Skip to content

Commit

Permalink
s/attribute_escape/attr/. see #9650
Browse files Browse the repository at this point in the history 
git-svn-id: http://svn.automattic.com/wordpress/trunk@11109 1a063a9b-81f0-0310-95a4-ce76da25c4cd
  • Loading branch information
ryan committed Apr 28, 2009
1 parent 430a8cb commit 2d48976
Show file tree
Hide file tree
Showing 84 changed files with 391 additions and 391 deletions.
4 changes: 2 additions & 2 deletions wp-admin/admin-ajax.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -474,7 +474,7 @@ function _wp_ajax_delete_comment_response( $comment_id ) {
$cat_full_name = $_cat->name . ' — ' . $cat_full_name;
$level++;
}
$cat_full_name = attribute_escape($cat_full_name);
$cat_full_name = attr($cat_full_name);

$x = new WP_Ajax_Response( array(
'what' => 'cat',
Expand Down Expand Up @@ -552,7 +552,7 @@ function _wp_ajax_delete_comment_response( $comment_id ) {
die('0');

$tag_full_name = $tag->name;
$tag_full_name = attribute_escape($tag_full_name);
$tag_full_name = attr($tag_full_name);

$x = new WP_Ajax_Response( array(
'what' => 'tag',
Expand Down
8 changes: 4 additions & 4 deletions wp-admin/custom-header.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -287,7 +287,7 @@ function step_1() {
<input type="button" class="button" value="<?php _ea('Hide Text'); ?>" onclick="hide_text()" id="hidetext" />
<input type="button" class="button" value="<?php _ea('Select a Text Color'); ?>" id="pickcolor" /><input type="button" class="button" value="<?php _ea('Use Original Color'); ?>" onclick="colorDefault()" id="defaultcolor" />
<?php wp_nonce_field('custom-header') ?>
<input type="hidden" name="textcolor" id="textcolor" value="#<?php attribute_escape(header_textcolor()) ?>" /><input name="submit" type="submit" class="button" value="<?php _ea('Save Changes'); ?>" /></form>
<input type="hidden" name="textcolor" id="textcolor" value="#<?php attr(header_textcolor()) ?>" /><input name="submit" type="submit" class="button" value="<?php _ea('Save Changes'); ?>" /></form>
<?php } ?>

<div id="colorPickerDiv" style="z-index: 100;background:#eee;border:1px solid #ccc;position:absolute;display:none;"> </div>
Expand All @@ -296,7 +296,7 @@ function step_1() {
<h2><?php _e('Upload New Header Image'); ?></h2><p><?php _e('Here you can upload a custom header image to be shown at the top of your blog instead of the default one. On the next screen you will be able to crop the image.'); ?></p>
<p><?php printf(__('Images of exactly <strong>%1$d x %2$d pixels</strong> will be used as-is.'), HEADER_IMAGE_WIDTH, HEADER_IMAGE_HEIGHT); ?></p>

<form enctype="multipart/form-data" id="uploadForm" method="POST" action="<?php echo attribute_escape(add_query_arg('step', 2)) ?>" style="margin: auto; width: 50%;">
<form enctype="multipart/form-data" id="uploadForm" method="POST" action="<?php echo attr(add_query_arg('step', 2)) ?>" style="margin: auto; width: 50%;">
<label for="upload"><?php _e('Choose an image from your computer:'); ?></label><br /><input type="file" id="upload" name="import" />
<input type="hidden" name="action" value="save" />
<?php wp_nonce_field('custom-header') ?>
Expand All @@ -311,7 +311,7 @@ function step_1() {
<div class="wrap">
<h2><?php _e('Reset Header Image and Color'); ?></h2>
<p><?php _e('This will restore the original header image and color. You will not be able to retrieve any customizations.') ?></p>
<form method="post" action="<?php echo attribute_escape(add_query_arg('step', 1)) ?>">
<form method="post" action="<?php echo attr(add_query_arg('step', 1)) ?>">
<?php wp_nonce_field('custom-header'); ?>
<input type="submit" class="button" name="resetheader" value="<?php _ea('Restore Original Header'); ?>" />
</form>
Expand Down Expand Up @@ -372,7 +372,7 @@ function step_2() {

<div class="wrap">

<form method="POST" action="<?php echo attribute_escape(add_query_arg('step', 3)) ?>">
<form method="POST" action="<?php echo attr(add_query_arg('step', 3)) ?>">

