]> scripts.mit.edu Git - autoinstalls/wordpress.git/commitdiff
Wordpress 2.0.11 wordpress-2.0.11
authorEdward Z. Yang <ezyang@mit.edu>
Fri, 20 Nov 2009 21:54:34 +0000 (16:54 -0500)
committerEdward Z. Yang <ezyang@mit.edu>
Fri, 20 Nov 2009 21:54:34 +0000 (16:54 -0500)
Signed-off-by: Edward Z. Yang <ezyang@mit.edu>
89 files changed:
readme.html
wp-admin/admin-db.php
wp-admin/admin-footer.php
wp-admin/admin-functions.php
wp-admin/bookmarklet.php
wp-admin/categories.php
wp-admin/edit-comments.php
wp-admin/edit-form-advanced.php
wp-admin/edit-form-comment.php
wp-admin/edit-form.php
wp-admin/edit-link-form.php
wp-admin/edit-page-form.php
wp-admin/edit-pages.php
wp-admin/edit.php
wp-admin/import/blogger.php
wp-admin/import/dotclear.php
wp-admin/import/greymatter.php
wp-admin/import/livejournal.php
wp-admin/import/mt.php
wp-admin/import/rss.php
wp-admin/import/textpattern.php
wp-admin/index.php
wp-admin/inline-uploading.php
wp-admin/install.php
wp-admin/link-categories.php
wp-admin/link-import.php
wp-admin/link-manager.php
wp-admin/menu.php
wp-admin/moderation.php
wp-admin/options-discussion.php
wp-admin/options-general.php
wp-admin/options-misc.php
wp-admin/options-permalink.php
wp-admin/options.php
wp-admin/page-new.php
wp-admin/plugins.php
wp-admin/post.php
wp-admin/profile.php
wp-admin/templates.php
wp-admin/theme-editor.php
wp-admin/upgrade-schema.php
wp-admin/upgrade.php
wp-admin/user-edit.php
wp-admin/users.php
wp-admin/wp-admin.css
wp-comments-post.php
wp-content/plugins/akismet/akismet.gif [new file with mode: 0644]
wp-content/plugins/akismet/akismet.php
wp-content/plugins/wp-db-backup.php
wp-content/themes/classic/comments-popup.php
wp-content/themes/classic/sidebar.php
wp-content/themes/default/comments-popup.php
wp-content/themes/default/functions.php
wp-content/themes/default/searchform.php
wp-includes/cache.php
wp-includes/class-snoopy.php
wp-includes/classes.php
wp-includes/comment-functions.php
wp-includes/default-filters.php
wp-includes/feed-functions.php
wp-includes/functions-formatting.php
wp-includes/functions-post.php
wp-includes/functions.php
wp-includes/gettext.php
wp-includes/js/tinymce/plugins/inlinepopups/editor_plugin.js [deleted file]
wp-includes/js/tinymce/plugins/inlinepopups/editor_plugin_src.js [deleted file]
wp-includes/js/tinymce/plugins/inlinepopups/readme.txt [deleted file]
wp-includes/js/tinymce/tiny_mce_gzip.php
wp-includes/js/tinymce/wp-mce-help.php
wp-includes/kses.php
wp-includes/links.php
wp-includes/pluggable-functions.php
wp-includes/registration-functions.php
wp-includes/rss-functions.php
wp-includes/template-functions-author.php
wp-includes/template-functions-category.php
wp-includes/template-functions-general.php
wp-includes/template-functions-links.php
wp-includes/template-functions-post.php
wp-includes/version.php
wp-includes/wp-db.php
wp-links-opml.php
wp-login.php
wp-mail.php
wp-register.php
wp-rss2.php
wp-settings.php
wp-trackback.php
xmlrpc.php

index 2a630165aa30955ea94d99f019d85ca11a20fdb4..ae746367d6a73f0f1400a7b4055eee6e791b13cc 100644 (file)
@@ -80,7 +80,7 @@
        <dt><a href="http://wordpress.org/support/">WordPress Support Forums</a></dt>
        <dd>If you've looked everywhere and still can't find an answer, the support forums are very active and have a large community ready to help. To help them help you be sure to use a descriptive thread title and describe your question in as much detail as possible. </dd>
        <dt><a href="http://codex.wordpress.org/IRC">WordPress IRC Channel</a></dt>
        <dt><a href="http://wordpress.org/support/">WordPress Support Forums</a></dt>
        <dd>If you've looked everywhere and still can't find an answer, the support forums are very active and have a large community ready to help. To help them help you be sure to use a descriptive thread title and describe your question in as much detail as possible. </dd>
        <dt><a href="http://codex.wordpress.org/IRC">WordPress IRC Channel</a></dt>
-       <dd>Finally, there is an online chat channel that is used for discussion amoung people who use WordPress and occasionally support topics. The above wiki page should point you in the right direction. (irc.freenode.net #wordpresss) </dd>
+       <dd>Finally, there is an online chat channel that is used for discussion among people who use WordPress and occasionally support topics. The above wiki page should point you in the right direction. (irc.freenode.net #wordpress) </dd>
 </dl>
 
 <h1 id="requirements">System Recommendations</h1>
 </dl>
 
 <h1 id="requirements">System Recommendations</h1>
index d81b6b845a36e5e3a0bf7aa872f6ccac58737ad1..d909ee67cb630aaf07f64f278c1d2721a4dc7c3d 100644 (file)
@@ -34,7 +34,7 @@ function get_editable_authors( $user_id ) {
                return false;
        } else {
                $editable = join(',', $editable);
                return false;
        } else {
                $editable = join(',', $editable);
-               $authors = $wpdb->get_results( "SELECT * FROM $wpdb->users WHERE ID IN ($editable)" );
+               $authors = $wpdb->get_results( "SELECT * FROM $wpdb->users WHERE ID IN ($editable) ORDER BY display_name" );
        }
 
        return apply_filters('get_editable_authors', $authors);
        }
 
        return apply_filters('get_editable_authors', $authors);
@@ -110,7 +110,7 @@ function wp_insert_category($catarr) {
 
        if (!$update) {
                $wpdb->query("INSERT INTO $wpdb->categories (cat_ID, cat_name, category_nicename, category_description, category_parent) VALUES ('0', '$cat_name', '$category_nicename', '$category_description', '$category_parent')");
 
        if (!$update) {
                $wpdb->query("INSERT INTO $wpdb->categories (cat_ID, cat_name, category_nicename, category_description, category_parent) VALUES ('0', '$cat_name', '$category_nicename', '$category_description', '$category_parent')");
-               $cat_ID = $wpdb->insert_id;
+               $cat_ID = (int) $wpdb->insert_id;
        } else {
                $wpdb->query ("UPDATE $wpdb->categories SET cat_name = '$cat_name', category_nicename = '$category_nicename', category_description = '$category_description', category_parent = '$category_parent' WHERE cat_ID = '$cat_ID'");
        }
        } else {
                $wpdb->query ("UPDATE $wpdb->categories SET cat_name = '$cat_name', category_nicename = '$category_nicename', category_description = '$category_description', category_parent = '$category_parent' WHERE cat_ID = '$cat_ID'");
        }
@@ -207,7 +207,7 @@ function category_exists($cat_name) {
        if (!$category_nicename = sanitize_title($cat_name))
                return 0;
 
        if (!$category_nicename = sanitize_title($cat_name))
                return 0;
 
-       return $wpdb->get_var("SELECT cat_ID FROM $wpdb->categories WHERE category_nicename = '$category_nicename'");
+       return (int) $wpdb->get_var("SELECT cat_ID FROM $wpdb->categories WHERE category_nicename = '$category_nicename'");
 }
 
 function wp_delete_user($id, $reassign = 'novalue') {
 }
 
 function wp_delete_user($id, $reassign = 'novalue') {
@@ -266,23 +266,57 @@ function wp_insert_link($linkdata) {
        extract($linkdata);
 
        $update = false;
        extract($linkdata);
 
        $update = false;
+
        if ( !empty($link_id) )
                $update = true;
 
        if ( !empty($link_id) )
                $update = true;
 
+       $link_id = (int) $link_id;
+
+       if( trim( $link_name ) == '' )
+               return 0;
+       $link_name = apply_filters('pre_link_name', $link_name);
+
+       if( trim( $link_url ) == '' )
+               return 0;
+       $link_url = apply_filters('pre_link_url', $link_url);
+
        if ( empty($link_rating) )
                $link_rating = 0;       
        if ( empty($link_rating) )
                $link_rating = 0;       
+       else
+               $link_rating = (int) $link_rating;
+
+       if ( empty($link_image) )
+               $link_image = '';
+       $link_image = apply_filters('pre_link_image', $link_image);
 
        if ( empty($link_target) )
                $link_target = '';      
 
        if ( empty($link_target) )
                $link_target = '';      
+       $link_target = apply_filters('pre_link_target', $link_target);
 
        if ( empty($link_visible) )
                $link_visible = 'Y';
 
        if ( empty($link_visible) )
                $link_visible = 'Y';
-               
+       $link_visibile = preg_replace('/[^YNyn]/', '', $link_visible);
+
        if ( empty($link_owner) )
                $link_owner = $current_user->id;
        if ( empty($link_owner) )
                $link_owner = $current_user->id;
+       else
+               $link_owner = (int) $link_owner;
 
        if ( empty($link_notes) )
                $link_notes = '';
 
        if ( empty($link_notes) )
                $link_notes = '';
+       $link_notes = apply_filters('pre_link_notes', $link_notes);
+
+       if ( empty($link_description) )
+               $link_description = '';
+       $link_description = apply_filters('pre_link_description', $link_description);
+
+       if ( empty($link_rss) )
+               $link_rss = '';
+       $link_rss = apply_filters('pre_link_rss', $link_rss);
+
+       if ( empty($link_rel) )
+               $link_rel = '';
+       $link_rel = apply_filters('pre_link_rel', $link_rel);
 
        if ( $update ) {
                $wpdb->query("UPDATE $wpdb->links SET link_url='$link_url',
 
        if ( $update ) {
                $wpdb->query("UPDATE $wpdb->links SET link_url='$link_url',
@@ -294,7 +328,7 @@ function wp_insert_link($linkdata) {
                        WHERE link_id='$link_id'");
        } else {
                $wpdb->query("INSERT INTO $wpdb->links (link_url, link_name, link_image, link_target, link_category, link_description, link_visible, link_owner, link_rating, link_rel, link_notes, link_rss) VALUES('$link_url','$link_name', '$link_image', '$link_target', '$link_category', '$link_description', '$link_visible', '$link_owner', '$link_rating', '$link_rel', '$link_notes', '$link_rss')");
                        WHERE link_id='$link_id'");
        } else {
                $wpdb->query("INSERT INTO $wpdb->links (link_url, link_name, link_image, link_target, link_category, link_description, link_visible, link_owner, link_rating, link_rel, link_notes, link_rss) VALUES('$link_url','$link_name', '$link_image', '$link_target', '$link_category', '$link_description', '$link_visible', '$link_owner', '$link_rating', '$link_rel', '$link_notes', '$link_rss')");
-               $link_id = $wpdb->insert_id;
+               $link_id = (int) $wpdb->insert_id;
        }
        
        if ( $update )
        }
        
        if ( $update )
index e660be287f81940c91077131415a34e2eac4f5d7..88e69ae4838e4ca68ab50bd56ec08404dc59e5ed 100644 (file)
@@ -2,7 +2,7 @@
 <div id="footer"><p><a href="http://wordpress.org/" id="wordpress-logo"><img src="images/wordpress-logo.png" alt="WordPress" /></a></p>
 <p>
 <a href="http://codex.wordpress.org/"><?php _e('Documentation'); ?></a> &#8212; <a href="http://wordpress.org/support/"><?php _e('Support Forums'); ?></a> <br />
 <div id="footer"><p><a href="http://wordpress.org/" id="wordpress-logo"><img src="images/wordpress-logo.png" alt="WordPress" /></a></p>
 <p>
 <a href="http://codex.wordpress.org/"><?php _e('Documentation'); ?></a> &#8212; <a href="http://wordpress.org/support/"><?php _e('Support Forums'); ?></a> <br />
-<?php bloginfo('version'); ?> &#8212; <?php printf(__('%s seconds'), number_format(timer_stop(), 2)); ?>
+<?php bloginfo('version'); ?> &#8212; <?php printf(__('%s seconds'), timer_stop(0, 2)); ?>
 </p>
 
 </div>
 </p>
 
 </div>
index 6b9be7541bd285ffde44e2c27ca76f576a522518..641ed1e2274ff48ed0a614b6f697031eed61b1ee 100644 (file)
@@ -265,6 +265,8 @@ function get_post_to_edit($id) {
        $post->post_title = format_to_edit($post->post_title);
        $post->post_title = apply_filters('title_edit_pre', $post->post_title);
 
        $post->post_title = format_to_edit($post->post_title);
        $post->post_title = apply_filters('title_edit_pre', $post->post_title);
 
+    $post->post_password = format_to_edit($post->post_password); 
+
        if ($post->post_status == 'static')
                $post->page_template = get_post_meta($id, '_wp_page_template', true);
 
        if ($post->post_status == 'static')
                $post->page_template = get_post_meta($id, '_wp_page_template', true);
 
@@ -287,7 +289,7 @@ function get_default_post_to_edit() {
        else if ( !empty($post_title) ) {
                $text       = wp_specialchars(stripslashes(urldecode($_REQUEST['text'])));
                $text       = funky_javascript_fix($text);
        else if ( !empty($post_title) ) {
                $text       = wp_specialchars(stripslashes(urldecode($_REQUEST['text'])));
                $text       = funky_javascript_fix($text);
-               $popupurl   = wp_specialchars($_REQUEST['popupurl']);
+               $popupurl   = clean_url(stripslashes($_REQUEST['popupurl']));
         $post_content = '<a href="'.$popupurl.'">'.$post_title.'</a>'."\n$text";
     }
 
         $post_content = '<a href="'.$popupurl.'">'.$post_title.'</a>'."\n$text";
     }
 
@@ -317,11 +319,15 @@ function get_comment_to_edit($id) {
 
        $comment = get_comment($id);
 
 
        $comment = get_comment($id);
 
-       $comment->comment_content = format_to_edit($comment->comment_content, $richedit);
+       $comment->comment_ID = (int) $comment->comment_ID;
+       $comment->comment_post_ID = (int) $comment->comment_post_ID;
+
+       $comment->comment_content = format_to_edit($comment->comment_content);
        $comment->comment_content = apply_filters('comment_edit_pre', $comment->comment_content);
 
        $comment->comment_author = format_to_edit($comment->comment_author);
        $comment->comment_author_email = format_to_edit($comment->comment_author_email);
        $comment->comment_content = apply_filters('comment_edit_pre', $comment->comment_content);
 
        $comment->comment_author = format_to_edit($comment->comment_author);
        $comment->comment_author_email = format_to_edit($comment->comment_author_email);
+       $comment->comment_author_url = clean_url($comment->comment_author_url);
        $comment->comment_author_url = format_to_edit($comment->comment_author_url);
 
        return $comment;
        $comment->comment_author_url = format_to_edit($comment->comment_author_url);
 
        return $comment;
@@ -333,6 +339,23 @@ function get_category_to_edit($id) {
        return $category;
 }
 
        return $category;
 }
 
+function get_user_to_edit($user_id) {
+       $user = new WP_User($user_id);
+       $user->user_login   = attribute_escape($user->user_login);
+       $user->user_email   = attribute_escape($user->user_email);
+       $user->user_url     = clean_url($user->user_url);
+       $user->first_name   = attribute_escape($user->first_name);
+       $user->last_name    = attribute_escape($user->last_name);
+       $user->display_name = attribute_escape($user->display_name);
+       $user->nickname     = attribute_escape($user->nickname);
+       $user->aim          = attribute_escape($user->aim);
+       $user->yim          = attribute_escape($user->yim);
+       $user->jabber       = attribute_escape($user->jabber);
+       $user->description  =  wp_specialchars($user->description);
+
+       return $user;
+}
+
 // Creates a new user from the "Users" form using $_POST information.
 
 function add_user() {
 // Creates a new user from the "Users" form using $_POST information.
 
 function add_user() {
@@ -344,7 +367,7 @@ function edit_user($user_id = 0) {
 
        if ($user_id != 0) {
                $update = true;
 
        if ($user_id != 0) {
                $update = true;
-               $user->ID = $user_id;
+               $user->ID = (int) $user_id;
                $userdata = get_userdata($user_id);
                $user->user_login = $wpdb->escape($userdata->user_login);
        } else {
                $userdata = get_userdata($user_id);
                $user->user_login = $wpdb->escape($userdata->user_login);
        } else {
@@ -369,7 +392,7 @@ function edit_user($user_id = 0) {
        if (isset ($_POST['email']))
                $user->user_email = wp_specialchars(trim($_POST['email']));
        if (isset ($_POST['url'])) {
        if (isset ($_POST['email']))
                $user->user_email = wp_specialchars(trim($_POST['email']));
        if (isset ($_POST['url'])) {
-               $user->user_url = wp_specialchars(trim($_POST['url']));
+               $user->user_url = clean_url(trim($_POST['url']));
                $user->user_url = preg_match('/^(https?|ftps?|mailto|news|gopher):/is', $user->user_url) ? $user->user_url : 'http://'.$user->user_url;
        }
        if (isset ($_POST['first_name']))
                $user->user_url = preg_match('/^(https?|ftps?|mailto|news|gopher):/is', $user->user_url) ? $user->user_url : 'http://'.$user->user_url;
        }
        if (isset ($_POST['first_name']))
@@ -381,7 +404,7 @@ function edit_user($user_id = 0) {
        if (isset ($_POST['display_name']))
                $user->display_name = wp_specialchars(trim($_POST['display_name']));
        if (isset ($_POST['description']))
        if (isset ($_POST['display_name']))
                $user->display_name = wp_specialchars(trim($_POST['display_name']));
        if (isset ($_POST['description']))
-               $user->description = wp_specialchars(trim($_POST['description']));
+               $user->description = trim($_POST['description']);
        if (isset ($_POST['jabber']))
                $user->jabber = wp_specialchars(trim($_POST['jabber']));
        if (isset ($_POST['aim']))
        if (isset ($_POST['jabber']))
                $user->jabber = wp_specialchars(trim($_POST['jabber']));
        if (isset ($_POST['aim']))
@@ -447,24 +470,27 @@ function edit_user($user_id = 0) {
 
 function get_link_to_edit($link_id) {
        $link = get_link($link_id);
 
 function get_link_to_edit($link_id) {
        $link = get_link($link_id);
-       
-       $link->link_url = wp_specialchars($link->link_url, 1);
-       $link->link_name = wp_specialchars($link->link_name, 1);
-       $link->link_description = wp_specialchars($link->link_description);
-       $link->link_notes = wp_specialchars($link->link_notes);
-       $link->link_rss = wp_specialchars($link->link_rss);
-       
+
+       $link->link_url         =        clean_url($link->link_url);
+       $link->link_name        = attribute_escape($link->link_name);
+       $link->link_image       = attribute_escape($link->link_image);
+       $link->link_description = attribute_escape($link->link_description);
+       $link->link_rss         =        clean_url($link->link_rss);
+       $link->link_rel         = attribute_escape($link->link_rel);
+       $link->link_notes       =  wp_specialchars($link->link_notes);
+       $link->post_category    = $link->link_category;
+
        return $link;
 }
 
 function get_default_link_to_edit() {
        if ( isset($_GET['linkurl']) )
        return $link;
 }
 
 function get_default_link_to_edit() {
        if ( isset($_GET['linkurl']) )
-               $link->link_url = wp_specialchars($_GET['linkurl'], 1);
+               $link->link_url = clean_url($_GET['linkurl']);
        else
                $link->link_url = '';
        
        if ( isset($_GET['name']) )
        else
                $link->link_url = '';
        
        if ( isset($_GET['name']) )
-               $link->link_name = wp_specialchars($_GET['name'], 1);
+               $link->link_name = attribute_escape($_GET['name']);
        else
                $link->link_name = '';
                
        else
                $link->link_name = '';
                
