X-Git-Url: https://scripts.mit.edu/gitweb/autoinstalls/wordpress.git/blobdiff_plain/ff81ee6e8304a1982a3ec4f5b134764a29d502cf..refs/tags/wordpress-2.0.11:/wp-admin/inline-uploading.php diff --git a/wp-admin/inline-uploading.php b/wp-admin/inline-uploading.php index c2334cd9..212f1159 100644 --- a/wp-admin/inline-uploading.php +++ b/wp-admin/inline-uploading.php @@ -24,6 +24,8 @@ for ($i=0; $i".__('Go back').''); wp_delete_attachment($attachment); -header("Location: ".basename(__FILE__)."?post=$post&all=$all&action=view&start=$start"); +wp_redirect(basename(__FILE__) ."?post=$post&all=$all&action=view&start=$start"); die; case 'save': +check_admin_referer('inlineuploading'); + $overrides = array('action'=>'save'); $file = wp_handle_upload($_FILES['image'], $overrides); @@ -98,7 +104,7 @@ if ( preg_match('!^image/!', $attachment['post_mime_type']) ) { add_post_meta($id, '_wp_attachment_metadata', array()); } -header("Location: ".basename(__FILE__)."?post=$post&all=$all&action=view&start=0"); +wp_redirect(basename(__FILE__) . "?post=$post&all=$all&action=view&start=0"); die(); case 'upload': @@ -137,7 +143,7 @@ if ( '' == $sort ) $attachments = $wpdb->get_results("SELECT ID, post_date, post_title, post_mime_type, guid FROM $wpdb->posts WHERE post_status = 'attachment' $and_type $and_post $and_user ORDER BY $sort LIMIT $start, $double", ARRAY_A); if ( count($attachments) == 0 ) { - header("Location: ".basename(__FILE__)."?post=$post&action=upload"); + wp_redirect( basename(__FILE__) ."?post=$post&action=upload" ); die; } elseif ( count($attachments) > $num ) { $next = $start + count($attachments) - $num; @@ -211,7 +217,7 @@ var icon = new Array(); "; $send_delete_cancel = "$__send_to_editor -$__delete +$__delete $__close "; $uwidth_sum += 128; @@ -234,7 +240,7 @@ srcb[{$ID}] = '{$image['guid']}'; $xpadding = (128 - $image['uwidth']) / 2; $ypadding = (96 - $image['uheight']) / 2; $style .= "#target{$ID} img { padding: {$ypadding}px {$xpadding}px; }\n"; - $title = htmlentities($image['post_title'], ENT_QUOTES); + $title = attribute_escape($image['post_title']); $script .= "aa[{$ID}] = ''; ab[{$ID}] = ''; imga[{$ID}] = ' $\"{$title}\"$ '; @@ -254,7 +260,7 @@ imgb[{$ID}] = ' $\"{$title}\"$ "; } else { - $title = htmlentities($attachment['post_title'], ENT_QUOTES); + $title = attribute_escape($attachment['post_title']); $filename = basename($attachment['guid']); $icon = get_attachment_icon($ID); $toggle_icon = "$__using_title"; @@ -295,8 +301,10 @@ die(__('This script was not meant to be called directly.')); +