<p><?php _e('Choose the part of the image you want to use as your header.'); ?></p>
<div id="testWrap" style="position: relative">
Expand Down
8 changes: 4 additions & 4 deletions wp-admin/edit-attachment-rows.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -62,7 +62,7 @@
if ( $thumb = wp_get_attachment_image( $post->ID, array(80, 60), true ) ) {
?>

<a href="media.php?action=edit&amp;attachment_id=<?php the_ID(); ?>" title="<?php echo attribute_escape(sprintf(__('Edit "%s"'), $att_title)); ?>">
<a href="media.php?action=edit&amp;attachment_id=<?php the_ID(); ?>" title="<?php echo attr(sprintf(__('Edit "%s"'), $att_title)); ?>">
<?php echo $thumb; ?>
</a>

Expand All @@ -74,7 +74,7 @@

case 'media':
?>
<td <?php echo $attributes ?>><strong><a href="<?php echo get_edit_post_link( $post->ID ); ?>" title="<?php echo attribute_escape(sprintf(__('Edit "%s"'), $att_title)); ?>"><?php echo $att_title; ?></a></strong><br />
<td <?php echo $attributes ?>><strong><a href="<?php echo get_edit_post_link( $post->ID ); ?>" title="<?php echo attr(sprintf(__('Edit "%s"'), $att_title)); ?>"><?php echo $att_title; ?></a></strong><br />
<?php echo strtoupper(preg_replace('/^.*?\.(\w+)$/', '$1', get_attached_file($post->ID))); ?>
<p>
<?php
Expand All @@ -83,7 +83,7 @@
$actions['edit'] = '<a href="' . get_edit_post_link($post->ID, true) . '">' . __('Edit') . '</a>';
if ( current_user_can('delete_post', $post->ID) )
$actions['delete'] = "<a class='submitdelete' href='" . wp_nonce_url("post.php?action=delete&amp;post=$post->ID", 'delete-post_' . $post->ID) . "' onclick=\"if ( confirm('" . js_escape(sprintf( ('draft' == $post->post_status) ? __("You are about to delete this attachment '%s'\n 'Cancel' to stop, 'OK' to delete.") : __("You are about to delete this attachment '%s'\n 'Cancel' to stop, 'OK' to delete."), $post->post_title )) . "') ) { return true;}return false;\">" . __('Delete') . "</a>";
$actions['view'] = '<a href="' . get_permalink($post->ID) . '" title="' . attribute_escape(sprintf(__('View "%s"'), $title)) . '" rel="permalink">' . __('View') . '</a>';
$actions['view'] = '<a href="' . get_permalink($post->ID) . '" title="' . attr(sprintf(__('View "%s"'), $title)) . '" rel="permalink">' . __('View') . '</a>';
$action_count = count($actions);
$i = 0;
echo '<div class="row-actions">';
Expand Down Expand Up @@ -182,7 +182,7 @@
case 'actions':
?>
<td <?php echo $attributes ?>>
<a href="media.php?action=edit&amp;attachment_id=<?php the_ID(); ?>" title="<?php echo attribute_escape(sprintf(__('Edit "%s"'), $att_title)); ?>"><?php _e('Edit'); ?></a> |
<a href="media.php?action=edit&amp;attachment_id=<?php the_ID(); ?>" title="<?php echo attr(sprintf(__('Edit "%s"'), $att_title)); ?>"><?php _e('Edit'); ?></a> |
<a href="<?php the_permalink(); ?>"><?php _e('Get permalink'); ?></a>
</td>
<?php
Expand Down
4 changes: 2 additions & 2 deletions wp-admin/edit-category-form.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -49,12 +49,12 @@ function _fill_empty_category(&$category) {
<table class="form-table">
<tr class="form-field form-required">
<th scope="row" valign="top"><label for="cat_name"><?php _e('Category Name') ?></label></th>
<td><input name="cat_name" id="cat_name" type="text" value="<?php echo attribute_escape($category->name); ?>" size="40" aria-required="true" /><br />
<td><input name="cat_name" id="cat_name" type="text" value="<?php echo attr($category->name); ?>" size="40" aria-required="true" /><br />
<?php _e('The name is used to identify the category almost everywhere, for example under the post or in the category widget.'); ?></td>
</tr>
<tr class="form-field">
<th scope="row" valign="top"><label for="category_nicename"><?php _e('Category Slug') ?></label></th>
<td><input name="category_nicename" id="category_nicename" type="text" value="<?php echo attribute_escape(apply_filters('editable_slug', $category->slug)); ?>" size="40" /><br />
<td><input name="category_nicename" id="category_nicename" type="text" value="<?php echo attr(apply_filters('editable_slug', $category->slug)); ?>" size="40" /><br />
<?php _e('The &#8220;slug&#8221; is the URL-friendly version of the name. It is usually all lowercase and contains only letters, numbers, and hyphens.'); ?></td>
</tr>
<tr class="form-field">
Expand Down
12 changes: 6 additions & 6 deletions wp-admin/edit-comments.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -83,7 +83,7 @@

require_once('admin-header.php');