@@ -480,10 +506,10 @@ function edit_link($link_id = '') {
                die(__("Cheatin' uh ?"));
 
        $_POST['link_url'] = wp_specialchars($_POST['link_url']);
                die(__("Cheatin' uh ?"));
 
        $_POST['link_url'] = wp_specialchars($_POST['link_url']);
-       $_POST['link_url'] = preg_match('/^(https?|ftps?|mailto|news|gopher):/is', $_POST['link_url']) ? $_POST['link_url'] : 'http://' . $_POST['link_url'];
+       $_POST['link_url'] = clean_url($_POST['link_url']);
        $_POST['link_name'] = wp_specialchars($_POST['link_name']);
        $_POST['link_image'] = wp_specialchars($_POST['link_image']);
        $_POST['link_name'] = wp_specialchars($_POST['link_name']);
        $_POST['link_image'] = wp_specialchars($_POST['link_image']);
-       $_POST['link_rss'] = wp_specialchars($_POST['link_rss']);
+       $_POST['link_rss'] = clean_url($_POST['link_rss']);
        $auto_toggle = get_autotoggle($_POST['link_category']);
        
        // if we are in an auto toggle category and this one is visible then we
        $auto_toggle = get_autotoggle($_POST['link_category']);
        
        // if we are in an auto toggle category and this one is visible then we
@@ -826,12 +852,27 @@ function list_meta($meta) {
                        $style = '';
                if ('_' == $entry['meta_key'] { 0 })
                        $style .= ' hidden';
                        $style = '';
                if ('_' == $entry['meta_key'] { 0 })
                        $style .= ' hidden';
+
+               if ( is_serialized($entry['meta_value']) ) {
+                       if ( is_serialized_string($entry['meta_value']) ) {
+                               // this is a serialized string, so we should display it
+                               $entry['meta_value'] = maybe_unserialize($entry['meta_value']);
+                       } else {
+                               // this is a serialized array/object so we should NOT display it
+                               --$count;
+                               continue;
+                       }
+               }
+
+               $entry['meta_key'] = attribute_escape( $entry['meta_key']);
+               $entry['meta_value'] = attribute_escape( $entry['meta_value']);
+               $entry['meta_id'] = (int) $entry['meta_id'];
                echo "
                        <tr class='$style'>
                                <td valign='top'><input name='meta[{$entry['meta_id']}][key]' tabindex='6' type='text' size='20' value='{$entry['meta_key']}' /></td>
                                <td><textarea name='meta[{$entry['meta_id']}][value]' tabindex='6' rows='2' cols='30'>{$entry['meta_value']}</textarea></td>
                echo "
                        <tr class='$style'>
                                <td valign='top'><input name='meta[{$entry['meta_id']}][key]' tabindex='6' type='text' size='20' value='{$entry['meta_key']}' /></td>
                                <td><textarea name='meta[{$entry['meta_id']}][value]' tabindex='6' rows='2' cols='30'>{$entry['meta_value']}</textarea></td>
-                               <td align='center'><input name='updatemeta' type='submit' class='updatemeta' tabindex='6' value='".__('Update')."' /><br />
-                               <input name='deletemeta[{$entry['meta_id']}]' type='submit' class='deletemeta' tabindex='6' value='".__('Delete')."' /></td>
+                               <td align='center'><input name='updatemeta' type='submit' class='updatemeta' tabindex='6' value='".attribute_escape(__('Update'))."' /><br />
+                               <input name='deletemeta[{$entry['meta_id']}]' type='submit' class='deletemeta' tabindex='6' value='".attribute_escape(__('Delete'))."' /></td>
                        </tr>
                ";
        }
                        </tr>
                ";
        }
@@ -876,6 +917,7 @@ function meta_form() {
 <?php
 
        foreach ($keys as $key) {
 <?php
 
        foreach ($keys as $key) {
+               $key = attribute_escape($key);
                echo "\n\t<option value='$key'>$key</option>";
        }
 ?>
                echo "\n\t<option value='$key'>$key</option>";
        }
 ?>
@@ -894,10 +936,14 @@ function meta_form() {
 
 function add_meta($post_ID) {
        global $wpdb;
 
 function add_meta($post_ID) {
        global $wpdb;
+       $post_ID = (int) $post_ID;
+
+       $protected = array( '_wp_attached_file', '_wp_attachment_metadata', '_wp_old_slug', '_wp_page_template' );
 
        $metakeyselect = $wpdb->escape(stripslashes(trim($_POST['metakeyselect'])));
        $metakeyinput = $wpdb->escape(stripslashes(trim($_POST['metakeyinput'])));
 
        $metakeyselect = $wpdb->escape(stripslashes(trim($_POST['metakeyselect'])));
        $metakeyinput = $wpdb->escape(stripslashes(trim($_POST['metakeyinput'])));
-       $metavalue = $wpdb->escape(stripslashes(trim($_POST['metavalue'])));
+       $metavalue = maybe_serialize(stripslashes((trim($_POST['metavalue']))));
+       $metavalue = $wpdb->escape($metavalue);
 
        if ( ('0' === $metavalue || !empty ($metavalue)) && ((('#NONE#' != $metakeyselect) && !empty ($metakeyselect)) || !empty ($metakeyinput)) ) {
                // We have a key/value pair. If both the select and the 
 
        if ( ('0' === $metavalue || !empty ($metavalue)) && ((('#NONE#' != $metakeyselect) && !empty ($metakeyselect)) || !empty ($metakeyinput)) ) {
                // We have a key/value pair. If both the select and the 
@@ -909,6 +955,9 @@ function add_meta($post_ID) {
                if ($metakeyinput)
                        $metakey = $metakeyinput; // default
 
                if ($metakeyinput)
                        $metakey = $metakeyinput; // default
 
+               if ( in_array($metakey, $protected) )
+                       return false;
+
                $result = $wpdb->query("
                                                INSERT INTO $wpdb->postmeta 
                                                (post_id,meta_key,meta_value) 
                $result = $wpdb->query("
                                                INSERT INTO $wpdb->postmeta 
                                                (post_id,meta_key,meta_value) 
@@ -919,6 +968,7 @@ function add_meta($post_ID) {
 
 function delete_meta($mid) {
        global $wpdb;
 
 function delete_meta($mid) {
        global $wpdb;
+       $mid = (int) $mid;
 
        $result = $wpdb->query("DELETE FROM $wpdb->postmeta WHERE meta_id = '$mid'");
 }
 
        $result = $wpdb->query("DELETE FROM $wpdb->postmeta WHERE meta_id = '$mid'");
 }
@@ -926,6 +976,14 @@ function delete_meta($mid) {
 function update_meta($mid, $mkey, $mvalue) {
        global $wpdb;
 
 function update_meta($mid, $mkey, $mvalue) {
        global $wpdb;
 
+       $protected = array( '_wp_attached_file', '_wp_attachment_metadata', '_wp_old_slug', '_wp_page_template' );
+
+       if ( in_array($mkey, $protected) )
+               return false;
+
+       $mvalue = maybe_serialize(stripslashes($mvalue));
+       $mvalue = $wpdb->escape($mvalue);
+       $mid = (int) $mid;
        return $wpdb->query("UPDATE $wpdb->postmeta SET meta_key = '$mkey', meta_value = '$mvalue' WHERE meta_id = '$mid'");
 }
 
        return $wpdb->query("UPDATE $wpdb->postmeta SET meta_key = '$mkey', meta_value = '$mvalue' WHERE meta_id = '$mid'");
 }
 
@@ -1081,15 +1139,13 @@ function save_mod_rewrite_rules() {
 }
 
 function the_quicktags() {
 }
 
 function the_quicktags() {
-       // Browser detection sucks, but until Safari supports the JS needed for this to work people just assume it's a bug in WP
-       if (!strstr($_SERVER['HTTP_USER_AGENT'], 'Safari'))
                echo '
                <div id="quicktags">
                        <script src="../wp-includes/js/quicktags.js" type="text/javascript"></script>
                        <script type="text/javascript">if ( typeof tinyMCE == "undefined" || tinyMCE.configs.length < 1 ) edToolbar();</script>
                </div>
 ';
                echo '
                <div id="quicktags">
                        <script src="../wp-includes/js/quicktags.js" type="text/javascript"></script>
                        <script type="text/javascript">if ( typeof tinyMCE == "undefined" || tinyMCE.configs.length < 1 ) edToolbar();</script>
                </div>
 ';
-       else echo '
+       echo '
 <script type="text/javascript">
 function edInsertContent(myField, myValue) {
        //IE support
 <script type="text/javascript">
 function edInsertContent(myField, myValue) {
        //IE support
@@ -1547,25 +1603,23 @@ function get_plugins() {
                }
        }
 
                }
        }
 
-       if (!$plugins_dir || !$plugin_files) {
+       if ( !$plugins_dir || !$plugin_files )
                return $wp_plugins;
                return $wp_plugins;
-       }
 
 
-       sort($plugin_files);
-
-       foreach ($plugin_files as $plugin_file) {
+       foreach ( $plugin_files as $plugin_file ) {
                if ( !is_readable("$plugin_root/$plugin_file"))
                        continue;
 
                $plugin_data = get_plugin_data("$plugin_root/$plugin_file");
 
                if ( !is_readable("$plugin_root/$plugin_file"))
                        continue;
 
                $plugin_data = get_plugin_data("$plugin_root/$plugin_file");
 
-               if (empty ($plugin_data['Name'])) {
+               if ( empty ($plugin_data['Name']) )
                        continue;
                        continue;
-               }
 
                $wp_plugins[plugin_basename($plugin_file)] = $plugin_data;
        }
 
 
                $wp_plugins[plugin_basename($plugin_file)] = $plugin_data;
        }
 
+       uasort($wp_plugins, create_function('$a, $b', 'return strnatcasecmp($a["Name"], $b["Name"]);'));
+
        return $wp_plugins;
 }
 
        return $wp_plugins;
 }
 
@@ -1774,7 +1828,8 @@ o.action.value = 'view';
 o.submit();
 }
 </script>
 o.submit();
 }
 </script>
-<form enctype="multipart/form-data" id="uploadForm" method="post" action="<?php echo $action ?>">
+<form enctype="multipart/form-data" id="uploadForm" method="post" action="<?php echo attribute_escape($action) ?>">
+<?php wp_nonce_field('import-upload'); ?>
 <label for="upload"><?php _e('File:'); ?></label><input type="file" id="upload" name="import" />
 <input type="hidden" name="action" value="save" />
 <div id="buttons">
 <label for="upload"><?php _e('File:'); ?></label><input type="file" id="upload" name="import" />
 <input type="hidden" name="action" value="save" />
 <div id="buttons">
index 195e35ccf1e69860b34b7aeec0467d95880ca2d1..2fa3c842b7c62fe864b55077b1f12f49cb09a450 100644 (file)
@@ -37,7 +37,7 @@ else
        
   
 $content  = wp_specialchars($_REQUEST['content']);
        
   
 $content  = wp_specialchars($_REQUEST['content']);
-$popupurl = wp_specialchars($_REQUEST['popupurl']);
+$popupurl = clean_url(stripslashes($_REQUEST['popupurl']));
     if ( !empty($content) ) {
         $post->post_content = wp_specialchars( stripslashes($_REQUEST['content']) );
     } else {
     if ( !empty($content) ) {
         $post->post_content = wp_specialchars( stripslashes($_REQUEST['content']) );
     } else {
index 30d37c8b4b58dd0bc2ce821297b787ceb80a270f..d26a847bbbc38b8ab61dd5107fe5354cb4af7653 100644 (file)
@@ -33,6 +33,7 @@ case 'addcat':
        wp_insert_category($_POST);
 
        wp_redirect('categories.php?message=1#addcat');
        wp_insert_category($_POST);
 
        wp_redirect('categories.php?message=1#addcat');
+       exit;
 break;
 
 case 'delete':
 break;
 
 case 'delete':
@@ -51,7 +52,7 @@ case 'delete':
        wp_delete_category($cat_ID);
 
        wp_redirect('categories.php?message=2');
        wp_delete_category($cat_ID);
 
        wp_redirect('categories.php?message=2');
-
+       exit;
 break;
 
 case 'edit':
 break;
 
 case 'edit':
@@ -68,12 +69,12 @@ case 'edit':
          <table class="editform" width="100%" cellspacing="2" cellpadding="5">
                <tr>
                  <th width="33%" scope="row"><?php _e('Category name:') ?></th>
          <table class="editform" width="100%" cellspacing="2" cellpadding="5">
                <tr>
                  <th width="33%" scope="row"><?php _e('Category name:') ?></th>
-                 <td width="67%"><input name="cat_name" type="text" value="<?php echo wp_specialchars($category->cat_name); ?>" size="40" /> <input type="hidden" name="action" value="editedcat" />
+                 <td width="67%"><input name="cat_name" type="text" value="<?php echo attribute_escape($category->cat_name); ?>" size="40" /> <input type="hidden" name="action" value="editedcat" />
 <input type="hidden" name="cat_ID" value="<?php echo $category->cat_ID ?>" /></td>
                </tr>
                <tr>
                        <th scope="row"><?php _e('Category slug:') ?></th>
 <input type="hidden" name="cat_ID" value="<?php echo $category->cat_ID ?>" /></td>
                </tr>
                <tr>
                        <th scope="row"><?php _e('Category slug:') ?></th>
-                       <td><input name="category_nicename" type="text" value="<?php echo wp_specialchars($category->category_nicename); ?>" size="40" /></td>
+                       <td><input name="category_nicename" type="text" value="<?php echo attribute_escape($category->category_nicename); ?>" size="40" /></td>
                </tr>
                <tr>
                        <th scope="row"><?php _e('Category parent:') ?></th>
                </tr>
                <tr>
                        <th scope="row"><?php _e('Category parent:') ?></th>
@@ -85,7 +86,7 @@ case 'edit':
                </tr>
                <tr>
                        <th scope="row"><?php _e('Description:') ?></th>
                </tr>
                <tr>
                        <th scope="row"><?php _e('Description:') ?></th>
-                       <td><textarea name="category_description" rows="5" cols="50" style="width: 97%;"><?php echo wp_specialchars($category->category_description, 1); ?></textarea></td>
+                       <td><textarea name="category_description" rows="5" cols="50" style="width: 97%;"><?php echo wp_specialchars($category->category_description); ?></textarea></td>
                </tr>
                </table>
          <p class="submit"><input type="submit" name="submit" value="<?php _e('Edit category') ?> &raquo;" /></p>
                </tr>
                </table>
          <p class="submit"><input type="submit" name="submit" value="<?php _e('Edit category') ?> &raquo;" /></p>
@@ -106,6 +107,7 @@ case 'editedcat':
        wp_update_category($_POST);
 
        wp_redirect('categories.php?message=3');
        wp_update_category($_POST);
 
        wp_redirect('categories.php?message=3');
+       exit;
 break;
 
 default:
 break;
 
 default:
index 88e672a7185714c09e8b1c8cbdabef9c19f9b876..ab0f0a8e46e538f8183d6304d987de7380f13718 100644 (file)
@@ -7,7 +7,7 @@ $list_js = true;
 
 require_once('admin-header.php');
 if (empty($_GET['mode'])) $mode = 'view';
 
 require_once('admin-header.php');
 if (empty($_GET['mode'])) $mode = 'view';
-else $mode = wp_specialchars($_GET['mode'], 1);
+else $mode = attribute_escape($_GET['mode']);
 ?>
 
