Wordpress 2.0.11

[autoinstalls/wordpress.git] / wp-admin / categories.php

diff --git a/wp-admin/categories.php b/wp-admin/categories.php
index 79163a985cd67bb9ef6c69516e590ac8c51495aa..d26a847bbbc38b8ab61dd5107fe5354cb4af7653 100644 (file)
--- a/wp-admin/categories.php
+++ b/wp-admin/categories.php
@@ -25,31 +25,34 @@ switch($action) {
 
 case 'addcat':
 
+       check_admin_referer('add-category');
+
        if ( !current_user_can('manage_categories') )
                die (__('Cheatin’ uh?'));
        
        wp_insert_category($_POST);
 
-       header('Location: categories.php?message=1#addcat');
+       wp_redirect('categories.php?message=1#addcat');
+       exit;
 break;
 
 case 'delete':
-
-       check_admin_referer();
+       $cat_ID = (int) $_GET['cat_ID'];
+       check_admin_referer('delete-category_' .  $cat_ID);
 
        if ( !current_user_can('manage_categories') )
                die (__('Cheatin’ uh?'));
 
-       $cat_ID = (int) $_GET['cat_ID'];
        $cat_name = get_catname($cat_ID);
 
-       if ( 1 == $cat_ID )
+       // Don't delete the default cats.
+       if ( $cat_ID == get_option('default_category') )
                die(sprintf(__("Can't delete the <strong>%s</strong> category: this is the default one"), $cat_name));
 
        wp_delete_category($cat_ID);
 
-       header('Location: categories.php?message=2');
-
+       wp_redirect('categories.php?message=2');
+       exit;
 break;
 
 case 'edit':
@@ -62,15 +65,16 @@ case 'edit':
 <div class="wrap">
  <h2><?php _e('Edit Category') ?></h2>
  <form name="editcat" action="categories.php" method="post">
+         <?php wp_nonce_field('update-category_' .  $category->cat_ID); ?>
          <table class="editform" width="100%" cellspacing="2" cellpadding="5">
                <tr>
                  <th width="33%" scope="row"><?php _e('Category name:') ?></th>
-                 <td width="67%"><input name="cat_name" type="text" value="<?php echo wp_specialchars($category->cat_name); ?>" size="40" /> <input type="hidden" name="action" value="editedcat" />
+                 <td width="67%"><input name="cat_name" type="text" value="<?php echo attribute_escape($category->cat_name); ?>" size="40" /> <input type="hidden" name="action" value="editedcat" />
 <input type="hidden" name="cat_ID" value="<?php echo $category->cat_ID ?>" /></td>
                </tr>
                <tr>
                        <th scope="row"><?php _e('Category slug:') ?></th>
-                       <td><input name="category_nicename" type="text" value="<?php echo wp_specialchars($category->category_nicename); ?>" size="40" /></td>
+                       <td><input name="category_nicename" type="text" value="<?php echo attribute_escape($category->category_nicename); ?>" size="40" /></td>
                </tr>
                <tr>
                        <th scope="row"><?php _e('Category parent:') ?></th>
@@ -82,7 +86,7 @@ case 'edit':
                </tr>
                <tr>
                        <th scope="row"><?php _e('Description:') ?></th>
-                       <td><textarea name="category_description" rows="5" cols="50" style="width: 97%;"><?php echo wp_specialchars($category->category_description, 1); ?></textarea></td>
+                       <td><textarea name="category_description" rows="5" cols="50" style="width: 97%;"><?php echo wp_specialchars($category->category_description); ?></textarea></td>
                </tr>
                </table>
          <p class="submit"><input type="submit" name="submit" value="<?php _e('Edit category') ?> &raquo;" /></p>
@@ -94,12 +98,16 @@ case 'edit':
 break;
 
 case 'editedcat':
+       $cat_ID = (int) $_POST['cat_ID'];
+       check_admin_referer('update-category_' . $cat_ID);
+
        if ( !current_user_can('manage_categories') )
                die (__('Cheatin&#8217; uh?'));
        
        wp_update_category($_POST);
 
-       header('Location: categories.php?message=3');
+       wp_redirect('categories.php?message=3');
+       exit;
 break;
 
 default:
@@ -146,7 +154,7 @@ cat_rows();
 <div class="wrap">
     <h2><?php _e('Add New Category') ?></h2>
     <form name="addcat" id="addcat" action="categories.php" method="post">
-        
+    <?php wp_nonce_field('add-category'); ?>
         <p><?php _e('Name:') ?><br />
         <input type="text" name="cat_name" value="" /></p>
         <p><?php _e('Category parent:') ?><br />