$mode = ( ! isset($_GET['mode']) || empty($_GET['mode']) ) ? 'detail' : attribute_escape($_GET['mode']);
$mode = ( ! isset($_GET['mode']) || empty($_GET['mode']) ) ? 'detail' : attr($_GET['mode']);

$default_status = get_user_option('edit_comments_last_view');
if ( empty($default_status) )
Expand All @@ -94,10 +94,10 @@
if ( $comment_status != $default_status )
update_usermeta($current_user->ID, 'edit_comments_last_view', $comment_status);

$comment_type = !empty($_GET['comment_type']) ? attribute_escape($_GET['comment_type']) : '';
$comment_type = !empty($_GET['comment_type']) ? attr($_GET['comment_type']) : '';

$search_dirty = ( isset($_GET['s']) ) ? $_GET['s'] : '';
$search = attribute_escape( $search_dirty ); ?>
$search = attr( $search_dirty ); ?>

<div class="wrap">
<?php screen_icon(); ?>
Expand Down Expand Up @@ -164,7 +164,7 @@
/*
// I toyed with this, but decided against it. Leaving it in here in case anyone thinks it is a good idea. ~ Mark
if ( !empty( $_GET['s'] ) )
$link = add_query_arg( 's', attribute_escape( stripslashes( $_GET['s'] ) ), $link );
$link = add_query_arg( 's', attr( stripslashes( $_GET['s'] ) ), $link );
*/
$status_links[] = "<li class='$status'><a href='$link'$class>" . sprintf(
_n( $label[0], $label[1], $num_comments->$status ),
Expand Down Expand Up @@ -364,8 +364,8 @@
<input type="hidden" name="mode" value="<?php echo attr($mode); ?>" />
<input type="hidden" name="comment_status" value="<?php echo attr($comment_status); ?>" />
<input type="hidden" name="page" value="<?php echo isset($_REQUEST['page']) ? absint( $_REQUEST['page'] ) : 1; ?>" />
<input type="hidden" name="p" value="<?php echo attribute_escape( $post_id ); ?>" />
<input type="hidden" name="comment_type" value="<?php echo attribute_escape( $comment_type ); ?>" />
<input type="hidden" name="p" value="<?php echo attr( $post_id ); ?>" />
<input type="hidden" name="comment_type" value="<?php echo attr( $comment_type ); ?>" />
<?php wp_nonce_field( 'add-comment', '_ajax_nonce', false ); ?>
</form>

Expand Down
20 changes: 10 additions & 10 deletions wp-admin/edit-form-advanced.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@
$action = isset($action) ? $action : '';
if ( isset($_GET['message']) )
$_GET['message'] = absint( $_GET['message'] );
$messages[1] = sprintf( __( 'Post updated. Continue editing below or <a href="%s">go back</a>.' ), attribute_escape( stripslashes( ( isset( $_GET['_wp_original_http_referer'] ) ? $_GET['_wp_original_http_referer'] : '') ) ) );
$messages[1] = sprintf( __( 'Post updated. Continue editing below or <a href="%s">go back</a>.' ), attr( stripslashes( ( isset( $_GET['_wp_original_http_referer'] ) ? $_GET['_wp_original_http_referer'] : '') ) ) );
$messages[2] = __('Custom field updated.');
$messages[3] = __('Custom field deleted.');
$messages[4] = __('Post updated.');
Expand Down Expand Up @@ -169,15 +169,15 @@ function post_submit_meta_box($post) {
?><?php echo wp_specialchars( $visibility_trans ); ?></span></b> <?php if ( $can_publish ) { ?> <a href="#visibility" class="edit-visibility hide-if-no-js"><?php _e('Edit'); ?></a>