 <script type="text/javascript">
 ?>
 
 <script type="text/javascript">
@@ -30,7 +30,7 @@ function checkAll(form)
 <form name="searchform" action="" method="get"> 
   <fieldset> 
   <legend><?php _e('Show Comments That Contain...') ?></legend> 
 <form name="searchform" action="" method="get"> 
   <fieldset> 
   <legend><?php _e('Show Comments That Contain...') ?></legend> 
-  <input type="text" name="s" value="<?php if (isset($_GET['s'])) echo wp_specialchars($_GET['s'], 1); ?>" size="17" /> 
+  <input type="text" name="s" value="<?php if (isset($_GET['s'])) echo attribute_escape($_GET['s']); ?>" size="17" /> 
   <input type="submit" name="submit" value="<?php _e('Search') ?>"  />  
   <input type="hidden" name="mode" value="<?php echo $mode; ?>" />
   <?php _e('(Searches within comment text, e-mail, URI, and IP address.)') ?>
   <input type="submit" name="submit" value="<?php _e('Search') ?>"  />  
   <input type="hidden" name="mode" value="<?php echo $mode; ?>" />
   <?php _e('(Searches within comment text, e-mail, URI, and IP address.)') ?>
@@ -44,7 +44,7 @@ if ( !empty( $_POST['delete_comments'] ) ) :
        $i = 0;
        foreach ($_POST['delete_comments'] as $comment) : // Check the permissions on each
                $comment = (int) $comment;
        $i = 0;
        foreach ($_POST['delete_comments'] as $comment) : // Check the permissions on each
                $comment = (int) $comment;
-               $post_id = $wpdb->get_var("SELECT comment_post_ID FROM $wpdb->comments WHERE comment_ID = $comment");
+               $post_id = (int) $wpdb->get_var("SELECT comment_post_ID FROM $wpdb->comments WHERE comment_ID = $comment");
                $authordata = get_userdata( $wpdb->get_var("SELECT post_author FROM $wpdb->posts WHERE ID = $post_id") );
                if ( current_user_can('edit_post', $post_id) ) :
                        wp_set_comment_status($comment, "delete");
                $authordata = get_userdata( $wpdb->get_var("SELECT post_author FROM $wpdb->posts WHERE ID = $post_id") );
                if ( current_user_can('edit_post', $post_id) ) :
                        wp_set_comment_status($comment, "delete");
index 7ac1eecda8278d888f72e83d97cb5c0f19881c8f..e7490fe25c1b385da5000a24b2152fc14917be9a 100644 (file)
@@ -1,10 +1,12 @@
 <?php
 <?php
+if ( isset($_GET['message']) )
+       $_GET['message'] = (int) $_GET['message'];
 $messages[1] = __('Post updated');
 $messages[2] = __('Custom field updated');
 $messages[3] = __('Custom field deleted.');
 ?>
 <?php if (isset($_GET['message'])) : ?>
 $messages[1] = __('Post updated');
 $messages[2] = __('Custom field updated');
 $messages[3] = __('Custom field deleted.');
 ?>
 <?php if (isset($_GET['message'])) : ?>
-<div id="message" class="updated fade"><p><?php echo $messages[$_GET['message']]; ?></p></div>
+<div id="message" class="updated fade"><p><?php echo wp_specialchars($messages[$_GET['message']]); ?></p></div>
 <?php endif; ?>
 
 <form name="post" action="post.php" method="post" id="post">
 <?php endif; ?>
 
 <form name="post" action="post.php" method="post" id="post">
@@ -24,35 +26,36 @@ if (0 == $post_ID) {
        $form_extra = "<input type='hidden' name='temp_ID' value='$temp_ID' />";
        wp_nonce_field('add-post');
 } else {
        $form_extra = "<input type='hidden' name='temp_ID' value='$temp_ID' />";
        wp_nonce_field('add-post');
 } else {
+       $post_ID = (int) $post_ID;
        $form_action = 'editpost';
        $form_extra = "<input type='hidden' name='post_ID' value='$post_ID' />";
        wp_nonce_field('update-post_' .  $post_ID);
 }
 
        $form_action = 'editpost';
        $form_extra = "<input type='hidden' name='post_ID' value='$post_ID' />";
        wp_nonce_field('update-post_' .  $post_ID);
 }
 
-$form_pingback = '<input type="hidden" name="post_pingback" value="' . get_option('default_pingback_flag') . '" id="post_pingback" />';
+$form_pingback = '<input type="hidden" name="post_pingback" value="' . (int) get_option('default_pingback_flag') . '" id="post_pingback" />'; 
 
 
-$form_prevstatus = '<input type="hidden" name="prev_status" value="' . $post->post_status . '" />';
+$form_prevstatus = '<input type="hidden" name="prev_status" value="' . attribute_escape( $post->post_status ) . '" />'; 
 
 
-$form_trackback = '<input type="text" name="trackback_url" style="width: 415px" id="trackback" tabindex="7" value="'. str_replace("\n", ' ', $post->to_ping) .'" />';
+$form_trackback = '<input type="text" name="trackback_url" style="width: 415px" id="trackback" tabindex="7" value="'. attribute_escape( str_replace("\n", ' ', $post->to_ping) ) .'" />';
 
 if ('' != $post->pinged) {
        $pings = '<p>'. __('Already pinged:') . '</p><ul>';
        $already_pinged = explode("\n", trim($post->pinged));
        foreach ($already_pinged as $pinged_url) {
 
 if ('' != $post->pinged) {
        $pings = '<p>'. __('Already pinged:') . '</p><ul>';
        $already_pinged = explode("\n", trim($post->pinged));
        foreach ($already_pinged as $pinged_url) {
-               $pings .= "\n\t<li>$pinged_url</li>";
+               $pings .= "\n\t<li>" . wp_specialchars($pinged_url) . "</li>";
        }
        $pings .= '</ul>';
 }
 
        }
        $pings .= '</ul>';
 }
 
-$saveasdraft = '<input name="save" type="submit" id="save" tabindex="3" value="' . __('Save and Continue Editing') . '" />';
+$saveasdraft = '<input name="save" type="submit" id="save" tabindex="3" value="' . attribute_escape(__('Save and Continue Editing')) . '" />';
 
 if (empty($post->post_status)) $post->post_status = 'draft';
 
 ?>
 
 
 if (empty($post->post_status)) $post->post_status = 'draft';
 
 ?>
 
-<input type="hidden" name="user_ID" value="<?php echo $user_ID ?>" />
+<input type="hidden" name="user_ID" value="<?php echo (int) $user_ID ?>" />
 <input type="hidden" name="action" value="<?php echo $form_action ?>" />
 <input type="hidden" name="action" value="<?php echo $form_action ?>" />
-<input type="hidden" name="post_author" value="<?php echo $post->post_author ?>" />
+<input type="hidden" name="post_author" value="<?php echo attribute_escape($post->post_author) ?>" />
 
 <?php echo $form_extra ?>
 <?php if (isset($_GET['message']) && 2 > $_GET['message']) : ?>
 
 <?php echo $form_extra ?>
 <?php if (isset($_GET['message']) && 2 > $_GET['message']) : ?>
@@ -82,12 +85,12 @@ addLoadEvent(focusit);
 
 <fieldset id="passworddiv" class="dbx-box">
 <h3 class="dbx-handle"><?php _e('Password-Protect Post') ?></h3> 
 
 <fieldset id="passworddiv" class="dbx-box">
 <h3 class="dbx-handle"><?php _e('Password-Protect Post') ?></h3> 
-<div class="dbx-content"><input name="post_password" type="text" size="13" id="post_password" value="<?php echo $post->post_password ?>" /></div>
+<div class="dbx-content"><input name="post_password" type="text" size="13" id="post_password" value="<?php echo attribute_escape($post->post_password) ?>" /></div>
 </fieldset>
 
 <fieldset id="slugdiv" class="dbx-box">
 <h3 class="dbx-handle"><?php _e('Post slug') ?></h3> 
 </fieldset>
 
 <fieldset id="slugdiv" class="dbx-box">
 <h3 class="dbx-handle"><?php _e('Post slug') ?></h3> 
-<div class="dbx-content"><input name="post_name" type="text" size="13" id="post_name" value="<?php echo $post->post_name ?>" /></div>
+<div class="dbx-content"><input name="post_name" type="text" size="13" id="post_name" value="<?php echo attribute_escape($post->post_name) ?>" /></div>
 </fieldset>
 
 <fieldset id="categorydiv" class="dbx-box">
 </fieldset>
 
 <fieldset id="categorydiv" class="dbx-box">
@@ -97,7 +100,7 @@ addLoadEvent(focusit);
 <div id="categorychecklist"><?php dropdown_categories(get_settings('default_category')); ?></div></div>
 </fieldset>
 
 <div id="categorychecklist"><?php dropdown_categories(get_settings('default_category')); ?></div></div>
 </fieldset>
 
-<fieldset class="dbx-box">
+<fieldset id="poststatusdiv" class="dbx-box">
 <h3 class="dbx-handle"><?php _e('Post Status') ?></h3> 
 <div class="dbx-content"><?php if ( current_user_can('publish_posts') ) : ?>
 <label for="post_status_publish" class="selectit"><input id="post_status_publish" name="post_status" type="radio" value="publish" <?php checked($post->post_status, 'publish'); ?> /> <?php _e('Published') ?></label>
 <h3 class="dbx-handle"><?php _e('Post Status') ?></h3> 
 <div class="dbx-content"><?php if ( current_user_can('publish_posts') ) : ?>
 <label for="post_status_publish" class="selectit"><input id="post_status_publish" name="post_status" type="radio" value="publish" <?php checked($post->post_status, 'publish'); ?> /> <?php _e('Published') ?></label>
@@ -107,7 +110,7 @@ addLoadEvent(focusit);
 </fieldset>
 
 <?php if ( current_user_can('edit_posts') ) : ?>
 </fieldset>
 
 <?php if ( current_user_can('edit_posts') ) : ?>
-<fieldset class="dbx-box">
+<fieldset id="posttimestampdiv" class="dbx-box">
 <h3 class="dbx-handle"><?php _e('Post Timestamp'); ?>:</h3>
 <div class="dbx-content"><?php touch_time(($action == 'edit')); ?></div>
 </fieldset>
 <h3 class="dbx-handle"><?php _e('Post Timestamp'); ?>:</h3>
 <div class="dbx-content"><?php touch_time(($action == 'edit')); ?></div>
 </fieldset>
@@ -123,7 +126,7 @@ foreach ($authors as $o) :
 $o = get_userdata( $o->ID );
 if ( $post->post_author == $o->ID || ( empty($post_ID) && $user_ID == $o->ID ) ) $selected = 'selected="selected"';
 else $selected = '';
 $o = get_userdata( $o->ID );
 if ( $post->post_author == $o->ID || ( empty($post_ID) && $user_ID == $o->ID ) ) $selected = 'selected="selected"';
 else $selected = '';
-echo "<option value='$o->ID' $selected>$o->display_name</option>";
+echo "<option value='" . (int) $o->ID . "' $selected>" . wp_specialchars($o->display_name) . "</option>";
 endforeach;
 ?>
 </select>
 endforeach;
 ?>
 </select>
@@ -138,7 +141,7 @@ endforeach;
 
 <fieldset id="titlediv">
   <legend><?php _e('Title') ?></legend> 
 
 <fieldset id="titlediv">
   <legend><?php _e('Title') ?></legend> 
-  <div><input type="text" name="post_title" size="30" tabindex="1" value="<?php echo $post->post_title; ?>" id="title" /></div>
+  <div><input type="text" name="post_title" size="30" tabindex="1" value="<?php echo attribute_escape($post->post_title); ?>" id="title" /></div>
 </fieldset>
 
 <fieldset id="<?php echo user_can_richedit() ? 'postdivrich' : 'postdiv'; ?>">
 </fieldset>
 
 <fieldset id="<?php echo user_can_richedit() ? 'postdivrich' : 'postdiv'; ?>">
@@ -210,44 +213,44 @@ if ('publish' != $post->post_status || 0 == $post_ID) {
 ?>
 <input name="referredby" type="hidden" id="referredby" value="<?php 
 if ( !empty($_REQUEST['popupurl']) )
 ?>
 <input name="referredby" type="hidden" id="referredby" value="<?php 
 if ( !empty($_REQUEST['popupurl']) )
-       echo wp_specialchars($_REQUEST['popupurl']);
-else if ( url_to_postid(wp_get_referer()) == $post_ID )
+       echo attribute_escape(stripslashes($_REQUEST['popupurl']));
+else if ( url_to_postid(stripslashes(wp_get_referer())) == $post_ID )
        echo 'redo';
 else
        echo 'redo';
 else
-       echo wp_specialchars(wp_get_referer());
+       echo attribute_escape(stripslashes(wp_get_referer()));
 ?>" /></p>
 
 <?php do_action('edit_form_advanced'); ?>
 
 <?php
 if (current_user_can('upload_files')) {
 ?>" /></p>
 
 <?php do_action('edit_form_advanced'); ?>
 
 <?php
 if (current_user_can('upload_files')) {
-       $uploading_iframe_ID = (0 == $post_ID ? $temp_ID : $post_ID);
+       $uploading_iframe_ID = (int) (0 == $post_ID ? $temp_ID : $post_ID);
        $uploading_iframe_src = wp_nonce_url("inline-uploading.php?action=view&amp;post=$uploading_iframe_ID", 'inlineuploading');
        $uploading_iframe_src = apply_filters('uploading_iframe_src', $uploading_iframe_src);
        if ( false != $uploading_iframe_src )
        $uploading_iframe_src = wp_nonce_url("inline-uploading.php?action=view&amp;post=$uploading_iframe_ID", 'inlineuploading');
        $uploading_iframe_src = apply_filters('uploading_iframe_src', $uploading_iframe_src);
        if ( false != $uploading_iframe_src )
-               echo '<iframe id="uploading" border="0" src="' . $uploading_iframe_src . '">' . __('This feature requires iframe support.') . '</iframe>';
+               echo '<iframe id="uploading" frameborder="0" src="' . $uploading_iframe_src . '">' . __('This feature requires iframe support.') . '</iframe>';
 }
 ?>
 
 <div id="advancedstuff" class="dbx-group" >
 
 }
 ?>
 
 <div id="advancedstuff" class="dbx-group" >
 
-<div class="dbx-box-wrapper">
+<div class="dbx-b-ox-wrapper">
 <fieldset id="postexcerpt" class="dbx-box">
 <fieldset id="postexcerpt" class="dbx-box">
-<div class="dbx-handle-wrapper">
+<div class="dbx-h-andle-wrapper">
 <h3 class="dbx-handle"><?php _e('Optional Excerpt') ?></h3>
 </div>
 <h3 class="dbx-handle"><?php _e('Optional Excerpt') ?></h3>
 </div>
-<div class="dbx-content-wrapper">
+<div class="dbx-c-ontent-wrapper">
 <div class="dbx-content"><textarea rows="1" cols="40" name="excerpt" tabindex="6" id="excerpt"><?php echo $post->post_excerpt ?></textarea></div>
 </div>
 </fieldset>
 </div>
 
 <div class="dbx-content"><textarea rows="1" cols="40" name="excerpt" tabindex="6" id="excerpt"><?php echo $post->post_excerpt ?></textarea></div>
 </div>
 </fieldset>
 </div>
 
-<div class="dbx-box-wrapper">
-<fieldset class="dbx-box">
-<div class="dbx-handle-wrapper">
+<div class="dbx-b-ox-wrapper">
+<fieldset id="trackbacksdiv" class="dbx-box">
+<div class="dbx-h-andle-wrapper">
 <h3 class="dbx-handle"><?php _e('Trackbacks') ?></h3>
 </div>
 <h3 class="dbx-handle"><?php _e('Trackbacks') ?></h3>
 </div>
-<div class="dbx-content-wrapper">
+<div class="dbx-c-ontent-wrapper">
 <div class="dbx-content"><?php _e('Send trackbacks to'); ?>: <?php echo $form_trackback; ?> (<?php _e('Separate multiple URIs with spaces'); ?>)
 <?php 
 if ( ! empty($pings) )
 <div class="dbx-content"><?php _e('Send trackbacks to'); ?>: <?php echo $form_trackback; ?> (<?php _e('Separate multiple URIs with spaces'); ?>)
 <?php 
 if ( ! empty($pings) )
@@ -258,12 +261,12 @@ if ( ! empty($pings) )
 </fieldset>
 </div>
 
 </fieldset>
 </div>
 
-<div class="dbx-box-wrapper">
+<div class="dbx-b-ox-wrapper">
 <fieldset id="postcustom" class="dbx-box">
 <fieldset id="postcustom" class="dbx-box">
-<div class="dbx-handle-wrapper">
+<div class="dbx-h-andle-wrapper">
 <h3 class="dbx-handle"><?php _e('Custom Fields') ?></h3>
 </div>
 <h3 class="dbx-handle"><?php _e('Custom Fields') ?></h3>
 </div>
-<div class="dbx-content-wrapper">
+<div class="dbx-c-ontent-wrapper">
 <div id="postcustomstuff" class="dbx-content">
 <?php 
 if($metadata = has_meta($post_ID)) {
 <div id="postcustomstuff" class="dbx-content">
 <?php 
 if($metadata = has_meta($post_ID)) {
@@ -276,6 +279,7 @@ if($metadata = has_meta($post_ID)) {
        meta_form();
 ?>
 </div>
        meta_form();
 ?>
 </div>
+</div>
 </fieldset>
 </div>
 
 </fieldset>
 </div>
 
index 2695c51c9b7f2b5b9794b2fd53aac964b02d0de9..7a09960724d4e7b5427dea83b61685d9cb0588cd 100644 (file)
@@ -8,7 +8,7 @@ $form_extra = "' />\n<input type='hidden' name='comment_ID' value='" . $comment-
 <form name="post" action="post.php" method="post" id="post">
 <?php wp_nonce_field('update-comment_' . $comment->comment_ID) ?>
 <div class="wrap">
 <form name="post" action="post.php" method="post" id="post">
 <?php wp_nonce_field('update-comment_' . $comment->comment_ID) ?>
 <div class="wrap">
-<input type="hidden" name="user_ID" value="<?php echo $user_ID ?>" />
+<input type="hidden" name="user_ID" value="<?php echo (int) $user_ID ?>" />
 <input type="hidden" name="action" value='<?php echo $form_action . $form_extra ?>' />
 
 <script type="text/javascript">
 <input type="hidden" name="action" value='<?php echo $form_action . $form_extra ?>' />
 
 <script type="text/javascript">
@@ -20,19 +20,19 @@ addLoadEvent(focusit);
 <fieldset id="namediv">
     <legend><?php _e('Name:') ?></legend>
        <div>
 <fieldset id="namediv">
     <legend><?php _e('Name:') ?></legend>
        <div>
-         <input type="text" name="newcomment_author" size="22" value="<?php echo $comment->comment_author ?>" tabindex="1" id="name" />
+         <input type="text" name="newcomment_author" size="22" value="<?php echo attribute_escape($comment->comment_author); ?>" tabindex="1" id="name" />
     </div>
 </fieldset>
 <fieldset id="emaildiv">
         <legend><?php _e('E-mail:') ?></legend>
                <div>
     </div>
 </fieldset>
 <fieldset id="emaildiv">
         <legend><?php _e('E-mail:') ?></legend>
                <div>
-                 <input type="text" name="newcomment_author_email" size="30" value="<?php echo $comment->comment_author_email ?>" tabindex="2" id="email" />
+                 <input type="text" name="newcomment_author_email" size="30" value="<?php echo attribute_escape($comment->comment_author_email); ?>" tabindex="2" id="email" />
     </div>
 </fieldset>
 <fieldset id="uridiv">
         <legend><?php _e('URI:') ?></legend>
                <div>
     </div>
 </fieldset>
 <fieldset id="uridiv">
         <legend><?php _e('URI:') ?></legend>
                <div>
-                 <input type="text" id="newcomment_author_url" name="newcomment_author_url" size="35" value="<?php echo $comment->comment_author_url ?>" tabindex="3" id="URL" />
+                 <input type="text" id="newcomment_author_url" name="newcomment_author_url" size="35" value="<?php echo attribute_escape($comment->comment_author_url); ?>" tabindex="3" id="URL" />
     </div>
 </fieldset>
 
