&amp;TB_iframe=true&amp;tbWidth=500&amp;tbHeight=350') . '" class="thickbox thickbox-preview onclick" title="' . attribute_escape(sprintf(__('Install "%s"'), $name)) . '">' . __('Install') . '</a>';
$actions[] = '<a href="' . $preview_link . '" class="thickbox thickbox-preview onclick previewlink" title="' . attribute_escape(sprintf(__('Preview "%s"'), $name)) . '">' . __('Preview') . '</a>';
'&amp;TB_iframe=true&amp;tbWidth=500&amp;tbHeight=350') . '" class="thickbox thickbox-preview onclick" title="' . attr(sprintf(__('Install "%s"'), $name)) . '">' . __('Install') . '</a>';
$actions[] = '<a href="' . $preview_link . '" class="thickbox thickbox-preview onclick previewlink" title="' . attr(sprintf(__('Preview "%s"'), $name)) . '">' . __('Preview') . '</a>';
$actions = apply_filters('theme_install_action_links', $actions, $theme);
}
@@ -310,7 +310,7 @@ function display_theme($theme, $actions = null, $show_details = true) {
?>
<a class='thickbox thickbox-preview screenshot'
href='<? echo clean_url($preview_link); ?>'
title='<?php echo attribute_escape(sprintf(__('Preview "%s"'), $name)); ?>'>
title='<?php echo attr(sprintf(__('Preview "%s"'), $name)); ?>'>
<img src='<?php echo clean_url($theme->screenshot_url); ?>' width='150' />
</a>
<h3><?php echo $name ?></h3>
@@ -331,7 +331,7 @@ function display_theme($theme, $actions = null, $show_details = true) {
<p><strong><?php _e('Downloaded:') ?></strong> <?php printf(_n('%s time', '%s times', $theme->downloaded), number_format_i18n($theme->downloaded)) ?></p>
<?php endif; ?>
<div class="star-holder" title="<?php printf(_n('(based on %s rating)', '(based on %s ratings)', $theme->num_ratings), number_format_i18n($theme->num_ratings)) ?>">
<div class="star star-rating" style="width: <?php echo attribute_escape($theme->rating) ?>px"></div>
<div class="star star-rating" style="width: <?php echo attr($theme->rating) ?>px"></div>
<div class="star star5"><img src="<?php echo admin_url('images/star.gif'); ?>" alt="<?php _e('5 stars') ?>" /></div>
<div class="star star4"><img src="<?php echo admin_url('images/star.gif'); ?>" alt="<?php _e('4 stars') ?>" /></div>
<div class="star star3"><img src="<?php echo admin_url('images/star.gif'); ?>" alt="<?php _e('3 stars') ?>" /></div>
wp-admin/includes/user.php
+9 -9
View File
@@ -366,16 +366,16 @@ function get_others_pending($user_id) {
*/
function get_user_to_edit( $user_id ) {
$user = new WP_User( $user_id );
$user->user_login = attribute_escape($user->user_login);
$user->user_email = attribute_escape($user->user_email);
$user->user_login = attr($user->user_login);
$user->user_email = attr($user->user_email);
$user->user_url = clean_url($user->user_url);
$user->first_name = attribute_escape($user->first_name);
$user->last_name = attribute_escape($user->last_name);
$user->display_name = attribute_escape($user->display_name);
$user->nickname = attribute_escape($user->nickname);
$user->aim = isset( $user->aim ) && !empty( $user->aim ) ? attribute_escape($user->aim) : '';
$user->yim = isset( $user->yim ) && !empty( $user->yim ) ? attribute_escape($user->yim) : '';
$user->jabber = isset( $user->jabber ) && !empty( $user->jabber ) ? attribute_escape($user->jabber) : '';
$user->first_name = attr($user->first_name);
$user->last_name = attr($user->last_name);
$user->display_name = attr($user->display_name);
$user->nickname = attr($user->nickname);
$user->aim = isset( $user->aim ) && !empty( $user->aim ) ? attr($user->aim) : '';
$user->yim = isset( $user->yim ) && !empty( $user->yim ) ? attr($user->yim) : '';
$user->jabber = isset( $user->jabber ) && !empty( $user->jabber ) ? attr($user->jabber) : '';
$user->description = isset( $user->description ) && !empty( $user->description ) ? wp_specialchars($user->description) : '';
return $user;