<div id="post-visibility-select" class="hide-if-js">
<input type="hidden" name="hidden_post_password" id="hidden-post-password" value="<?php echo attribute_escape($post->post_password); ?>" />
<input type="hidden" name="hidden_post_password" id="hidden-post-password" value="<?php echo attr($post->post_password); ?>" />
<input type="checkbox" style="display:none" name="hidden_post_sticky" id="hidden-post-sticky" value="sticky" <?php checked(is_sticky($post->ID)); ?> />
<input type="hidden" name="hidden_post_visibility" id="hidden-post-visibility" value="<?php echo attribute_escape( $visibility ); ?>" />
<input type="hidden" name="hidden_post_visibility" id="hidden-post-visibility" value="<?php echo attr( $visibility ); ?>" />


<input type="radio" name="visibility" id="visibility-radio-public" value="public" <?php checked( $visibility, 'public' ); ?> /> <label for="visibility-radio-public" class="selectit"><?php _e('Public'); ?></label><br />
<span id="sticky-span"><input id="sticky" name="sticky" type="checkbox" value="sticky" <?php checked(is_sticky($post->ID)); ?> tabindex="4" /> <label for="sticky" class="selectit"><?php _e('Stick this post to the front page') ?></label><br /></span>
<input type="radio" name="visibility" id="visibility-radio-password" value="password" <?php checked( $visibility, 'password' ); ?> /> <label for="visibility-radio-password" class="selectit"><?php _e('Password protected'); ?></label><br />
<span id="password-span"><label for="post_password"><?php _e('Password:'); ?></label> <input type="text" name="post_password" id="post_password" value="<?php echo attribute_escape($post->post_password); ?>" /><br /></span>
<span id="password-span"><label for="post_password"><?php _e('Password:'); ?></label> <input type="text" name="post_password" id="post_password" value="<?php echo attr($post->post_password); ?>" /><br /></span>
<input type="radio" name="visibility" id="visibility-radio-private" value="private" <?php checked( $visibility, 'private' ); ?> /> <label for="visibility-radio-private" class="selectit"><?php _e('Private'); ?></label><br />

<p>
Expand Down Expand Up @@ -271,7 +271,7 @@ function post_submit_meta_box($post) {
function post_tags_meta_box($post, $box) {
$tax_name = substr($box['id'], 8);
$taxonomy = get_taxonomy($tax_name);
$helps = isset($taxonomy->helps) ? attribute_escape($taxonomy->helps) : __('Separate tags with commas.');
$helps = isset($taxonomy->helps) ? attr($taxonomy->helps) : __('Separate tags with commas.');
?>
<div class="tagsdiv" id="<?php echo $tax_name; ?>">
<p class="jaxtag">
Expand All @@ -293,7 +293,7 @@ function post_tags_meta_box($post, $box) {
foreach ( get_object_taxonomies('post') as $tax_name ) {
if ( !is_taxonomy_hierarchical($tax_name) ) {
$taxonomy = get_taxonomy($tax_name);
$label = isset($taxonomy->label) ? attribute_escape($taxonomy->label) : $tax_name;
$label = isset($taxonomy->label) ? attr($taxonomy->label) : $tax_name;

