X-Git-Url: https://scripts.mit.edu/gitweb/autoinstalls/wordpress.git/blobdiff_plain/177fd6fefd2e3d5a0ea6591c71d660cabdb3c1a4..672d6bc6da735e745275ef7a86341dc1178da8d2:/wp-admin/export.php

diff --git a/wp-admin/export.php b/wp-admin/export.php
index 99505e4a..807ef0fa 100644
--- a/wp-admin/export.php
+++ b/wp-admin/export.php
@@ -1,11 +1,24 @@
 <?php
+/**
+ * WordPress Export Administration Panel
+ *
+ * @package WordPress
+ * @subpackage Administration
+ */
+
+/** Load WordPress Bootstrap */
 require_once ('admin.php');
+
+if ( !current_user_can('edit_files') )
+	wp_die(__('You do not have sufficient permissions to export the content of this blog.'));
+
+/** Load WordPress export API */
 require_once('includes/export.php');
 $title = __('Export');
-$parent_file = 'edit.php';
 
 if ( isset( $_GET['download'] ) ) {
-	export_wp( $_GET['author'] );
+	$author = isset($_GET['author']) ? $_GET['author'] : 'all';
+	export_wp( $author );
 	die();
 }
 
@@ -13,7 +26,9 @@ require_once ('admin-header.php');
 ?>
 
 <div class="wrap">
-<h2><?php _e('Export'); ?></h2>
+<?php screen_icon(); ?>
+<h2><?php echo esc_html( $title ); ?></h2>
+
 <p><?php _e('When you click the button below WordPress will create an XML file for you to save to your computer.'); ?></p>
 <p><?php _e('This format, which we call WordPress eXtended RSS or WXR, will contain your posts, pages, comments, custom fields, categories, and tags.'); ?></p>
 <p><?php _e('Once you&#8217;ve saved the download file, you can use the Import function on another WordPress blog to import this blog.'); ?></p>
@@ -22,22 +37,22 @@ require_once ('admin-header.php');
 
 <table class="form-table">
 <tr>
-<th><?php _e('Restrict Author'); ?></th>
+<th><label for="author"><?php _e('Restrict Author'); ?></label></th>
 <td>
-<select name="author">
+<select name="author" id="author">
 <option value="all" selected="selected"><?php _e('All Authors'); ?></option>
 <?php
 $authors = $wpdb->get_col( "SELECT post_author FROM $wpdb->posts GROUP BY post_author" );
 foreach ( $authors as $id ) {
 	$o = get_userdata( $id );
-	echo "<option value='$o->ID'>$o->display_name</option>";
+	echo "<option value='" . esc_attr($o->ID) . "'>$o->display_name</option>";
 }
 ?>
 </select>
 </td>
 </tr>
 </table>
-<p class="submit"><input type="submit" name="submit" value="<?php _e('Download Export File'); ?>" />
+<p class="submit"><input type="submit" name="submit" class="button" value="<?php esc_attr_e('Download Export File'); ?>" />
 <input type="hidden" name="download" value="true" />
 </p>
 </form>