     </div>
 </fieldset>
 
index fd5efcea9b3a2daf38b3f9602ad3ec8375690f3a..de5937e38ef634040f8a13f219a483c125aa1e0f 100644 (file)
@@ -6,7 +6,7 @@
 <?php if (isset($mode) && 'bookmarklet' == $mode) : ?>
 <input type="hidden" name="mode" value="bookmarklet" />
 <?php endif; ?>
 <?php if (isset($mode) && 'bookmarklet' == $mode) : ?>
 <input type="hidden" name="mode" value="bookmarklet" />
 <?php endif; ?>
-<input type="hidden" name="user_ID" value="<?php echo $user_ID ?>" />
+<input type="hidden" name="user_ID" value="<?php echo (int) $user_ID ?>" />
 <input type="hidden" name="action" value='post' />
 
 <script type="text/javascript">
 <input type="hidden" name="action" value='post' />
 
 <script type="text/javascript">
@@ -21,7 +21,7 @@ addLoadEvent(focusit);
 <div id="poststuff">
     <fieldset id="titlediv">
       <legend><a href="http://wordpress.org/docs/reference/post/#title" title="<?php _e('Help on titles') ?>"><?php _e('Title') ?></a></legend> 
 <div id="poststuff">
     <fieldset id="titlediv">
       <legend><a href="http://wordpress.org/docs/reference/post/#title" title="<?php _e('Help on titles') ?>"><?php _e('Title') ?></a></legend> 
-         <div><input type="text" name="post_title" size="30" tabindex="1" value="<?php echo $post->post_title; ?>" id="title" /></div>
+         <div><input type="text" name="post_title" size="30" tabindex="1" value="<?php echo attribute_escape($post->post_title); ?>" id="title" /></div>
     </fieldset>
 
     <fieldset id="categorydiv">
     </fieldset>
 
     <fieldset id="categorydiv">
@@ -49,7 +49,7 @@ edCanvas = document.getElementById('content');
 //-->
 </script>
 
 //-->
 </script>
 
-<input type="hidden" name="post_pingback" value="<?php echo get_option('default_pingback_flag') ?>" id="post_pingback" />
+<input type="hidden" name="post_pingback" value="<?php echo (int) get_option('default_pingback_flag') ?>" id="post_pingback" />
 
 <p><label for="trackback"> <?php printf(__('<a href="%s" title="Help on trackbacks"><strong>TrackBack</strong> a <abbr title="Universal Resource Identifier">URI</abbr></a>:</label> (Separate multiple <abbr title="Universal Resource Identifier">URI</abbr>s with spaces.)<br />'), 'http://wordpress.org/docs/reference/post/#trackback') ?>
        <input type="text" name="trackback_url" style="width: 360px" id="trackback" tabindex="7" /></p>
 
 <p><label for="trackback"> <?php printf(__('<a href="%s" title="Help on trackbacks"><strong>TrackBack</strong> a <abbr title="Universal Resource Identifier">URI</abbr></a>:</label> (Separate multiple <abbr title="Universal Resource Identifier">URI</abbr>s with spaces.)<br />'), 'http://wordpress.org/docs/reference/post/#trackback') ?>
        <input type="text" name="trackback_url" style="width: 360px" id="trackback" tabindex="7" /></p>
@@ -64,7 +64,7 @@ edCanvas = document.getElementById('content');
 <?php if ('bookmarklet' != $mode) {
       echo '<input name="advanced" type="submit" id="advancededit" tabindex="7" value="' .  __('Advanced Editing &raquo;') . '" />';
   } ?>
 <?php if ('bookmarklet' != $mode) {
       echo '<input name="advanced" type="submit" id="advancededit" tabindex="7" value="' .  __('Advanced Editing &raquo;') . '" />';
   } ?>
-  <input name="referredby" type="hidden" id="referredby" value="<?php if ( wp_get_referer() ) echo urlencode(wp_get_referer()); ?>" />
+  <input name="referredby" type="hidden" id="referredby" value="<?php if ( $refby = wp_get_referer() ) echo urlencode($refby); ?>" />
 </p>
 
 <?php do_action('simple_edit_form', ''); ?>
 </p>
 
 <?php do_action('simple_edit_form', ''); ?>
index fe5b6349aadbc043afe7ac6a76b420a33ddb6508..5111c0b86b9b30003ca23d6c91d1d9b3cb13081b 100644 (file)
@@ -230,7 +230,7 @@ function xfn_check($class, $value = '', $type = 'check') {
 <?php if ( $editing ) : ?>
           <input type="hidden" name="action" value="editlink" />
           <input type="hidden" name="link_id" value="<?php echo (int) $link_id; ?>" />
 <?php if ( $editing ) : ?>
           <input type="hidden" name="action" value="editlink" />
           <input type="hidden" name="link_id" value="<?php echo (int) $link_id; ?>" />
-          <input type="hidden" name="order_by" value="<?php echo wp_specialchars($order_by, 1); ?>" />
+          <input type="hidden" name="order_by" value="<?php echo attribute_escape($order_by); ?>" />
           <input type="hidden" name="cat_id" value="<?php echo (int) $cat_id ?>" />
 <?php else: ?>
                <input type="hidden" name="action" value="Add" />
           <input type="hidden" name="cat_id" value="<?php echo (int) $cat_id ?>" />
 <?php else: ?>
                <input type="hidden" name="action" value="Add" />
index c9b7ef5b305eb4b2b568c92c802895636eeb23e4..b0e603e0061265d7b2988d9503bca308507e11c8 100644 (file)
@@ -9,16 +9,19 @@ if (0 == $post_ID) {
        $temp_ID = -1 * time();
        $form_extra = "<input type='hidden' name='temp_ID' value='$temp_ID' />";
 } else {
        $temp_ID = -1 * time();
        $form_extra = "<input type='hidden' name='temp_ID' value='$temp_ID' />";
 } else {
+       $post_ID = (int) $post_ID;
        $form_action = 'editpost';
        $nonce_action = 'update-post_' . $post_ID;
        $form_extra = "<input type='hidden' id='post_ID' name='post_ID' value='$post_ID' />";
 }
 
        $form_action = 'editpost';
        $nonce_action = 'update-post_' . $post_ID;
        $form_extra = "<input type='hidden' id='post_ID' name='post_ID' value='$post_ID' />";
 }
 
-$sendto = wp_get_referer();
+$temp_ID = (int) $temp_ID;
+$user_ID = (int) $user_ID;
+
+$sendto = attribute_escape(wp_get_referer());
 
 if ( 0 != $post_ID && $sendto == get_permalink($post_ID) )
        $sendto = 'redo';
 
 if ( 0 != $post_ID && $sendto == get_permalink($post_ID) )
        $sendto = 'redo';
-$sendto = wp_specialchars( $sendto );
 
 ?>
 
 
 ?>
 
@@ -61,7 +64,7 @@ addLoadEvent(focusit);
 
 <fieldset id="passworddiv" class="dbx-box">
 <h3 class="dbx-handle"><?php _e('Password-Protect Post') ?></h3> 
 
 <fieldset id="passworddiv" class="dbx-box">
 <h3 class="dbx-handle"><?php _e('Password-Protect Post') ?></h3> 
-<div class="dbx-content"><input name="post_password" type="text" size="13" id="post_password" value="<?php echo $post->post_password ?>" /></div>
+<div class="dbx-content"><input name="post_password" type="text" size="13" id="post_password" value="<?php echo attribute_escape($post->post_password); ?>" /></div>
 </fieldset>
 
 <fieldset id="pageparent" class="dbx-box">
 </fieldset>
 
 <fieldset id="pageparent" class="dbx-box">
@@ -86,7 +89,7 @@ addLoadEvent(focusit);
 
 <fieldset id="slugdiv" class="dbx-box">
 <h3 class="dbx-handle"><?php _e('Post slug') ?></h3> 
 
 <fieldset id="slugdiv" class="dbx-box">
 <h3 class="dbx-handle"><?php _e('Post slug') ?></h3> 
-<div class="dbx-content"><input name="post_name" type="text" size="13" id="post_name" value="<?php echo $post->post_name ?>" /></div>
+<div class="dbx-content"><input name="post_name" type="text" size="13" id="post_name" value="<?php echo attribute_escape($post->post_name); ?>" /></div>
 </fieldset>
 
 <?php if ( $authors = get_editable_authors( $current_user->id ) ) : // TODO: ROLE SYSTEM ?>
 </fieldset>
 
 <?php if ( $authors = get_editable_authors( $current_user->id ) ) : // TODO: ROLE SYSTEM ?>
@@ -99,6 +102,8 @@ foreach ($authors as $o) :
 $o = get_userdata( $o->ID );
 if ( $post->post_author == $o->ID || ( empty($post_ID) && $user_ID == $o->ID ) ) $selected = 'selected="selected"';
 else $selected = '';
 $o = get_userdata( $o->ID );
 if ( $post->post_author == $o->ID || ( empty($post_ID) && $user_ID == $o->ID ) ) $selected = 'selected="selected"';
 else $selected = '';
+$o->ID = (int) $o->ID;
+$o->display_name = wp_specialchars( $o->display_name );
 echo "<option value='$o->ID' $selected>$o->display_name</option>";
 endforeach;
 ?>
 echo "<option value='$o->ID' $selected>$o->display_name</option>";
 endforeach;
 ?>
@@ -119,7 +124,7 @@ endforeach;
 
 <fieldset id="titlediv">
   <legend><?php _e('Page Title') ?></legend> 
 
 <fieldset id="titlediv">
   <legend><?php _e('Page Title') ?></legend> 
-  <div><input type="text" name="post_title" size="30" tabindex="1" value="<?php echo $post->post_title; ?>" id="title" /></div>
+  <div><input type="text" name="post_title" size="30" tabindex="1" value="<?php echo attribute_escape($post->post_title); ?>" id="title" /></div>
 </fieldset>
 
 
 </fieldset>
 
 
@@ -193,7 +198,7 @@ if (current_user_can('upload_files')) {
        $uploading_iframe_src = wp_nonce_url("inline-uploading.php?action=view&amp;post=$uploading_iframe_ID", 'inlineuploading');
        $uploading_iframe_src = apply_filters('uploading_iframe_src', $uploading_iframe_src);
        if ( false != $uploading_iframe_src )
        $uploading_iframe_src = wp_nonce_url("inline-uploading.php?action=view&amp;post=$uploading_iframe_ID", 'inlineuploading');
        $uploading_iframe_src = apply_filters('uploading_iframe_src', $uploading_iframe_src);
        if ( false != $uploading_iframe_src )
-               echo '<iframe id="uploading" border="0" src="' . $uploading_iframe_src . '">' . __('This feature requires iframe support.') . '</iframe>';
+               echo '<iframe id="uploading" frameborder="0" src="' . $uploading_iframe_src . '">' . __('This feature requires iframe support.') . '</iframe>';
 }
 ?>
 
 }
 ?>
 
@@ -224,8 +229,8 @@ if($metadata = has_meta($post_ID)) {
        $delete_nonce = wp_create_nonce( 'delete-page_' . $post_ID ); ?>
        <input name="deletepost" class="button" type="submit" id="deletepost" tabindex="10" value="<?php _e('Delete this page') ?>" <?php echo "onclick=\"if ( confirm('" . sprintf(__("You are about to delete this page \'%s\'\\n  \'Cancel\' to stop, \'OK\' to delete."), js_escape($post->post_title) ) . "') ) { document.forms.post._wpnonce.value = '$delete_nonce'; return true;}return false;\""; ?> />
 <?php endif; ?>
        $delete_nonce = wp_create_nonce( 'delete-page_' . $post_ID ); ?>
        <input name="deletepost" class="button" type="submit" id="deletepost" tabindex="10" value="<?php _e('Delete this page') ?>" <?php echo "onclick=\"if ( confirm('" . sprintf(__("You are about to delete this page \'%s\'\\n  \'Cancel\' to stop, \'OK\' to delete."), js_escape($post->post_title) ) . "') ) { document.forms.post._wpnonce.value = '$delete_nonce'; return true;}return false;\""; ?> />
 <?php endif; ?>
-</form>
-
 </div>
 
 </div>
 
+</form>
+
 </div>
 </div>
index 9dc89d78275615a3ae75d3571702f14b292e5be7..e108407d3b4c299b7a49b07f5bfaf94e97194e79 100644 (file)
@@ -13,7 +13,7 @@ require_once('admin-header.php');
 <form name="searchform" action="" method="get"> 
   <fieldset> 
   <legend><?php _e('Search Pages&hellip;') ?></legend>
 <form name="searchform" action="" method="get"> 
   <fieldset> 
   <legend><?php _e('Search Pages&hellip;') ?></legend>
-  <input type="text" name="s" value="<?php if (isset($_GET['s'])) echo wp_specialchars($_GET['s'], 1); ?>" size="17" /> 
+  <input type="text" name="s" value="<?php if (isset($_GET['s'])) echo attribute_escape($_GET['s']); ?>" size="17" /> 
   <input type="submit" name="submit" value="<?php _e('Search') ?>"  /> 
   </fieldset>
 </form>
   <input type="submit" name="submit" value="<?php _e('Search') ?>"  /> 
   </fieldset>
 </form>
index eb67c80a6e36fbed184c42dcd2ca7121ea23de8c..df86317e387b6bfbcfda2abc09b05fe8ff142180 100644 (file)
@@ -79,7 +79,7 @@ if ( is_month() ) {
 <form name="searchform" action="" method="get" style="float: left; width: 16em; margin-right: 3em;"> 
   <fieldset> 
   <legend><?php _e('Search Posts&hellip;') ?></legend> 
 <form name="searchform" action="" method="get" style="float: left; width: 16em; margin-right: 3em;"> 
   <fieldset> 
   <legend><?php _e('Search Posts&hellip;') ?></legend> 
-  <input type="text" name="s" value="<?php if (isset($s)) echo wp_specialchars($s, 1); ?>" size="17" /> 
+  <input type="text" name="s" value="<?php if (isset($s)) echo attribute_escape($s); ?>" size="17" /> 
   <input type="submit" name="submit" value="<?php _e('Search') ?>"  /> 
   </fieldset>
 </form>
   <input type="submit" name="submit" value="<?php _e('Search') ?>"  /> 
   </fieldset>
 </form>
index d35f84219c83731d405ada2e15b5af95d517b17a..0772eb1db20aef146f0372ed7aca55f8dcc8703d 100644 (file)
@@ -7,14 +7,15 @@ class Blogger_Import {
 
        // Shows the welcome screen and the magic iframe.
        function greet() {
 
        // Shows the welcome screen and the magic iframe.
        function greet() {
-               $title = __('Import Blogger');
-               $welcome = __('Howdy! This importer allows you to import posts and comments from your Blogger account into your WordPress blog.');
+               $title = __('Import Old Blogger');
+               $welcome = __('Howdy! This importer allows you to import posts and comments from your Old Blogger account into your WordPress blog.');
                $noiframes = __('This feature requires iframe support.');
                $warning = __('This will delete everything saved by the Blogger importer except your posts and comments. Are you sure you want to do this?');
                $reset = __('Reset this importer');
                $incompat = __('Your web server is not properly configured to use this importer. Please enable the CURL extension for PHP and then reload this page.');
 
                echo "<div class='wrap'><h2>$title</h2><p>$welcome</p>";
                $noiframes = __('This feature requires iframe support.');
                $warning = __('This will delete everything saved by the Blogger importer except your posts and comments. Are you sure you want to do this?');
                $reset = __('Reset this importer');
                $incompat = __('Your web server is not properly configured to use this importer. Please enable the CURL extension for PHP and then reload this page.');
 
                echo "<div class='wrap'><h2>$title</h2><p>$welcome</p>";
+               echo "<p>" . __('Please note that this importer <em>does not work with Blogger (using your Google account)</em>.') . "</p>";
                if ( function_exists('curl_init') )
                        echo "<iframe src='admin.php?import=blogger&amp;noheader=true' height='350px' width = '99%'>$noiframes</iframe><p><a href='admin.php?import=blogger&amp;restart=true&amp;noheader=true' onclick='return confirm(\"$warning\")'>$reset</a></p>";
                else
                if ( function_exists('curl_init') )
                        echo "<iframe src='admin.php?import=blogger&amp;noheader=true' height='350px' width = '99%'>$noiframes</iframe><p><a href='admin.php?import=blogger&amp;restart=true&amp;noheader=true' onclick='return confirm(\"$warning\")'>$reset</a></p>";
                else
@@ -135,13 +136,13 @@ class Blogger_Import {
                curl_setopt($ch, CURLOPT_RETURNTRANSFER,1);
                if ($header) curl_setopt($ch, CURLOPT_HTTPHEADER, $header);
                $response = curl_exec ($ch);
                curl_setopt($ch, CURLOPT_RETURNTRANSFER,1);
                if ($header) curl_setopt($ch, CURLOPT_HTTPHEADER, $header);
                $response = curl_exec ($ch);
-       
+
                if ($parse) {
                        $response = $this->parse_response($response);
                        $response['url'] = $url;
                        return $response;
                }
                if ($parse) {
                        $response = $this->parse_response($response);
                        $response['url'] = $url;
                        return $response;
                }
-       
+
                return $response;
        }
 
