Wordpress 2.8.5-scripts

[autoinstalls/wordpress.git] / wp-admin / export.php

diff --git a/wp-admin/export.php b/wp-admin/export.php
index dbe1b143c8c70ce25dfba846bbdc02dc0991d2ad..807ef0faf8ee8a65b4e692f012ac731d2ac07d3c 100644 (file)
--- a/wp-admin/export.php
+++ b/wp-admin/export.php
@@ -9,6 +9,9 @@
 /** Load WordPress Bootstrap */
 require_once ('admin.php');
 
 /** Load WordPress Bootstrap */
 require_once ('admin.php');
 

+if ( !current_user_can('edit_files') )
+       wp_die(__('You do not have sufficient permissions to export the content of this blog.'));
+

 /** Load WordPress export API */
 require_once('includes/export.php');
 $title = __('Export');
 /** Load WordPress export API */
 require_once('includes/export.php');
 $title = __('Export');


@@ -24,7 +27,7 @@ require_once ('admin-header.php');
 
 <div class="wrap">
 <?php screen_icon(); ?>
 
 <div class="wrap">
 <?php screen_icon(); ?>

-<h2><?php echo wp_specialchars( $title ); ?></h2>
+<h2><?php echo esc_html( $title ); ?></h2>

 
 <p><?php _e('When you click the button below WordPress will create an XML file for you to save to your computer.'); ?></p>
 <p><?php _e('This format, which we call WordPress eXtended RSS or WXR, will contain your posts, pages, comments, custom fields, categories, and tags.'); ?></p>
 
 <p><?php _e('When you click the button below WordPress will create an XML file for you to save to your computer.'); ?></p>
 <p><?php _e('This format, which we call WordPress eXtended RSS or WXR, will contain your posts, pages, comments, custom fields, categories, and tags.'); ?></p>


@@ -42,14 +45,14 @@ require_once ('admin-header.php');
 $authors = $wpdb->get_col( "SELECT post_author FROM $wpdb->posts GROUP BY post_author" );
 foreach ( $authors as $id ) {
        $o = get_userdata( $id );
 $authors = $wpdb->get_col( "SELECT post_author FROM $wpdb->posts GROUP BY post_author" );
 foreach ( $authors as $id ) {
        $o = get_userdata( $id );

-       echo "<option value='$o->ID'>$o->display_name</option>";
+       echo "<option value='" . esc_attr($o->ID) . "'>$o->display_name</option>";

 }
 ?>
 </select>
 </td>
 </tr>
 </table>
 }
 ?>
 </select>
 </td>
 </tr>
 </table>

-<p class="submit"><input type="submit" name="submit" class="button" value="<?php _e('Download Export File'); ?>" />
+<p class="submit"><input type="submit" name="submit" class="button" value="<?php esc_attr_e('Download Export File'); ?>" />

 <input type="hidden" name="download" value="true" />
 </p>
 </form>
 <input type="hidden" name="download" value="true" />
 </p>
 </form>