vhad/wordpress-develop
1
0
Fork 0
mirror of https://github.com/gosticks/wordpress-develop.git synced 2026-08-11 12:20:22 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

esc_textarea() and application for obvious textarea escaping. props alexkingorg. fixes #15454

Browse Source 
git-svn-id: https://develop.svn.wordpress.org/trunk@16431 602fd350-edb4-49c9-b593-d223f7449a82
This commit is contained in:
Mark Jaquith
2010-11-17 17:12:01 +00:00
parent b9b0431d29
commit 55e0256967
22 changed files with 48 additions and 35 deletions
Download Patch File Download Diff File Expand all files Collapse all files
wp-admin/includes/class-wp-comments-list-table.php
+1 -1
View File
@@ -350,7 +350,7 @@ class WP_Comments_List_Table extends WP_List_Table {
comment_text();
if ( $user_can ) { ?>
<div id="inline-<?php echo $comment->comment_ID; ?>" class="hidden">
<textarea class="comment" rows="1" cols="1"><?php echo esc_html( apply_filters( 'comment_edit_pre', $comment->comment_content ) ); ?></textarea>
<textarea class="comment" rows="1" cols="1"><?php echo esc_textarea( apply_filters( 'comment_edit_pre', $comment->comment_content ) ); ?></textarea>
<div class="author-email"><?php echo esc_attr( $comment->comment_author_email ); ?></div>
<div class="author"><?php echo esc_attr( $comment->comment_author ); ?></div>
<div class="author-url"><?php echo esc_attr( $comment->comment_author_url ); ?></div>
wp-admin/includes/dashboard.php
+1 -1
View File
@@ -518,7 +518,7 @@ function wp_dashboard_quick_press_output() {
<h4 id="content-label"><label for="content"><?php _e('Content') ?></label></h4>
<div class="textarea-wrap">
<textarea name="content" id="content" class="mceEditor" rows="3" cols="15" tabindex="2"><?php echo $post->post_content; ?></textarea>
<textarea name="content" id="content" class="mceEditor" rows="3" cols="15" tabindex="2"><?php echo esc_textarea( $post->post_content ); ?></textarea>
</div>
<script type="text/javascript">edCanvas = document.getElementById('content');edInsertContent = null;</script>
wp-admin/includes/media.php
+1 -1
View File
@@ -1282,7 +1282,7 @@ function get_media_item( $attachment_id, $args = null ) {
if ( !empty( $field[ $field['input'] ] ) )
$item .= $field[ $field['input'] ];
elseif ( $field['input'] == 'textarea' ) {
$item .= "<textarea type='text' id='$name' name='$name' $aria_required>" . esc_html( $field['value'] ) . '</textarea>';
$item .= "<textarea type='text' id='$name' name='$name' $aria_required>" . esc_textarea( $field['value'] ) . '</textarea>';
} else {
$item .= "<input type='text' class='text' id='$name' name='$name' value='" . esc_attr( $field['value'] ) . "' $aria_required />";
}
wp-admin/includes/meta-boxes.php
+3 -3
View File
@@ -285,7 +285,7 @@ function post_tags_meta_box($post, $box) {
<div class="jaxtag">
<div class="nojs-tags hide-if-js">
<p><?php echo $taxonomy->labels->add_or_remove_items; ?></p>
<textarea name="<?php echo "tax_input[$tax_name]"; ?>" rows="3" cols="20" class="the-tags" id="tax-input-<?php echo $tax_name; ?>" <?php echo $disabled; ?>><?php echo esc_attr(get_terms_to_edit( $post->ID, $tax_name )); ?></textarea></div>
<textarea name="<?php echo "tax_input[$tax_name]"; ?>" rows="3" cols="20" class="the-tags" id="tax-input-<?php echo $tax_name; ?>" <?php echo $disabled; ?>><?php echo esc_textarea( get_terms_to_edit( $post->ID, $tax_name ) ); ?></textarea></div>
<?php if ( current_user_can($taxonomy->cap->assign_terms) ) : ?>