                return $response;
        }
 
@@ -210,7 +211,7 @@ class Blogger_Import {
                $this->import['blogs'][$_GET['blog']]['nextstep'] = $step;
                update_option('import-blogger', $this->import);
        }
                $this->import['blogs'][$_GET['blog']]['nextstep'] = $step;
                update_option('import-blogger', $this->import);
        }
-       
+
        // Redirects to next step
        function do_next_step() {
                wp_redirect("admin.php?import=blogger&noheader=true&blog={$_GET['blog']}");
        // Redirects to next step
        function do_next_step() {
                wp_redirect("admin.php?import=blogger&noheader=true&blog={$_GET['blog']}");
@@ -224,13 +225,13 @@ class Blogger_Import {
                        if ( ! ( $_POST['user'] && $_POST['pass'] ) ) {
                                $this->login_form(__('The script will log into your Blogger account, change some settings so it can read your blog, and restore the original settings when it\'s done. Here\'s what you do:').'</p><ol><li>'.__('Back up your Blogger template.').'</li><li>'.__('Back up any other Blogger settings you might need later.').'</li><li>'.__('Log out of Blogger').'</li><li>'.__('Log in <em>here</em> with your Blogger username and password.').'</li><li>'.__('On the next screen, click one of your Blogger blogs.').'</li><li>'.__('Do not close this window or navigate away until the process is complete.').'</li></ol>');
                        }
                        if ( ! ( $_POST['user'] && $_POST['pass'] ) ) {
                                $this->login_form(__('The script will log into your Blogger account, change some settings so it can read your blog, and restore the original settings when it\'s done. Here\'s what you do:').'</p><ol><li>'.__('Back up your Blogger template.').'</li><li>'.__('Back up any other Blogger settings you might need later.').'</li><li>'.__('Log out of Blogger').'</li><li>'.__('Log in <em>here</em> with your Blogger username and password.').'</li><li>'.__('On the next screen, click one of your Blogger blogs.').'</li><li>'.__('Do not close this window or navigate away until the process is complete.').'</li></ol>');
                        }
-               
-                       // Try logging in. If we get an array of cookies back, we at least connected.           
+
+                       // Try logging in. If we get an array of cookies back, we at least connected.
                        $this->import['cookies'] = $this->login_blogger($_POST['user'], $_POST['pass']);
                        if ( !is_array( $this->import['cookies'] ) ) {
                                $this->login_form(__('Login failed. Please enter your credentials again.'));
                        }
                        $this->import['cookies'] = $this->login_blogger($_POST['user'], $_POST['pass']);
                        if ( !is_array( $this->import['cookies'] ) ) {
                                $this->login_form(__('Login failed. Please enter your credentials again.'));
                        }
-                       
+
                        // Save the password so we can log the browser in when it's time to publish.
                        $this->import['pass'] = $_POST['pass'];
                        $this->import['user'] = $_POST['user'];
                        // Save the password so we can log the browser in when it's time to publish.
                        $this->import['pass'] = $_POST['pass'];
                        $this->import['user'] = $_POST['user'];
@@ -341,7 +342,7 @@ class Blogger_Import {
                                $form = "<div style='height:0px;width:0px;overflow:hidden;'>";
                                $form.= $body;
                                $form.= "</div><script type='text/javascript'>forms=document.getElementsByTagName('form');for(i=0;i<forms.length;i++){if(forms[i].action.search('{$blog_opt}')){forms[i].submit();break;}}</script>";
                                $form = "<div style='height:0px;width:0px;overflow:hidden;'>";
                                $form.= $body;
                                $form.= "</div><script type='text/javascript'>forms=document.getElementsByTagName('form');for(i=0;i<forms.length;i++){if(forms[i].action.search('{$blog_opt}')){forms[i].submit();break;}}</script>";
-                               $output.= '<p>'.sprintf('<strong>%s</strong> in progress, please wait...', $blog_opt)."</p>\n";
+                               $output.= '<p>'.sprintf(__('<strong>%s</strong> in progress, please wait...'), $blog_opt)."</p>\n";
                        } else {
                                $output.= "<p>$blog_opt</p>\n";
                        }
                        } else {
                                $output.= "<p>$blog_opt</p>\n";
                        }
@@ -395,7 +396,7 @@ class Blogger_Import {
                                update_option('import-blogger', $import);
                                $archive = $this->get_blogger($url);
                                if ( $archive['code'] > 200 )
                                update_option('import-blogger', $import);
                                $archive = $this->get_blogger($url);
                                if ( $archive['code'] > 200 )
-                                       continue;       
+                                       continue;
                                $posts = explode('<wordpresspost>', $archive['body']);
                                for ($i = 1; $i < count($posts); $i = $i + 1) {
                                        $postparts = explode('<wordpresscomment>', $posts[$i]);
                                $posts = explode('<wordpresspost>', $archive['body']);
                                for ($i = 1; $i < count($posts); $i = $i + 1) {
                                        $postparts = explode('<wordpresscomment>', $posts[$i]);
@@ -409,7 +410,7 @@ class Blogger_Import {
                                        $post_title = ( $postinfo[4] != '' ) ? $postinfo[4] : $postinfo[3];
                                        $post_author_name = $wpdb->escape(trim($postinfo[1]));
                                        $post_author_email = $postinfo[5] ? $postinfo[5] : 'user@wordpress.org';
                                        $post_title = ( $postinfo[4] != '' ) ? $postinfo[4] : $postinfo[3];
                                        $post_author_name = $wpdb->escape(trim($postinfo[1]));
                                        $post_author_email = $postinfo[5] ? $postinfo[5] : 'user@wordpress.org';
-       
+
                                        if ( $this->lump_authors ) {
                                                // Ignore Blogger authors. Use the current user_ID for all posts imported.
                                                $post_author = $GLOBALS['user_ID'];
                                        if ( $this->lump_authors ) {
                                                // Ignore Blogger authors. Use the current user_ID for all posts imported.
                                                $post_author = $GLOBALS['user_ID'];
@@ -420,7 +421,7 @@ class Blogger_Import {
                                                        $user_email = $wpdb->escape($post_author_email);
                                                        $user_password = substr(md5(uniqid(microtime())), 0, 6);
                                                        $result = wp_create_user( $user_login, $user_password, $user_email );
                                                        $user_email = $wpdb->escape($post_author_email);
                                                        $user_password = substr(md5(uniqid(microtime())), 0, 6);
                                                        $result = wp_create_user( $user_login, $user_password, $user_email );
-                                                       $status.= sprintf('Registered user <strong>%s</strong>.', $user_login);
+                                                       $status.= sprintf(__('Registered user <strong>%s</strong>.'), $user_login);
                                                        $this->import['blogs'][$_GET['blog']]['newusers'][] = $user_login;
                                                }
                                                $userdata = get_userdatabylogin( $post_author_name );
                                                        $this->import['blogs'][$_GET['blog']]['newusers'][] = $user_login;
                                                }
                                                $userdata = get_userdatabylogin( $post_author_name );
@@ -435,21 +436,21 @@ class Blogger_Import {
                                        $posthour = zeroise($post_date_His[0], 2);
                                        $postminute = zeroise($post_date_His[1], 2);
                                        $postsecond = zeroise($post_date_His[2], 2);
                                        $posthour = zeroise($post_date_His[0], 2);
                                        $postminute = zeroise($post_date_His[1], 2);
                                        $postsecond = zeroise($post_date_His[2], 2);
-       
+
                                        if (($post_date[2] == 'PM') && ($posthour != '12'))
                                                $posthour = $posthour + 12;
                                        else if (($post_date[2] == 'AM') && ($posthour == '12'))
                                                $posthour = '00';
                                        if (($post_date[2] == 'PM') && ($posthour != '12'))
                                                $posthour = $posthour + 12;
                                        else if (($post_date[2] == 'AM') && ($posthour == '12'))
                                                $posthour = '00';
-       
+
                                        $post_date = "$postyear-$postmonth-$postday $posthour:$postminute:$postsecond";
                                        $post_date = "$postyear-$postmonth-$postday $posthour:$postminute:$postsecond";
-       
+
                                        $post_content = addslashes($post_content);
                                        $post_content = str_replace(array('<br>','<BR>','<br/>','<BR/>','<br />','<BR />'), "\n", $post_content); // the XHTML touch... ;)
                                        $post_content = addslashes($post_content);
                                        $post_content = str_replace(array('<br>','<BR>','<br/>','<BR/>','<br />','<BR />'), "\n", $post_content); // the XHTML touch... ;)
-       
+
                                        $post_title = addslashes($post_title);
                                        $post_title = addslashes($post_title);
-                       
+
                                        $post_status = 'publish';
                                        $post_status = 'publish';
-       
+
                                        if ( $ID = post_exists($post_title, '', $post_date) ) {
                                                $post_array[$i]['ID'] = $ID;
                                                $skippedpostcount++;
                                        if ( $ID = post_exists($post_title, '', $post_date) ) {
                                                $post_array[$i]['ID'] = $ID;
                                                $skippedpostcount++;
@@ -509,7 +510,7 @@ class Blogger_Import {
                                        }
                                }
                                $status = sprintf(__('%s post(s) parsed, %s skipped...'), $postcount,  $skippedpostcount).' '.
                                        }
                                }
                                $status = sprintf(__('%s post(s) parsed, %s skipped...'), $postcount,  $skippedpostcount).' '.
-                                       sprintf(__('%s comment(s) parsed, %s skipped...'), $commentcoun, $skippedcommentcount).' '.
+                                       sprintf(__('%s comment(s) parsed, %s skipped...'), $commentcount, $skippedcommentcount).' '.
                                        ' <strong>'.__('Done').'</strong>';
                                $import = $this->import;
                                $import['blogs'][$_GET['blog']]['archives']["$url"] = $status;
                                        ' <strong>'.__('Done').'</strong>';
                                $import = $this->import;
                                $import['blogs'][$_GET['blog']]['archives']["$url"] = $status;
@@ -546,7 +547,7 @@ class Blogger_Import {
                                                $response = $this->get_blogger("http://www.blogger.com/blog-publishing.g?blogID={$_GET['blog']}&publishMode={$optary['backup']['publishMode']}", $headers);
                                                sleep(2);
                                                if ( $response['code'] >= 400 )
                                                $response = $this->get_blogger("http://www.blogger.com/blog-publishing.g?blogID={$_GET['blog']}&publishMode={$optary['backup']['publishMode']}", $headers);
                                                sleep(2);
                                                if ( $response['code'] >= 400 )
-                                                       die('<h1>Error restoring publishMode.</h1><p>Please tell the devs.</p>' . addslashes(print_r($response, 1)) );
+                                                       die('<h1>'.__('Error restoring publishMode').'</h1><p>'.__('Please tell the devs.').'</p>' . addslashes(print_r($response, 1)) );
                                        }
                                }
                                if ( $optary['backup'] != $optary['modify'] ) {
                                        }
                                }
                                if ( $optary['backup'] != $optary['modify'] ) {
@@ -597,11 +598,11 @@ class Blogger_Import {
                if ( $_GET['restart'] == 'true' ) {
                        $this->restart();
                }
                if ( $_GET['restart'] == 'true' ) {
                        $this->restart();
                }
-               
+
                if ( isset($_GET['noheader']) ) {
                        header('Content-Type: text/html; charset=utf-8');
 
                if ( isset($_GET['noheader']) ) {
                        header('Content-Type: text/html; charset=utf-8');
 
-                       $this->import = get_settings('import-blogger');
+                       $this->import = get_option('import-blogger');
 
                        if ( false === $this->import ) {
                                $step = 0;
 
                        if ( false === $this->import ) {
                                $step = 0;
@@ -649,7 +650,7 @@ class Blogger_Import {
                                        break;
                        }
                        die;
                                        break;
                        }
                        die;
-                       
+
                } else {
                        $this->greet();
                }
                } else {
                        $this->greet();
                }
@@ -662,6 +663,6 @@ class Blogger_Import {
 
 $blogger_import = new Blogger_Import();
 
 
 $blogger_import = new Blogger_Import();
 
-register_importer('blogger', 'Blogger', __('Import posts and comments from a Blogger account'), array ($blogger_import, 'start'));
+register_importer('blogger', __('Old Blogger'), __('Import <strong>posts and comments</strong> from your Old Blogger account'), array ($blogger_import, 'start'));
 
 ?>
 
 ?>
index b4f2cd34400c1fab2ee9b7b0efe6d2b1ab298b2e..fd4f2d65cf3c07421184ad90be35f423b0ebf495 100644 (file)
@@ -1,16 +1,21 @@
 <?php
 <?php
+/*
+ * DotClear import plugin
+ * by Thomas Quinot - http://thomas.quinot.org/
+ */
+
 /**
        Add These Functions to make our lives easier
 **/
 if(!function_exists('get_catbynicename'))
 {
 /**
        Add These Functions to make our lives easier
 **/
 if(!function_exists('get_catbynicename'))
 {
-       function get_catbynicename($category_nicename) 
+       function get_catbynicename($category_nicename)
        {
        global $wpdb;
        {
        global $wpdb;
-       
+
        $cat_id -= 0;   // force numeric
        $name = $wpdb->get_var('SELECT cat_ID FROM '.$wpdb->categories.' WHERE category_nicename="'.$category_nicename.'"');
        $cat_id -= 0;   // force numeric
        $name = $wpdb->get_var('SELECT cat_ID FROM '.$wpdb->categories.' WHERE category_nicename="'.$category_nicename.'"');
-       
+
        return $name;
        }
 }
        return $name;
        }
 }
@@ -55,57 +60,58 @@ if(!function_exists('link_exists'))
 //
 //    This cries out for a C-implementation to be included in PHP core
 //
 //
 //    This cries out for a C-implementation to be included in PHP core
 //
-   function valid_1byte($char) {
-       if(!is_int($char)) return false;
-       return ($char & 0x80) == 0x00;
-   }
-  
-   function valid_2byte($char) {
-       if(!is_int($char)) return false;
-       return ($char & 0xE0) == 0xC0;
-   }
-
-   function valid_3byte($char) {
-       if(!is_int($char)) return false;
-       return ($char & 0xF0) == 0xE0;
-   }
-
-   function valid_4byte($char) {
-       if(!is_int($char)) return false;
-       return ($char & 0xF8) == 0xF0;
-   }
-  
-   function valid_nextbyte($char) {
-       if(!is_int($char)) return false;
-       return ($char & 0xC0) == 0x80;
-   }
-  
-   function valid_utf8($string) {
-       $len = strlen($string);
-       $i = 0;   
-       while( $i < $len ) {
-           $char = ord(substr($string, $i++, 1));
-           if(valid_1byte($char)) {    // continue
-               continue;
-           } else if(valid_2byte($char)) { // check 1 byte
-               if(!valid_nextbyte(ord(substr($string, $i++, 1))))
-                   return false;
-           } else if(valid_3byte($char)) { // check 2 bytes
-               if(!valid_nextbyte(ord(substr($string, $i++, 1))))
-                   return false;
-               if(!valid_nextbyte(ord(substr($string, $i++, 1))))
-                   return false;
-           } else if(valid_4byte($char)) { // check 3 bytes
-               if(!valid_nextbyte(ord(substr($string, $i++, 1))))
-                   return false;
-               if(!valid_nextbyte(ord(substr($string, $i++, 1))))
-                   return false;
-               if(!valid_nextbyte(ord(substr($string, $i++, 1))))
-                   return false;
-           } // goto next char
-       }
-       return true; // done
-   }
+
+function valid_1byte($char) {
+       if(!is_int($char)) return false;
+               return ($char & 0x80) == 0x00;
+}
+
+function valid_2byte($char) {
+       if(!is_int($char)) return false;
+               return ($char & 0xE0) == 0xC0;
+}
+
+function valid_3byte($char) {
+       if(!is_int($char)) return false;
+               return ($char & 0xF0) == 0xE0;
+}
+
+function valid_4byte($char) {
+       if(!is_int($char)) return false;
+               return ($char & 0xF8) == 0xF0;
+}
+
+function valid_nextbyte($char) {
+       if(!is_int($char)) return false;
+               return ($char & 0xC0) == 0x80;
+}
+
+function valid_utf8($string) {
+       $len = strlen($string);
+       $i = 0;
+       while( $i < $len ) {
+               $char = ord(substr($string, $i++, 1));
+               if(valid_1byte($char)) {    // continue
+                       continue;
+               } else if(valid_2byte($char)) { // check 1 byte
+                       if(!valid_nextbyte(ord(substr($string, $i++, 1))))
+                               return false;
+               } else if(valid_3byte($char)) { // check 2 bytes
+                       if(!valid_nextbyte(ord(substr($string, $i++, 1))))
+                               return false;
+                       if(!valid_nextbyte(ord(substr($string, $i++, 1))))
+                               return false;
+               } else if(valid_4byte($char)) { // check 3 bytes
+                       if(!valid_nextbyte(ord(substr($string, $i++, 1))))
+                               return false;
+                       if(!valid_nextbyte(ord(substr($string, $i++, 1))))
+                               return false;
+                       if(!valid_nextbyte(ord(substr($string, $i++, 1))))
+                               return false;
+               } // goto next char
+       }
+       return true; // done
+}
 
 function csc ($s) {
        if (valid_utf8 ($s)) {
 
 function csc ($s) {
        if (valid_utf8 ($s)) {
@@ -127,7 +133,7 @@ class Dotclear_Import {
        function header() 
        {
                echo '<div class="wrap">';
        function header() 
        {
                echo '<div class="wrap">';
-               echo '<h2>'.__('Import Dotclear').'</h2>';
+               echo '<h2>'.__('Import DotClear').'</h2>';
                echo '<p>'.__('Steps may take a few minutes depending on the size of your database. Please be patient.').'</p>';
        }
 
                echo '<p>'.__('Steps may take a few minutes depending on the size of your database. Please be patient.').'</p>';
        }
 
@@ -135,78 +141,79 @@ class Dotclear_Import {
        {
                echo '</div>';
        }
        {
                echo '</div>';
        }
-       
+
        function greet() 
        {
        function greet() 
        {
-               echo '<p>'.__('Howdy! This importer allows you to extract posts from a Dotclear database into your blog.  Mileage may vary.').'</p>';
-               echo '<p>'.__('Your Dotclear Configuration settings are as follows:').'</p>';
+               echo '<div class="narrow"><p>'.__('Howdy! This importer allows you to extract posts from a DotClear database into your blog.  Mileage may vary.').'</p>';
+               echo '<p>'.__('Your DotClear Configuration settings are as follows:').'</p>';
                echo '<form action="admin.php?import=dotclear&amp;step=1" method="post">';
                echo '<form action="admin.php?import=dotclear&amp;step=1" method="post">';
+               wp_nonce_field('import-dotclear');
                $this->db_form();
                $this->db_form();
-               echo '<input type="submit" name="submit" value="'.__('Import Categories').'" />';
-               echo '</form>';
+               echo '<p class="submit"><input type="submit" name="submit" value="'.attribute_escape(__('Import Categories &raquo;')).'" /></p>';
+               echo '</form></div>';
        }
 