add_meta_box('tagsdiv-' . $tax_name, $label, 'post_tags_meta_box', 'post', 'side', 'core');
}
Expand Down Expand Up @@ -384,7 +384,7 @@ function post_excerpt_meta_box($post) {
* @param object $post
*/
function post_trackback_meta_box($post) {
$form_trackback = '<input type="text" name="trackback_url" id="trackback_url" class="code" tabindex="7" value="'. attribute_escape( str_replace("\n", ' ', $post->to_ping) ) .'" />';
$form_trackback = '<input type="text" name="trackback_url" id="trackback_url" class="code" tabindex="7" value="'. attr( str_replace("\n", ' ', $post->to_ping) ) .'" />';
if ('' != $post->pinged) {
$pings = '<p>'. __('Already pinged:') . '</p><ul>';
$already_pinged = explode("\n", trim($post->pinged));
Expand Down Expand Up @@ -497,7 +497,7 @@ function post_comment_meta_box($post) {
*/
function post_slug_meta_box($post) {
?>
<label class="hidden" for="post_name"><?php _e('Post Slug') ?></label><input name="post_name" type="text" size="13" id="post_name" value="<?php echo attribute_escape( $post->post_name ); ?>" />
<label class="hidden" for="post_name"><?php _e('Post Slug') ?></label><input name="post_name" type="text" size="13" id="post_name" value="<?php echo attr( $post->post_name ); ?>" />
<?php
}
if ( !( 'pending' == $post->post_status && !current_user_can( 'publish_posts' ) ) )
Expand Down Expand Up @@ -574,7 +574,7 @@ function post_revisions_meta_box($post) {
<input type="hidden" id="user-id" name="user_ID" value="<?php echo (int) $user_ID ?>" />
<input type="hidden" id="hiddenaction" name="action" value="<?php echo attr($form_action) ?>" />
<input type="hidden" id="originalaction" name="originalaction" value="<?php echo attr($form_action) ?>" />
<input type="hidden" id="post_author" name="post_author" value="<?php echo attribute_escape( $post->post_author ); ?>" />
<input type="hidden" id="post_author" name="post_author" value="<?php echo attr( $post->post_author ); ?>" />
<input type="hidden" id="post_type" name="post_type" value="<?php echo attr($post->post_type) ?>" />
<input type="hidden" id="original_post_status" name="original_post_status" value="<?php echo attr($post->post_status) ?>" />
<input name="referredby" type="hidden" id="referredby" value="<?php echo clean_url(stripslashes(wp_get_referer())); ?>" />
Expand All @@ -595,7 +595,7 @@ function post_revisions_meta_box($post) {
<div id="post-body-content">
<div id="titlediv">
<div id="titlewrap">
<input type="text" name="post_title" size="30" tabindex="1" value="<?php echo attribute_escape( htmlspecialchars( $post->post_title ) ); ?>" id="title" autocomplete="off" />
<input type="text" name="post_title" size="30" tabindex="1" value="<?php echo attr( htmlspecialchars( $post->post_title ) ); ?>" id="title" autocomplete="off" />
</div>
<div class="inside">
<?php $sample_permalink_html = get_sample_permalink_html($post->ID); ?>
Expand Down
6 changes: 3 additions & 3 deletions wp-admin/edit-form-comment.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -26,8 +26,8 @@
<input type="hidden" name="action" value='<?php echo $form_action . $form_extra ?>' />
<?php

$email = attribute_escape( $comment->comment_author_email );
$url = attribute_escape( $comment->comment_author_url );
$email = attr( $comment->comment_author_email );
$url = attr( $comment->comment_author_url );
// add_meta_box('submitdiv', __('Save'), 'comment_submit_meta_box', 'comment', 'side', 'core');
?>

Expand Down Expand Up @@ -90,7 +90,7 @@
<tbody>
<tr valign="top">
<td class="first"><?php _e( 'Name:' ); ?></td>
<td><input type="text" name="newcomment_author" size="30" value="<?php echo attribute_escape( $comment->comment_author ); ?>" tabindex="1" id="name" /></td>
<td><input type="text" name="newcomment_author" size="30" value="<?php echo attr( $comment->comment_author ); ?>" tabindex="1" id="name" /></td>
</tr>
<tr valign="top">
<td class="first">
Expand Down
2 changes: 1 addition & 1 deletion wp-admin/edit-link-category-form.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -67,7 +67,7 @@ function _fill_empty_link_category(&$category) {
</tr>
<tr class="form-field">
<th scope="row" valign="top"><label for="slug"><?php _e('Link Category slug') ?></label></th>
<td><input name="slug" id="slug" type="text" value="<?php echo attribute_escape(apply_filters('editable_slug', $category->slug)); ?>" size="40" /><br />
<td><input name="slug" id="slug" type="text" value="<?php echo attr(apply_filters('editable_slug', $category->slug)); ?>" size="40" /><br />
<?php _e('The &#8220;slug&#8221; is the URL-friendly version of the name. It is usually all lowercase and contains only letters, numbers, and hyphens.'); ?></td>
</tr>
<tr class="form-field">
Expand Down
2 changes: 1 addition & 1 deletion wp-admin/edit-link-form.php
View file
Original file line number Diff line number Diff line change
Expand Up @@ -404,7 +404,7 @@ function link_advanced_meta_box($link) {
if ( $link_id ) : ?>
<input type="hidden" name="action" value="save" />
<input type="hidden" name="link_id" value="<?php echo (int) $link_id; ?>" />
<input type="hidden" name="order_by" value="<?php echo attribute_escape($order_by); ?>" />
<input type="hidden" name="order_by" value="<?php echo attr($order_by); ?>" />
<input type="hidden" name="cat_id" value="<?php echo (int) $cat_id ?>" />
<?php else: ?>
<input type="hidden" name="action" value="add" />
Expand Down
Loading

0 comments on commit 2d48976

Please sign in to comment.