Wordpress 2.0.11

[autoinstalls/wordpress.git] / wp-trackback.php

diff --git a/wp-trackback.php b/wp-trackback.php
index fb7845eebd87aa77259c290e540c646702558384..ae6ed41192c486242d9fbac7277824ff029367eb 100644 (file)
--- a/wp-trackback.php
+++ b/wp-trackback.php
@@ -30,11 +30,13 @@ if ( !$_GET['tb_id'] ) {
        $tb_id = intval( $tb_id[ count($tb_id) - 1 ] );
 }
 
-$tb_url    = $_POST['url'];
-$title     = $_POST['title'];
-$excerpt   = $_POST['excerpt'];
-$blog_name = $_POST['blog_name'];
-$charset   = $_POST['charset'];
+$tb_url  = $_POST['url'];
+$charset = $_POST['charset'];
+
+// These three are stripslashed here so that they can be properly escaped after mb_convert_encoding()
+$title     = stripslashes($_POST['title']);
+$excerpt   = stripslashes($_POST['excerpt']);
+$blog_name = stripslashes($_POST['blog_name']);
 
 if ($charset)
        $charset = strtoupper( trim($charset) );
@@ -42,11 +44,16 @@ else
        $charset = 'ASCII, UTF-8, ISO-8859-1, JIS, EUC-JP, SJIS';
 
 if ( function_exists('mb_convert_encoding') ) { // For international trackbacks
-       $title     = mb_convert_encoding($title, get_settings('blog_charset'), $charset);
-       $excerpt   = mb_convert_encoding($excerpt, get_settings('blog_charset'), $charset);
-       $blog_name = mb_convert_encoding($blog_name, get_settings('blog_charset'), $charset);
+       $title     = mb_convert_encoding($title, get_option('blog_charset'), $charset);
+       $excerpt   = mb_convert_encoding($excerpt, get_option('blog_charset'), $charset);
+       $blog_name = mb_convert_encoding($blog_name, get_option('blog_charset'), $charset);
 }
 
+// Now that mb_convert_encoding() has been given a swing, we need to escape these three
+$title     = $wpdb->escape($title);
+$excerpt   = $wpdb->escape($excerpt);
+$blog_name = $wpdb->escape($blog_name);
+
 if ( is_single() || is_page() ) 
     $tb_id = $posts[0]->ID;
 
@@ -55,7 +62,7 @@ if ( !intval( $tb_id ) )
 
 if (empty($title) && empty($tb_url) && empty($blog_name)) {
        // If it doesn't look like a trackback at all...
-       header('Location: ' . get_permalink($tb_id));
+       wp_redirect(get_permalink($tb_id));
        exit;
 }
 
@@ -77,7 +84,7 @@ if ( !empty($tb_url) && !empty($title) && !empty($tb_url) ) {
                $title = (strlen($title) > 250) ? substr($title, 0, 250) . '...' : $title;
        }
 
-       $comment_post_ID = $tb_id;
+       $comment_post_ID = (int) $tb_id;
        $comment_author = $blog_name;
        $comment_author_email = '';
        $comment_author_url = $tb_url;