        }
 
-       function get_dc_cats() 
+       function get_dc_cats()
        {
                global $wpdb;
                // General Housekeeping
                $dcdb = new wpdb(get_option('dcuser'), get_option('dcpass'), get_option('dcname'), get_option('dchost'));
                set_magic_quotes_runtime(0);
        {
                global $wpdb;
                // General Housekeeping
                $dcdb = new wpdb(get_option('dcuser'), get_option('dcpass'), get_option('dcname'), get_option('dchost'));
                set_magic_quotes_runtime(0);
-               $prefix = get_option('tpre');
-               
+               $dbprefix = get_option('dcdbprefix');
+
                // Get Categories
                // Get Categories
-               return $dcdb->get_results('SELECT * FROM dc_categorie', ARRAY_A);
+               return $dcdb->get_results('SELECT * FROM '.$dbprefix.'categorie', ARRAY_A);
        }
        }
-       
+
        function get_dc_users()
        {
                global $wpdb;
                // General Housekeeping
                $dcdb = new wpdb(get_option('dcuser'), get_option('dcpass'), get_option('dcname'), get_option('dchost'));
                set_magic_quotes_runtime(0);
        function get_dc_users()
        {
                global $wpdb;
                // General Housekeeping
                $dcdb = new wpdb(get_option('dcuser'), get_option('dcpass'), get_option('dcname'), get_option('dchost'));
                set_magic_quotes_runtime(0);
-               $prefix = get_option('tpre');
-               
+               $dbprefix = get_option('dcdbprefix');
+
                // Get Users
                // Get Users
-               
-               return $dcdb->get_results('SELECT * FROM dc_user', ARRAY_A);
+
+               return $dcdb->get_results('SELECT * FROM '.$dbprefix.'user', ARRAY_A);
        }
        }
-       
+
        function get_dc_posts()
        {
                // General Housekeeping
                $dcdb = new wpdb(get_option('dcuser'), get_option('dcpass'), get_option('dcname'), get_option('dchost'));
                set_magic_quotes_runtime(0);
        function get_dc_posts()
        {
                // General Housekeeping
                $dcdb = new wpdb(get_option('dcuser'), get_option('dcpass'), get_option('dcname'), get_option('dchost'));
                set_magic_quotes_runtime(0);
-               $prefix = get_option('tpre');
-               
+               $dbprefix = get_option('dcdbprefix');
+
                // Get Posts
                // Get Posts
-               return $dcdb->get_results('SELECT dc_post.*, dc_categorie.cat_libelle_url AS post_cat_name
-                                               FROM dc_post INNER JOIN dc_categorie
-                                                 ON dc_post.cat_id = dc_categorie.cat_id', ARRAY_A);
+               return $dcdb->get_results('SELECT '.$dbprefix.'post.*, '.$dbprefix.'categorie.cat_libelle_url AS post_cat_name
+                                               FROM '.$dbprefix.'post INNER JOIN '.$dbprefix.'categorie
+                                               ON '.$dbprefix.'post.cat_id = '.$dbprefix.'categorie.cat_id', ARRAY_A);
        }
        }
-       
+
        function get_dc_comments()
        {
                global $wpdb;
                // General Housekeeping
                $dcdb = new wpdb(get_option('dcuser'), get_option('dcpass'), get_option('dcname'), get_option('dchost'));
                set_magic_quotes_runtime(0);
        function get_dc_comments()
        {
                global $wpdb;
                // General Housekeeping
                $dcdb = new wpdb(get_option('dcuser'), get_option('dcpass'), get_option('dcname'), get_option('dchost'));
                set_magic_quotes_runtime(0);
-               $prefix = get_option('tpre');
-               
+               $dbprefix = get_option('dcdbprefix');
+
                // Get Comments
                // Get Comments
-               return $dcdb->get_results('SELECT * FROM dc_comment', ARRAY_A);
+               return $dcdb->get_results('SELECT * FROM '.$dbprefix.'comment', ARRAY_A);
        }
        }
-       
+
        function get_dc_links()
        {
                //General Housekeeping
                $dcdb = new wpdb(get_option('dcuser'), get_option('dcpass'), get_option('dcname'), get_option('dchost'));
                set_magic_quotes_runtime(0);
        function get_dc_links()
        {
                //General Housekeeping
                $dcdb = new wpdb(get_option('dcuser'), get_option('dcpass'), get_option('dcname'), get_option('dchost'));
                set_magic_quotes_runtime(0);
-               $prefix = get_option('tpre');
+               $dbprefix = get_option('dcdbprefix');
 
 
-               return $dcdb->get_results('SELECT * FROM dc_link ORDER BY position', ARRAY_A);
+               return $dcdb->get_results('SELECT * FROM '.$dbprefix.'link ORDER BY position', ARRAY_A);
        }
        }
-       
-       function cat2wp($categories='') 
+
+       function cat2wp($categories='')
        {
                // General Housekeeping
                global $wpdb;
        {
                // General Housekeeping
                global $wpdb;
@@ -216,11 +223,11 @@ class Dotclear_Import {
                if(is_array($categories))
                {
                        echo '<p>'.__('Importing Categories...').'<br /><br /></p>';
                if(is_array($categories))
                {
                        echo '<p>'.__('Importing Categories...').'<br /><br /></p>';
-                       foreach ($categories as $category) 
+                       foreach ($categories as $category)
                        {
                                $count++;
                                extract($category);
                        {
                                $count++;
                                extract($category);
-                               
+
                                // Make Nice Variables
                                $name = $wpdb->escape($cat_libelle_url);
                                $title = $wpdb->escape(csc ($cat_libelle));
                                // Make Nice Variables
                                $name = $wpdb->escape($cat_libelle_url);
                                $title = $wpdb->escape(csc ($cat_libelle));
@@ -236,7 +243,7 @@ class Dotclear_Import {
                                }
                                $dccat2wpcat[$id] = $ret_id;
                        }
                                }
                                $dccat2wpcat[$id] = $ret_id;
                        }
-                       
+
                        // Store category translation for future use
                        add_option('dccat2wpcat',$dccat2wpcat);
                        echo '<p>'.sprintf(__('Done! <strong>%1$s</strong> categories imported.'), $count).'<br /><br /></p>';
                        // Store category translation for future use
                        add_option('dccat2wpcat',$dccat2wpcat);
                        echo '<p>'.sprintf(__('Done! <strong>%1$s</strong> categories imported.'), $count).'<br /><br /></p>';
@@ -245,14 +252,14 @@ class Dotclear_Import {
                echo __('No Categories to Import!');
                return false;
        }
                echo __('No Categories to Import!');
                return false;
        }
-       
+
        function users2wp($users='')
        {
                // General Housekeeping
                global $wpdb;
                $count = 0;
                $dcid2wpid = array();
        function users2wp($users='')
        {
                // General Housekeeping
                global $wpdb;
                $count = 0;
                $dcid2wpid = array();
-               
+
                // Midnight Mojo
                if(is_array($users))
                {
                // Midnight Mojo
                if(is_array($users))
                {
@@ -261,14 +268,14 @@ class Dotclear_Import {
                        {
                                $count++;
                                extract($user);
                        {
                                $count++;
                                extract($user);
-                               
+
                                // Make Nice Variables
                                $name = $wpdb->escape(csc ($name));
                                $RealName = $wpdb->escape(csc ($user_pseudo));
                                // Make Nice Variables
                                $name = $wpdb->escape(csc ($name));
                                $RealName = $wpdb->escape(csc ($user_pseudo));
-                               
+
                                if($uinfo = get_userdatabylogin($name))
                                {
                                if($uinfo = get_userdatabylogin($name))
                                {
-                                       
+
                                        $ret_id = wp_insert_user(array(
                                                                'ID'            => $uinfo->ID,
                                                                'user_login'    => $user_id,
                                        $ret_id = wp_insert_user(array(
                                                                'ID'            => $uinfo->ID,
                                                                'user_login'    => $user_id,
@@ -278,7 +285,7 @@ class Dotclear_Import {
                                                                'display_name'  => $Realname)
                                                                );
                                }
                                                                'display_name'  => $Realname)
                                                                );
                                }
-                               else 
+                               else
                                {
                                        $ret_id = wp_insert_user(array(
                                                                'user_login'    => $user_id,
                                {
                                        $ret_id = wp_insert_user(array(
                                                                'user_login'    => $user_id,
@@ -289,9 +296,9 @@ class Dotclear_Import {
                                                                );
                                }
                                $dcid2wpid[$user_id] = $ret_id;
                                                                );
                                }
                                $dcid2wpid[$user_id] = $ret_id;
-                               
-                               // Set Dotclear-to-WordPress permissions translation
-                               
+
+                               // Set DotClear-to-WordPress permissions translation
+
                                // Update Usermeta Data
                                $user = new WP_User($ret_id);
                                $wp_perms = $user_level + 1;
                                // Update Usermeta Data
                                $user = new WP_User($ret_id);
                                $wp_perms = $user_level + 1;
@@ -302,26 +309,26 @@ class Dotclear_Import {
                                else if(3  <= $wp_perms) { $user->set_role('contributor'); }
                                else if(2  <= $wp_perms) { $user->set_role('contributor'); }
                                else                     { $user->set_role('subscriber'); }
                                else if(3  <= $wp_perms) { $user->set_role('contributor'); }
                                else if(2  <= $wp_perms) { $user->set_role('contributor'); }
                                else                     { $user->set_role('subscriber'); }
-                               
+
                                update_usermeta( $ret_id, 'wp_user_level', $wp_perms);
                                update_usermeta( $ret_id, 'rich_editing', 'false');
                                update_usermeta( $ret_id, 'first_name', csc ($user_prenom));
                                update_usermeta( $ret_id, 'last_name', csc ($user_nom));
                        }// End foreach($users as $user)
                                update_usermeta( $ret_id, 'wp_user_level', $wp_perms);
                                update_usermeta( $ret_id, 'rich_editing', 'false');
                                update_usermeta( $ret_id, 'first_name', csc ($user_prenom));
                                update_usermeta( $ret_id, 'last_name', csc ($user_nom));
                        }// End foreach($users as $user)
-                       
+
                        // Store id translation array for future use
                        add_option('dcid2wpid',$dcid2wpid);
                        // Store id translation array for future use
                        add_option('dcid2wpid',$dcid2wpid);
-                       
-                       
+
+
                        echo '<p>'.sprintf(__('Done! <strong>%1$s</strong> users imported.'), $count).'<br /><br /></p>';
                        return true;
                }// End if(is_array($users)
                        echo '<p>'.sprintf(__('Done! <strong>%1$s</strong> users imported.'), $count).'<br /><br /></p>';
                        return true;
                }// End if(is_array($users)
-               
+
                echo __('No Users to Import!');
                return false;
                echo __('No Users to Import!');
                return false;
-               
+
        }// End function user2wp()
        }// End function user2wp()
-       
+
        function posts2wp($posts='')
        {
                // General Housekeeping
        function posts2wp($posts='')
        {
                // General Housekeeping
@@ -338,17 +345,18 @@ class Dotclear_Import {
                        {
                                $count++;
                                extract($post);
                        {
                                $count++;
                                extract($post);
-                               
-                               // Set Dotclear-to-WordPress status translation
+
+                               // Set DotClear-to-WordPress status translation
                                $stattrans = array(0 => 'draft', 1 => 'publish');
                                $comment_status_map = array (0 => 'closed', 1 => 'open');
                                $stattrans = array(0 => 'draft', 1 => 'publish');
                                $comment_status_map = array (0 => 'closed', 1 => 'open');
-                               
+
                                //Can we do this more efficiently?
                                $uinfo = ( get_userdatabylogin( $user_id ) ) ? get_userdatabylogin( $user_id ) : 1;
                                $authorid = ( is_object( $uinfo ) ) ? $uinfo->ID : $uinfo ;
 
                                $Title = $wpdb->escape(csc ($post_titre));
                                $post_content = textconv ($post_content);
                                //Can we do this more efficiently?
                                $uinfo = ( get_userdatabylogin( $user_id ) ) ? get_userdatabylogin( $user_id ) : 1;
                                $authorid = ( is_object( $uinfo ) ) ? $uinfo->ID : $uinfo ;
 
                                $Title = $wpdb->escape(csc ($post_titre));
                                $post_content = textconv ($post_content);
+                               $post_excerpt = "";
                                if ($post_chapo != "") {
                                        $post_excerpt = textconv ($post_chapo);
                                        $post_content = $post_excerpt ."\n<!--more-->\n".$post_content;
                                if ($post_chapo != "") {
                                        $post_excerpt = textconv ($post_chapo);
                                        $post_content = $post_excerpt ."\n<!--more-->\n".$post_content;
@@ -356,9 +364,9 @@ class Dotclear_Import {
                                $post_excerpt = $wpdb->escape ($post_excerpt);
                                $post_content = $wpdb->escape ($post_content);
                                $post_status = $stattrans[$post_pub];
                                $post_excerpt = $wpdb->escape ($post_excerpt);
                                $post_content = $wpdb->escape ($post_content);
                                $post_status = $stattrans[$post_pub];
-                               
+
                                // Import Post data into WordPress
                                // Import Post data into WordPress
-                               
+
                                if($pinfo = post_exists($Title,$post_content))
                                {
                                        $ret_id = wp_insert_post(array(
                                if($pinfo = post_exists($Title,$post_content))
                                {
                                        $ret_id = wp_insert_post(array(
@@ -378,7 +386,7 @@ class Dotclear_Import {
                                                        'comment_count'         => $post_nb_comment + $post_nb_trackback)
                                                        );
                                }
                                                        'comment_count'         => $post_nb_comment + $post_nb_trackback)
                                                        );
                                }
-                               else 
+                               else
                                {
                                        $ret_id = wp_insert_post(array(
                                                        'post_author'           => $authorid,
                                {
                                        $ret_id = wp_insert_post(array(
                                                        'post_author'           => $authorid,
@@ -397,7 +405,7 @@ class Dotclear_Import {
                                                        );
                                }
                                $dcposts2wpposts[$post_id] = $ret_id;
                                                        );
                                }
                                $dcposts2wpposts[$post_id] = $ret_id;
-                               
+
                                // Make Post-to-Category associations
                                $cats = array();
                                if($cat1 = get_catbynicename($post_cat_name)) { $cats[1] = $cat1; }
                                // Make Post-to-Category associations
                                $cats = array();
                                if($cat1 = get_catbynicename($post_cat_name)) { $cats[1] = $cat1; }
@@ -407,11 +415,11 @@ class Dotclear_Import {
                }
                // Store ID translation for later use
                add_option('dcposts2wpposts',$dcposts2wpposts);
                }
                // Store ID translation for later use
                add_option('dcposts2wpposts',$dcposts2wpposts);
-               
+
                echo '<p>'.sprintf(__('Done! <strong>%1$s</strong> posts imported.'), $count).'<br /><br /></p>';
                echo '<p>'.sprintf(__('Done! <strong>%1$s</strong> posts imported.'), $count).'<br /><br /></p>';
-               return true;    
+               return true;
        }
        }
-       
+
        function comments2wp($comments='')
        {
                // General Housekeeping
        function comments2wp($comments='')
        {
                // General Housekeeping
@@ -419,7 +427,7 @@ class Dotclear_Import {
                $count = 0;
                $dccm2wpcm = array();
                $postarr = get_option('dcposts2wpposts');
                $count = 0;
                $dccm2wpcm = array();
                $postarr = get_option('dcposts2wpposts');
-               
+
                // Magic Mojo
                if(is_array($comments))
                {
                // Magic Mojo
                if(is_array($comments))
                {
@@ -428,16 +436,16 @@ class Dotclear_Import {
                        {
                                $count++;
                                extract($comment);
                        {
                                $count++;
                                extract($comment);
-                               
+
                                // WordPressify Data
                                // WordPressify Data
-                               $comment_ID = ltrim($comment_id, '0');
-                               $comment_post_ID = $postarr[$post_id];
+                               $comment_ID = (int) ltrim($comment_id, '0');
+                               $comment_post_ID = (int) $postarr[$post_id];
                                $comment_approved = "$comment_pub";
                                $name = $wpdb->escape(csc ($comment_auteur));
                                $email = $wpdb->escape($comment_email);
                                $web = "http://".$wpdb->escape($comment_site);
                                $message = $wpdb->escape(textconv ($comment_content));
                                $comment_approved = "$comment_pub";
                                $name = $wpdb->escape(csc ($comment_auteur));
                                $email = $wpdb->escape($comment_email);
                                $web = "http://".$wpdb->escape($comment_site);
                                $message = $wpdb->escape(textconv ($comment_content));
-                               
+
                                if($cinfo = comment_exists($name, $comment_dt))
                                {
                                        // Update comments
                                if($cinfo = comment_exists($name, $comment_dt))
                                {
                                        // Update comments
@@ -454,7 +462,7 @@ class Dotclear_Import {
                                                        'comment_approved'      => $comment_approved)
                                                        );
                                }
                                                        'comment_approved'      => $comment_approved)
                                                        );
                                }
-                               else 
+                               else
                                {
                                        // Insert comments
                                        $ret_id = wp_insert_comment(array(
                                {
                                        // Insert comments
                                        $ret_id = wp_insert_comment(array(
@@ -472,25 +480,25 @@ class Dotclear_Import {
                                $dccm2wpcm[$comment_ID] = $ret_id;
                        }
                        // Store Comment ID translation for future use
                                $dccm2wpcm[$comment_ID] = $ret_id;
                        }
                        // Store Comment ID translation for future use
-                       add_option('dccm2wpcm', $dccm2wpcm);                    
-                       
+                       add_option('dccm2wpcm', $dccm2wpcm);
+
                        // Associate newly formed categories with posts
                        get_comment_count($ret_id);
                        // Associate newly formed categories with posts
                        get_comment_count($ret_id);
-                       
-                       
+
+
                        echo '<p>'.sprintf(__('Done! <strong>%1$s</strong> comments imported.'), $count).'<br /><br /></p>';
                        return true;
                }
                echo __('No Comments to Import!');
                return false;
        }
                        echo '<p>'.sprintf(__('Done! <strong>%1$s</strong> comments imported.'), $count).'<br /><br /></p>';
                        return true;
                }
                echo __('No Comments to Import!');
                return false;
        }
-       
+
        function links2wp($links='')
        {
                // General Housekeeping
                global $wpdb;
                $count = 0;
        function links2wp($links='')
        {
                // General Housekeeping
                global $wpdb;
                $count = 0;
-               
+
                // Deal with the links
                if(is_array($links))
                {
                // Deal with the links
                if(is_array($links))
                {
@@ -499,7 +507,7 @@ class Dotclear_Import {
                        {
                                $count++;
                                extract($link);
                        {
                                $count++;
                                extract($link);
-                               
+
                                if ($title != "") {
                                        if ($cinfo = link_cat_exists (csc ($title))) {
                                                $category = $cinfo;
                                if ($title != "") {
                                        if ($cinfo = link_cat_exists (csc ($title))) {
                                                $category = $cinfo;
@@ -511,7 +519,7 @@ class Dotclear_Import {
                                } else {
                                        $linkname = $wpdb->escape(csc ($label));
                                        $description = $wpdb->escape(csc ($title));
                                } else {
                                        $linkname = $wpdb->escape(csc ($label));
                                        $description = $wpdb->escape(csc ($title));
-                               
+
                                        if($linfo = link_exists($linkname)) {
                                                $ret_id = wp_insert_link(array(
                                                                        'link_id'               => $linfo,
                                        if($linfo = link_exists($linkname)) {
                                                $ret_id = wp_insert_link(array(
                                                                        'link_id'               => $linfo,
@@ -540,70 +548,75 @@ class Dotclear_Import {
                echo __('No Links to Import!');
                return false;
        }
                echo __('No Links to Import!');
                return false;
        }
-               
-       function import_categories() 
-       {       
-               // Category Import      
+
+       function import_categories()
+       {
+               // Category Import
                $cats = $this->get_dc_cats();
                $this->cat2wp($cats);
                add_option('dc_cats', $cats);
                $cats = $this->get_dc_cats();
                $this->cat2wp($cats);
                add_option('dc_cats', $cats);
-               
-               
-                       
+
+
+
                echo '<form action="admin.php?import=dotclear&amp;step=2" method="post">';
                echo '<form action="admin.php?import=dotclear&amp;step=2" method="post">';
-               printf('<input type="submit" name="submit" value="%s" />', __('Import Users'));
+               wp_nonce_field('import-dotclear');
+               printf('<input type="submit" name="submit" value="%s" />', attribute_escape(__('Import Users')));
                echo '</form>';
 