<div class="ajaxtag hide-if-no-js">
<label class="screen-reader-text" for="new-tag-<?php echo $tax_name; ?>"><?php echo $box['title']; ?></label>
@@ -385,7 +385,7 @@ function post_categories_meta_box( $post, $box ) {
*/
function post_excerpt_meta_box($post) {
?>
<label class="screen-reader-text" for="excerpt"><?php _e('Excerpt') ?></label><textarea rows="1" cols="40" name="excerpt" tabindex="6" id="excerpt"><?php echo $post->post_excerpt ?></textarea>
<label class="screen-reader-text" for="excerpt"><?php _e('Excerpt') ?></label><textarea rows="1" cols="40" name="excerpt" tabindex="6" id="excerpt"><?php echo esc_textarea( $post->post_excerpt ); ?></textarea>
<p><?php _e('Excerpts are optional hand-crafted summaries of your content that can be used in your theme. <a href="http://codex.wordpress.org/Excerpt" target="_blank">Learn more about manual excerpts.</a>'); ?></p>
<?php
}
@@ -894,7 +894,7 @@ function link_advanced_meta_box($link) {
</tr>
<tr class="form-field">
<th valign="top" scope="row"><label for="link_notes"><?php _e('Notes') ?></label></th>
<td><textarea name="link_notes" id="link_notes" cols="50" rows="10" style="width: 95%"><?php echo ( isset( $link->link_notes ) ? $link->link_notes : ''); ?></textarea></td>
<td><textarea name="link_notes" id="link_notes" cols="50" rows="10" style="width: 95%"><?php echo esc_textarea( ( isset( $link->link_notes ) ? $link->link_notes : '') ); ?></textarea></td>
</tr>
<tr class="form-field">
<th valign="top" scope="row"><label for="link_rating"><?php _e('Rating') ?></label></th>
wp-admin/includes/nav-menu.php
+1 -1
View File
@@ -161,7 +161,7 @@ class Walker_Nav_Menu_Edit extends Walker_Nav_Menu {
<p class="field-description description description-wide">
<label for="edit-menu-item-description-<?php echo $item_id; ?>">
<?php _e( 'Description' ); ?><br />
<textarea id="edit-menu-item-description-<?php echo $item_id; ?>" class="widefat edit-menu-item-description" rows="3" cols="20" name="menu-item-description[<?php echo $item_id; ?>]"><?php echo esc_html( $item->description ); ?></textarea>
<textarea id="edit-menu-item-description-<?php echo $item_id; ?>" class="widefat edit-menu-item-description" rows="3" cols="20" name="menu-item-description[<?php echo $item_id; ?>]"><?php echo esc_textarea( $item->description ); ?></textarea>
<span class="description"><?php _e('The description will be displayed in the menu if the current theme supports it.'); ?></span>
</label>
</p>
wp-admin/includes/template.php
+2 -2
View File
@@ -483,7 +483,7 @@ function _list_meta_row( $entry, &$count ) {
}
$entry['meta_key'] = esc_attr($entry['meta_key']);
$entry['meta_value'] = htmlspecialchars($entry['meta_value']); // using a <textarea />
$entry['meta_value'] = esc_textarea( $entry['meta_value'] ); // using a <textarea />
$entry['meta_id'] = (int) $entry['meta_id'];
$delete_nonce = wp_create_nonce( 'delete-meta_' . $entry['meta_id'] );
@@ -718,7 +718,7 @@ function the_attachment_links( $id = false ) {
<col class="widefat" />
<tr>
<th scope="row"><?php _e( 'URL' ) ?></th>
<td><textarea rows="1" cols="40" type="text" class="attachmentlinks" readonly="readonly"><?php echo wp_get_attachment_url(); ?></textarea></td>
<td><textarea rows="1" cols="40" type="text" class="attachmentlinks" readonly="readonly"><?php echo esc_textarea( wp_get_attachment_url() ); ?></textarea></td>
</tr>
<?php if ( $icon ) : ?>
<tr>