More validation fixes. Escape some preview=true URLs, also clean up tags in edit-attachment-rows. Slight CSS tweak to match presentation to the formerly invalid HTML. props zeo, see #13383.

git-svn-id: https://develop.svn.wordpress.org/trunk@14673 602fd350-edb4-49c9-b593-d223f7449a82
This commit is contained in:
Andrew Nacin
2010-05-15 20:36:49 +00:00
parent 904ccf82e8
commit 23d6bf302c
5 changed files with 9 additions and 7 deletions
+2 -2
View File
@@ -1361,7 +1361,7 @@ function _post_row($a_post, $pending_comments, $mode) {
}
if ( in_array($post->post_status, array('pending', 'draft')) ) {
if ( current_user_can($post_type_object->cap->edit_post, $post->ID) )
$actions['view'] = '<a href="' . add_query_arg( 'preview', 'true', get_permalink($post->ID) ) . '" title="' . esc_attr(sprintf(__('Preview &#8220;%s&#8221;'), $title)) . '" rel="permalink">' . __('Preview') . '</a>';
$actions['view'] = '<a href="' . esc_url( add_query_arg( 'preview', 'true', get_permalink($post->ID) ) ) . '" title="' . esc_attr(sprintf(__('Preview &#8220;%s&#8221;'), $title)) . '" rel="permalink">' . __('Preview') . '</a>';
} elseif ( 'trash' != $post->post_status ) {
$actions['view'] = '<a href="' . get_permalink($post->ID) . '" title="' . esc_attr(sprintf(__('View &#8220;%s&#8221;'), $title)) . '" rel="permalink">' . __('View') . '</a>';
}
@@ -1583,7 +1583,7 @@ foreach ( $posts_columns as $column_name => $column_display_name ) {
}
if ( in_array($post->post_status, array('pending', 'draft')) ) {
if ( current_user_can($post_type_object->cap->edit_post, $page->ID) )
$actions['view'] = '<a href="' . add_query_arg( 'preview', 'true', get_permalink($page->ID) ) . '" title="' . esc_attr(sprintf(__('Preview &#8220;%s&#8221;'), $title)) . '" rel="permalink">' . __('Preview') . '</a>';
$actions['view'] = '<a href="' . esc_url( add_query_arg( 'preview', 'true', get_permalink($page->ID) ) ) . '" title="' . esc_attr(sprintf(__('Preview &#8220;%s&#8221;'), $title)) . '" rel="permalink">' . __('Preview') . '</a>';
} elseif ( $post->post_status != 'trash' ) {
$actions['view'] = '<a href="' . get_permalink($page->ID) . '" title="' . esc_attr(sprintf(__('View &#8220;%s&#8221;'), $title)) . '" rel="permalink">' . __('View') . '</a>';
}