        }
                echo '</form>';
 
        }
-       
+
        function import_users()
        {
                // User Import
        function import_users()
        {
                // User Import
-               $users = $this->get_dc_users(); 
+               $users = $this->get_dc_users();
                $this->users2wp($users);
                $this->users2wp($users);
-               
+
                echo '<form action="admin.php?import=dotclear&amp;step=3" method="post">';
                echo '<form action="admin.php?import=dotclear&amp;step=3" method="post">';
-               printf('<input type="submit" name="submit" value="%s" />', __('Import Posts'));
+               wp_nonce_field('import-dotclear');
+               printf('<input type="submit" name="submit" value="%s" />', attribute_escape(__('Import Posts')));
                echo '</form>';
        }
                echo '</form>';
        }
-       
+
        function import_posts()
        {
                // Post Import
                $posts = $this->get_dc_posts();
                $this->posts2wp($posts);
        function import_posts()
        {
                // Post Import
                $posts = $this->get_dc_posts();
                $this->posts2wp($posts);
-               
+
                echo '<form action="admin.php?import=dotclear&amp;step=4" method="post">';
                echo '<form action="admin.php?import=dotclear&amp;step=4" method="post">';
-               printf('<input type="submit" name="submit" value="%s" />', __('Import Comments'));
+               wp_nonce_field('import-dotclear');
+               printf('<input type="submit" name="submit" value="%s" />', attribute_escape(__('Import Comments')));
                echo '</form>';
        }
                echo '</form>';
        }
-       
+
        function import_comments()
        {
                // Comment Import
                $comments = $this->get_dc_comments();
                $this->comments2wp($comments);
        function import_comments()
        {
                // Comment Import
                $comments = $this->get_dc_comments();
                $this->comments2wp($comments);
-               
+
                echo '<form action="admin.php?import=dotclear&amp;step=5" method="post">';
                echo '<form action="admin.php?import=dotclear&amp;step=5" method="post">';
-               printf('<input type="submit" name="submit" value="%s" />', __('Import Links'));
+               wp_nonce_field('import-dotclear');
+               printf('<input type="submit" name="submit" value="%s" />', attribute_escape(__('Import Links')));
                echo '</form>';
        }
                echo '</form>';
        }
-       
+
        function import_links()
        {
                //Link Import
                $links = $this->get_dc_links();
                $this->links2wp($links);
                add_option('dc_links', $links);
        function import_links()
        {
                //Link Import
                $links = $this->get_dc_links();
                $this->links2wp($links);
                add_option('dc_links', $links);
-               
+
                echo '<form action="admin.php?import=dotclear&amp;step=6" method="post">';
                echo '<form action="admin.php?import=dotclear&amp;step=6" method="post">';
-               printf('<input type="submit" name="submit" value="%s" />', __('Finish'));
+               wp_nonce_field('import-dotclear');
+               printf('<input type="submit" name="submit" value="%s" />', attribute_escape(__('Finish')));
                echo '</form>';
        }
                echo '</form>';
        }
-       
+
        function cleanup_dcimport()
        {
        function cleanup_dcimport()
        {
-               delete_option('tpre');
+               delete_option('dcdbprefix');
                delete_option('dc_cats');
                delete_option('dcid2wpid');
                delete_option('dccat2wpcat');
                delete_option('dc_cats');
                delete_option('dcid2wpid');
                delete_option('dccat2wpcat');
@@ -617,39 +630,39 @@ class Dotclear_Import {
                delete_option('dccharset');
                $this->tips();
        }
                delete_option('dccharset');
                $this->tips();
        }
-       
+
        function tips()
        {
        function tips()
        {
-               echo '<p>'.__('Welcome to WordPress.  We hope (and expect!) that you will find this platform incredibly rewarding!  As a new WordPress user coming from Dotclear, there are some things that we would like to point out.  Hopefully, they will help your transition go as smoothly as possible.').'</p>';
+               echo '<p>'.__('Welcome to WordPress.  We hope (and expect!) that you will find this platform incredibly rewarding!  As a new WordPress user coming from DotClear, there are some things that we would like to point out.  Hopefully, they will help your transition go as smoothly as possible.').'</p>';
                echo '<h3>'.__('Users').'</h3>';
                echo '<h3>'.__('Users').'</h3>';
-               echo '<p>'.sprintf(__('You have already setup WordPress and have been assigned an administrative login and password.  Forget it.  You didn\'t have that login in Dotclear, why should you have it here?  Instead we have taken care to import all of your users into our system.  Unfortunately there is one downside.  Because both WordPress and Dotclear uses a strong encryption hash with passwords, it is impossible to decrypt it and we are forced to assign temporary passwords to all your users.  <strong>Every user has the same username, but their passwords are reset to password123.</strong>  So <a href="%1$s">Login</a> and change it.'), '/wp-login.php').'</p>';
+               echo '<p>'.sprintf(__('You have already setup WordPress and have been assigned an administrative login and password.  Forget it.  You didn\'t have that login in DotClear, why should you have it here?  Instead we have taken care to import all of your users into our system.  Unfortunately there is one downside.  Because both WordPress and DotClear uses a strong encryption hash with passwords, it is impossible to decrypt it and we are forced to assign temporary passwords to all your users.  <strong>Every user has the same username, but their passwords are reset to password123.</strong>  So <a href="%1$s">Login</a> and change it.'), '/wp-login.php').'</p>';
                echo '<h3>'.__('Preserving Authors').'</h3>';
                echo '<p>'.__('Secondly, we have attempted to preserve post authors.  If you are the only author or contributor to your blog, then you are safe.  In most cases, we are successful in this preservation endeavor.  However, if we cannot ascertain the name of the writer due to discrepancies between database tables, we assign it to you, the administrative user.').'</p>';
                echo '<h3>'.__('Textile').'</h3>';
                echo '<h3>'.__('Preserving Authors').'</h3>';
                echo '<p>'.__('Secondly, we have attempted to preserve post authors.  If you are the only author or contributor to your blog, then you are safe.  In most cases, we are successful in this preservation endeavor.  However, if we cannot ascertain the name of the writer due to discrepancies between database tables, we assign it to you, the administrative user.').'</p>';
                echo '<h3>'.__('Textile').'</h3>';
-               echo '<p>'.__('Also, since you\'re coming from Dotclear, you probably have been using Textile to format your comments and posts.  If this is the case, we recommend downloading and installing <a href="http://www.huddledmasses.org/2004/04/19/wordpress-plugin-textile-20/">Textile for WordPress</a>.  Trust me... You\'ll want it.').'</p>';
+               echo '<p>'.__('Also, since you\'re coming from DotClear, you probably have been using Textile to format your comments and posts.  If this is the case, we recommend downloading and installing <a href="http://www.huddledmasses.org/category/development/wordpress/textile/">Textile for WordPress</a>.  Trust me... You\'ll want it.').'</p>';
                echo '<h3>'.__('WordPress Resources').'</h3>';
                echo '<p>'.__('Finally, there are numerous WordPress resources around the internet.  Some of them are:').'</p>';
                echo '<ul>';
                echo '<li>'.__('<a href="http://www.wordpress.org">The official WordPress site</a>').'</li>';
                echo '<h3>'.__('WordPress Resources').'</h3>';
                echo '<p>'.__('Finally, there are numerous WordPress resources around the internet.  Some of them are:').'</p>';
                echo '<ul>';
                echo '<li>'.__('<a href="http://www.wordpress.org">The official WordPress site</a>').'</li>';
-               echo '<li>'.__('<a href="http://wordpress.org/support/">The WordPress support forums').'</li>';
+               echo '<li>'.__('<a href="http://wordpress.org/support/">The WordPress support forums</a>').'</li>';
                echo '<li>'.__('<a href="http://codex.wordpress.org">The Codex (In other words, the WordPress Bible)</a>').'</li>';
                echo '</ul>';
                echo '<li>'.__('<a href="http://codex.wordpress.org">The Codex (In other words, the WordPress Bible)</a>').'</li>';
                echo '</ul>';
-               echo '<p>'.sprintf(__('That\'s it! What are you waiting for? Go <a href="%1$s">login</a>!'), '/wp-login.php').'</p>';
+               echo '<p>'.sprintf(__('That\'s it! What are you waiting for? Go <a href="%1$s">login</a>!'), '../wp-login.php').'</p>';
        }
        }
-       
+
        function db_form()
        {
        function db_form()
        {
-               echo '<ul>';
-               printf('<li><label for="dbuser">%s</label> <input type="text" name="dbuser" id="dbuser" /></li>', __('Dotclear Database User:'));
-               printf('<li><label for="dbpass">%s</label> <input type="password" name="dbpass" id="dbpass" /></li>', __('Dotclear Database Password:'));
-               printf('<li><label for="dbname">%s</label> <input type="text" name="dbname" id="dbname" /></li>', __('Dotclear Database Name:'));
-               printf('<li><label for="dbhost">%s</label> <input type="text" name="dbhost" id="dbhost" value="localhost" /></li>', __('Dotclear Database Host:'));
-               /* printf('<li><label for="dbprefix">%s</label> <input type="text" name="dbprefix" /></li>', __('Dotclear Table prefix (if any):')); */
-               printf('<li><label for="dccharset">%s</label> <input type="text" id="dccharset" name="dccharset" value="ISO-8859-15"/></li>', __('Originating character set:'));
-               echo '</ul>';
+               echo '<table class="editform">';
+               printf('<tr><th><label for="dbuser">%s</label></th><td><input type="text" name="dbuser" id="dbuser" /></td></tr>', __('DotClear Database User:'));
+               printf('<tr><th><label for="dbpass">%s</label></th><td><input type="password" name="dbpass" id="dbpass" /></td></tr>', __('DotClear Database Password:'));
+               printf('<tr><th><label for="dbname">%s</label></th><td><input type="text" name="dbname" id="dbname" /></td></tr>', __('DotClear Database Name:'));
+               printf('<tr><th><label for="dbhost">%s</label></th><td><input type="text" name="dbhost" nameid="dbhost" value="localhost" /></td></tr>', __('DotClear Database Host:'));
+               printf('<tr><th><label for="dbprefix">%s</label></th><td><input type="text" name="dbprefix" id="dbprefix" value="dc_"/></td></tr>', __('DotClear Table prefix:'));
+               printf('<tr><th><label for="dccharset">%s</label></th><td><input type="text" name="dccharset" id="dccharset" value="ISO-8859-15"/></td></tr>', __('Originating character set:'));
+               echo '</table>';
        }
        }
-       
-       function dispatch() 
+
+       function dispatch()
        {
 
                if (empty ($_GET['step']))
        {
 
                if (empty ($_GET['step']))
@@ -657,51 +670,53 @@ class Dotclear_Import {
                else
                        $step = (int) $_GET['step'];
                $this->header();
                else
                        $step = (int) $_GET['step'];
                $this->header();
-               
-               if ( $step > 0 ) 
+
+               if ( $step > 0 )
                {
                {
+                       check_admin_referer('import-dotclear');
+
                        if($_POST['dbuser'])
                        {
                                if(get_option('dcuser'))
                        if($_POST['dbuser'])
                        {
                                if(get_option('dcuser'))
-                                       delete_option('dcuser');        
-                               add_option('dcuser',$_POST['dbuser']);
+                                       delete_option('dcuser');
+                               add_option('dcuser', sanitize_user($_POST['dbuser'], true));
                        }
                        if($_POST['dbpass'])
                        {
                                if(get_option('dcpass'))
                        }
                        if($_POST['dbpass'])
                        {
                                if(get_option('dcpass'))
-                                       delete_option('dcpass');        
-                               add_option('dcpass',$_POST['dbpass']);
+                                       delete_option('dcpass');
+                               add_option('dcpass', sanitize_user($_POST['dbpass'], true));
                        }
                        }
-                       
+
                        if($_POST['dbname'])
                        {
                                if(get_option('dcname'))
                        if($_POST['dbname'])
                        {
                                if(get_option('dcname'))
-                                       delete_option('dcname');        
-                               add_option('dcname',$_POST['dbname']);
+                                       delete_option('dcname');
+                               add_option('dcname', sanitize_user($_POST['dbname'], true));
                        }
                        if($_POST['dbhost'])
                        {
                                if(get_option('dchost'))
                                        delete_option('dchost');
                        }
                        if($_POST['dbhost'])
                        {
                                if(get_option('dchost'))
                                        delete_option('dchost');
-                               add_option('dchost',$_POST['dbhost']); 
+                               add_option('dchost', sanitize_user($_POST['dbhost'], true));
                        }
                        if($_POST['dccharset'])
                        {
                                if(get_option('dccharset'))
                                        delete_option('dccharset');
                        }
                        if($_POST['dccharset'])
                        {
                                if(get_option('dccharset'))
                                        delete_option('dccharset');
-                               add_option('dccharset',$_POST['dccharset']); 
-                       }                       
+                               add_option('dccharset', sanitize_user($_POST['dccharset'], true));
+                       }
                        if($_POST['dbprefix'])
                        {
                        if($_POST['dbprefix'])
                        {
-                               if(get_option('tpre'))
-                                       delete_option('tpre');
-                               add_option('tpre',$_POST['dbprefix']); 
-                       }                       
+                               if(get_option('dcdbprefix'))
+                                       delete_option('dcdbprefix');
+                               add_option('dcdbprefix', sanitize_user($_POST['dbprefix'], true));
+                       }
 
 
                }
 
 
 
                }
 
-               switch ($step) 
+               switch ($step)
                {
                        default:
                        case 0 :
                {
                        default:
                        case 0 :
@@ -726,16 +741,16 @@ class Dotclear_Import {
                                $this->cleanup_dcimport();
                                break;
                }
                                $this->cleanup_dcimport();
                                break;
                }
-               
+
                $this->footer();
        }
 
                $this->footer();
        }
 
-       function Dotclear_Import() 
+       function Dotclear_Import()
        {
        {
-               // Nothing.     
+               // Nothing.
        }
 }
 
 $dc_import = new Dotclear_Import();
        }
 }
 
 $dc_import = new Dotclear_Import();
-register_importer('dotclear', 'Dotclear', __('Import posts from a Dotclear Blog'), array ($dc_import, 'dispatch'));
+register_importer('dotclear', __('DotClear'), __('Import categories, users, posts, comments, and links from a DotClear blog'), array ($dc_import, 'dispatch'));
 ?>
 ?>
index e69de29bb2d1d6434b8b29ae775ad8c2e48c5391..4305cd18ce18bc472b1ee2c95c10b52ed41f6b75 100644 (file)
@@ -0,0 +1,317 @@
+<?php
+
+class GM_Import {
+
+       var $gmnames = array ();
+
+       function header() {
+               echo '<div class="wrap">';
+               echo '<h2>'.__('Import GreyMatter').'</h2>';
+       }
+
+       function footer() {
+               echo '</div>';
+       }
+
+       function greet() {
+               $this->header();
+?>
+<p><?php _e('This is a basic GreyMatter to WordPress import script.') ?></p>
+<p><?php _e('What it does:') ?></p>
+<ul>
+<li><?php _e('Parses gm-authors.cgi to import (new) authors. Everyone is imported at level 1.') ?></li>
+<li><?php _e('Parses the entries cgi files to import posts, comments, and karma on posts (although karma is not used on WordPress yet).<br />If authors are found not to be in gm-authors.cgi, imports them at level 0.') ?></li>
+<li><?php _e("Detects duplicate entries or comments. If you don't import everything the first time, or this import should fail in the middle, duplicate entries will not be made when you try again.") ?></li>
+</ul>
+<p><?php _e('What it does not:') ?></p>
+<ul>
+<li><?php _e('Parse gm-counter.cgi, gm-banlist.cgi, gm-cplog.cgi (you can make a CP log hack if you really feel like it, but I question the need of a CP log).') ?></li>
+<li><?php _e('Import gm-templates.') ?></li>
+<li><?php _e("Doesn't keep entries on top.")?></li>
+</ul>
+<p>&nbsp;</p>
+
+<form name="stepOne" method="get">
+<input type="hidden" name="import" value="greymatter" />
+<input type="hidden" name="step" value="1" />
+<?php wp_nonce_field('import-greymatter'); ?>
+<h3><?php _e('Second step: GreyMatter details:') ?></h3>
+<p><table cellpadding="0">
+<tr>
+<td><?php _e('Path to GM files:') ?></td>
+<td><input type="text" style="width:300px" name="gmpath" value="/home/my/site/cgi-bin/greymatter/" /></td>
+</tr>
+<tr>
+<td><?php _e('Path to GM entries:') ?></td>
+<td><input type="text" style="width:300px" name="archivespath" value="/home/my/site/cgi-bin/greymatter/archives/" /></td>
+</tr>
+<tr>
+<td colspan="2"><br /><?php _e("This importer will search for files 00000001.cgi to 000-whatever.cgi,<br />so you need to enter the number of the last GM post here.<br />(if you don't know that number, just log into your FTP and look it out<br />in the entries' folder)") ?></td>
+</tr>
+<tr>
+<td><?php _e("Last entry's number:") ?></td>
+<td><input type="text" name="lastentry" value="00000001" /></td>
+</tr>
+</table>
+</p>
+<p><?php _e("When you're ready, click OK to start importing: ") ?><input type="submit" name="submit" value="<?php _e('OK') ?>" class="search" /></p>
+</form>
+<p>&nbsp</p>
+<?php
+               $this->footer();
+       }
+
+
+
+       function gm2autobr($string) { // transforms GM's |*| into b2's <br />\n
+               $string = str_replace("|*|","<br />\n",$string);
+               return($string);
+       }
+
+       function import() {
+               global $wpdb;
+
+               $wpvarstoreset = array('gmpath', 'archivespath', 'lastentry');
+               for ($i=0; $i<count($wpvarstoreset); $i += 1) {
+                       $wpvar = $wpvarstoreset[$i];
+                       if (!isset($$wpvar)) {
+                               if (empty($_POST["$wpvar"])) {
+                                       if (empty($_GET["$wpvar"])) {
+                                               $$wpvar = '';
+                                       } else {
+                                               $$wpvar = $_GET["$wpvar"];
+                                       }
+                               } else {
+                                       $$wpvar = $_POST["$wpvar"];
+                               }
+                       }
+               }
+
+               if (!chdir($archivespath))
+                       wp_die(__("Wrong path, the path to the GM entries does not exist on the server"));
+
+               if (!chdir($gmpath))
+                       wp_die(__("Wrong path, the path to the GM files does not exist on the server"));
+
+               $lastentry = (int) $lastentry;
+
+               $this->header();
+?>
+<p><?php _e('The importer is running...') ?></p>
+<ul>
+<li><?php _e('importing users...') ?><ul><?php
+
+       chdir($gmpath);
+       $userbase = file("gm-authors.cgi");
+
+       foreach($userbase as $user) {
+               $userdata=explode("|", $user);
+
+               $user_ip="127.0.0.1";
+               $user_domain="localhost";
+               $user_browser="server";
+
+               $s=$userdata[4];
+               $user_joindate=substr($s,6,4)."-".substr($s,0,2)."-".substr($s,3,2)." 00:00:00";
+
+               $user_login=$wpdb->escape($userdata[0]);
+               $pass1=$wpdb->escape($userdata[1]);
+               $user_nickname=$wpdb->escape($userdata[0]);
+               $user_email=$wpdb->escape($userdata[2]);
+               $user_url=$wpdb->escape($userdata[3]);
+               $user_joindate=$wpdb->escape($user_joindate);
+
+               $user_id = username_exists($user_login);
+               if ($user_id) {
+                       printf('<li>'.__('user %s').'<strong>'.__('Already exists').'</strong></li>', "<em>$user_login</em>");
+                       $this->gmnames[$userdata[0]] = $user_id;
+                       continue;
+               }
+
+               $user_info = array("user_login"=>"$user_login", "user_pass"=>"$pass1", "user_nickname"=>"$user_nickname", "user_email"=>"$user_email", "user_url"=>"$user_url", "user_ip"=>"$user_ip", "user_domain"=>"$user_domain", "user_browser"=>"$user_browser", "dateYMDhour"=>"$user_joindate", "user_level"=>"1", "user_idmode"=>"nickname");
+               $user_id = wp_insert_user($user_info);
+               $this->gmnames[$userdata[0]] = $user_id;
+
+               printf('<li>'.__('user %s...').' <strong>'.__('Done').'</strong></li>', "<em>$user_login</em>");
+       }
+
+?></ul><strong><?php _e('Done') ?></strong></li>
+<li><?php _e('importing posts, comments, and karma...') ?><br /><ul><?php
+
+       chdir($archivespath);
+
+       for($i = 0; $i <= $lastentry; $i = $i + 1) {
+
+               $entryfile = "";
+
+               if ($i<10000000) {
+                       $entryfile .= "0";
+                       if ($i<1000000) {
+                               $entryfile .= "0";
+                               if ($i<100000) {
+                                       $entryfile .= "0";
+                                       if ($i<10000) {
+                                               $entryfile .= "0";
+                                               if ($i<1000) {
+                                                       $entryfile .= "0";
+                                                       if ($i<100) {
+                                                               $entryfile .= "0";
+                                                               if ($i<10) {
+                                                                       $entryfile .= "0";
+               }}}}}}}
+
+               $entryfile .= "$i";
+
+               if (is_file($entryfile.".cgi")) {
+
+                       $entry=file($entryfile.".cgi");
+                       $postinfo=explode("|",$entry[0]);
+                       $postmaincontent=$this->gm2autobr($entry[2]);
+                       $postmorecontent=$this->gm2autobr($entry[3]);
+
+                       $post_author=trim($wpdb->escape($postinfo[1]));
+
+                       $post_title=$this->gm2autobr($postinfo[2]);
+                       printf('<li>'.__('entry # %s : %s : by %s'), $entryfile, $post_title, $postinfo[1]);
+                       $post_title=$wpdb->escape($post_title);
+
+                       $postyear=$postinfo[6];
+                       $postmonth=zeroise($postinfo[4],2);
+                       $postday=zeroise($postinfo[5],2);
+                       $posthour=zeroise($postinfo[7],2);
+                       $postminute=zeroise($postinfo[8],2);
+                       $postsecond=zeroise($postinfo[9],2);
+
+                       if (($postinfo[10]=="PM") && ($posthour!="12"))
+                               $posthour=$posthour+12;
+
+                       $post_date="$postyear-$postmonth-$postday $posthour:$postminute:$postsecond";
+
+                       $post_content=$postmaincontent;
+                       if (strlen($postmorecontent)>3)
+                               $post_content .= "<!--more--><br /><br />".$postmorecontent;
+                       $post_content=$wpdb->escape($post_content);
+
+                       $post_karma=$postinfo[12];
+
+                       $post_status = 'publish'; //in greymatter, there are no drafts
+                       $comment_status = 'open';
+                       $ping_status = 'closed';
+
+                       if ($post_ID = post_exists($post_title, '', $post_date)) {
+                               echo ' ';
+                               _e('(already exists)');
+                       } else {
+                               //just so that if a post already exists, new users are not created by checkauthor
+                               // we'll check the author is registered, or if it's a deleted author
+                               $user_id = username_exists($post_author);
+                               if (!$user_id) {        // if deleted from GM, we register the author as a level 0 user
+                                       $user_ip="127.0.0.1";
+                                       $user_domain="localhost";
+                                       $user_browser="server";
+                                       $user_joindate="1979-06-06 00:41:00";
+                                       $user_login=$wpdb->escape($post_author);
+                                       $pass1=$wpdb->escape("password");
+                                       $user_nickname=$wpdb->escape($post_author);
+                                       $user_email=$wpdb->escape("user@deleted.com");
+                                       $user_url=$wpdb->escape("");
+                                       $user_joindate=$wpdb->escape($user_joindate);
+
+                                       $user_info = array("user_login"=>$user_login, "user_pass"=>$pass1, "user_nickname"=>$user_nickname, "user_email"=>$user_email, "user_url"=>$user_url, "user_ip"=>$user_ip, "user_domain"=>$user_domain, "user_browser"=>$user_browser, "dateYMDhour"=>$user_joindate, "user_level"=>0, "user_idmode"=>"nickname");
+                                       $user_id = wp_insert_user($user_info);
+                                       $this->gmnames[$postinfo[1]] = $user_id;
+
+                                       echo ': ';
+                                       printf(__('registered deleted user %s at level 0 '), "<em>$user_login</em>");
+                               }
+
+                               if (array_key_exists($postinfo[1], $this->gmnames)) {
+                                       $post_author = $this->gmnames[$postinfo[1]];
+                               } else {
+                                       $post_author = $user_id;
+                               }
+
+                               $postdata = compact('post_author', 'post_date', 'post_date_gmt', 'post_content', 'post_title', 'post_excerpt', 'post_status', 'comment_status', 'ping_status', 'post_modified', 'post_modified_gmt');
+                               $post_ID = wp_insert_post($postdata);
+                       }
+
+                       $c=count($entry);
+                       if ($c>4) {
+                               $numAddedComments = 0;
+                               $numComments = 0;
+                               for ($j=4;$j<$c;$j++) {
+                                       $entry[$j]=$this->gm2autobr($entry[$j]);
+                                       $commentinfo=explode("|",$entry[$j]);
+                                       $comment_post_ID=$post_ID;
+                                       $comment_author=$wpdb->escape($commentinfo[0]);
+                                       $comment_author_email=$wpdb->escape($commentinfo[2]);
+                                       $comment_author_url=$wpdb->escape($commentinfo[3]);
+                                       $comment_author_IP=$wpdb->escape($commentinfo[1]);
+
+                                       $commentyear=$commentinfo[7];
+                                       $commentmonth=zeroise($commentinfo[5],2);
+                                       $commentday=zeroise($commentinfo[6],2);
+                                       $commenthour=zeroise($commentinfo[8],2);
+                                       $commentminute=zeroise($commentinfo[9],2);
+                                       $commentsecond=zeroise($commentinfo[10],2);
+                                       if (($commentinfo[11]=="PM") && ($commenthour!="12"))
+                                               $commenthour=$commenthour+12;
+                                       $comment_date="$commentyear-$commentmonth-$commentday $commenthour:$commentminute:$commentsecond";
+
+                                       $comment_content=$wpdb->escape($commentinfo[12]);
+
+                                       if (!comment_exists($comment_author, $comment_date)) {
+                                               $commentdata = compact('comment_post_ID', 'comment_author', 'comment_author_url', 'comment_author_email', 'comment_author_IP', 'comment_date', 'comment_content', 'comment_approved');
+                                               $commentdata = wp_filter_comment($commentdata);
+                                               wp_insert_comment($commentdata);
+                                               $numAddedComments++;
+                                       }
+                                       $numComments++;
+                               }
+                               if ($numAddedComments > 0) {
+                                       echo ': ';
+                                       printf(__('imported %d comment(s)'), $numAddedComments);
+                               }
+                               $preExisting = $numComments - numAddedComments;
+                               if ($preExisting > 0) {
+                                       echo ' ';
+                                       printf(__('ignored %d pre-existing comments'), $preExisting);
+                               }
+                       }
+                       echo '... <strong>'.__('Done').'</strong></li>';
+               }
+       }
+       ?>
+</ul><strong><?php _e('Done') ?></strong></li></ul>
+<p>&nbsp;</p>
+<p><?php _e('Completed GreyMatter import!') ?></p>
+<?php
+       $this->footer();
+       }
+
+       function dispatch() {
+               if (empty ($_GET['step']))
+                       $step = 0;
+               else
+                       $step = (int) $_GET['step'];
+
+               switch ($step) {
+                       case 0 :
+                               $this->greet();
+                               break;
+                       case 1:
+                               check_admin_referer('import-greymatter');
+                               $this->import();
+                               break;
+               }
+       }
+
+       function GM_Import() {
+               // Nothing.
+       }
+}
+
+$gm_import = new GM_Import();
+
+register_importer('greymatter', __('GreyMatter'), __('Import users, posts, and comments from a Greymatter blog'), array ($gm_import, 'dispatch'));
+?>
index e8c48c4ad93b4e8b87948b4115dcc96a3f0c9e83..3c9cdab76ac61ac6a521dc26d59c9c6cb90136fe 100644 (file)
@@ -80,7 +80,7 @@ class LJ_Import {
                        $comments = $comments[1];
                        
                        if ( $comments ) {
                        $comments = $comments[1];
                        
                        if ( $comments ) {
-                               $comment_post_ID = $post_id;
+                               $comment_post_ID = (int) $post_id;
                                $num_comments = 0;
                                foreach ($comments as $comment) {
                                        preg_match('|<event>(.*?)</event>|is', $comment, $comment_content);
                                $num_comments = 0;
                                foreach ($comments as $comment) {
                                        preg_match('|<event>(.*?)</event>|is', $comment, $comment_content);
@@ -153,6 +153,7 @@ class LJ_Import {
                                $this->greet();
                                break;
                        case 1 :
                                $this->greet();
                                break;
                        case 1 :
+                               check_admin_referer('import-upload');
                                $this->import();
                                break;
                }
                                $this->import();
                                break;
                }
@@ -167,5 +168,5 @@ class LJ_Import {
 
 $livejournal_import = new LJ_Import();
 
 
 $livejournal_import = new LJ_Import();
 
-register_importer('livejournal', 'LiveJournal', __('Import posts from LiveJournal'), array ($livejournal_import, 'dispatch'));
+register_importer('livejournal', __('LiveJournal'), __('Import posts from LiveJournal'), array ($livejournal_import, 'dispatch'));
 ?>
 ?>
index e5b6626122989deb7846f5ea4842dc438d236d0b..f02b06976457396856e099db001a56e14643c840 100644 (file)
@@ -11,7 +11,7 @@ class MT_Import {
 
        function header() {
                echo '<div class="wrap">';
 
        function header() {
                echo '<div class="wrap">';
-               echo '<h2>'.__('Import Movable Type').'</h2>';
+               echo '<h2>'.__('Import Movable Type and Typepad').'</h2>';
        }
 
        function footer() {
        }
 
        function footer() {
@@ -32,7 +32,7 @@ class MT_Import {
                global $wpdb, $testing;
                $users = $wpdb->get_results("SELECT * FROM $wpdb->users ORDER BY ID");
 ?><select name="userselect[<?php echo $n; ?>]">
                global $wpdb, $testing;
                $users = $wpdb->get_results("SELECT * FROM $wpdb->users ORDER BY ID");
 ?><select name="userselect[<?php echo $n; ?>]">
-       <option value="#NONE#">- Select -</option>
+       <option value="#NONE#"><?php _e('- Select -') ?></option>
        <?php
 
 
        <?php
 
 
@@ -134,6 +134,8 @@ class MT_Import {
 
        function mt_authors_form() {
 ?>
 
        function mt_authors_form() {
 ?>
+<div class="wrap">
+<h2><?php _e('Assign Authors'); ?></h2>
 <p><?php _e('To make it easier for you to edit and save the imported posts and drafts, you may want to change the name of the author of the posts. For example, you may want to import all the entries as <code>admin</code>s entries.'); ?></p>
 <p><?php _e('Below, you can see the names of the authors of the MovableType posts in <i>italics</i>. For each of these names, you can either pick an author in your WordPress installation from the menu, or enter a name for the author in the textbox.'); ?></p>
 <p><?php _e('If a new user is created by WordPress, the password will be set, by default, to "changeme". Quite suggestive, eh? ;)'); ?></p>
 <p><?php _e('To make it easier for you to edit and save the imported posts and drafts, you may want to change the name of the author of the posts. For example, you may want to import all the entries as <code>admin</code>s entries.'); ?></p>
 <p><?php _e('Below, you can see the names of the authors of the MovableType posts in <i>italics</i>. For each of these names, you can either pick an author in your WordPress installation from the menu, or enter a name for the author in the textbox.'); ?></p>
 <p><?php _e('If a new user is created by WordPress, the password will be set, by default, to "changeme". Quite suggestive, eh? ;)'); ?></p>
@@ -143,29 +145,32 @@ class MT_Import {
                $authors = $this->get_mt_authors();
                echo '<ol id="authors">';
                echo '<form action="?import=mt&amp;step=2&amp;id=' . $this->id . '" method="post">';
                $authors = $this->get_mt_authors();
                echo '<ol id="authors">';
                echo '<form action="?import=mt&amp;step=2&amp;id=' . $this->id . '" method="post">';
+               wp_nonce_field('import-mt');
                $j = -1;
                foreach ($authors as $author) {
                        ++ $j;
                $j = -1;
                foreach ($authors as $author) {
                        ++ $j;
-                       echo '<li><i>'.$author.'</i><br />'.'<input type="text" value="'.$author.'" name="'.'user[]'.'" maxlength="30">';
+                       echo '<li>'.__('Current author:').' <strong>'.$author.'</strong><br />'.sprintf(__('Create user %1$s or map to existing'), ' <input type="text" value="'.$author.'" name="'.'user[]'.'" maxlength="30"> <br />');
                        $this->users_form($j);
                        echo '</li>';
                }
 
                        $this->users_form($j);
                        echo '</li>';
                }
 
-               echo '<input type="submit" value="Submit">'.'<br/>';
+               echo '<input type="submit" value="'.__('Submit').'">'.'<br/>';
                echo '</form>';
                echo '</form>';
-               echo '</ol>';
+               echo '</ol></div>';
 
 
-               flush();
        }
 
        function select_authors() {
                $file = wp_import_handle_upload();
                if ( isset($file['error']) ) {
        }
 
        function select_authors() {
                $file = wp_import_handle_upload();
                if ( isset($file['error']) ) {
-                       echo $file['error'];
+                       $this->header();
+                       echo '<p>'.__('Sorry, there has been an error').'.</p>';
+                       echo '<p><strong>' . $file['error'] . '</strong></p>';
+                       $this->footer();
                        return;
                }
                $this->file = $file['file'];
                        return;
                }
                $this->file = $file['file'];
-               $this->id = $file['id'];
+               $this->id = (int) $file['id'];
 
                $this->get_entries();
                $this->mt_authors_form();
 
                $this->get_entries();
                $this->mt_authors_form();
@@ -174,7 +179,7 @@ class MT_Import {
        function process_posts() {
                global $wpdb;
                $i = -1;
        function process_posts() {
                global $wpdb;
                $i = -1;
-               echo "<ol>";
+               echo "<div class='wrap'><ol>";
                foreach ($this->posts as $post) {
                        if ('' != trim($post)) {
                                ++ $i;
                foreach ($this->posts as $post) {
                        if ('' != trim($post)) {
                                ++ $i;
@@ -289,7 +294,7 @@ class MT_Import {
                                        }
                                }
 
                                        }
                                }
 
-                               $comment_post_ID = $post_id;
+                               $comment_post_ID = (int) $post_id;
                                $comment_approved = 1;
 
                                // Now for comments
                                $comment_approved = 1;
 
                                // Now for comments
@@ -330,7 +335,7 @@ class MT_Import {
                                        }
                                }
                                if ( $num_comments )
                                        }
                                }
                                if ( $num_comments )
-                                       printf(__('(%s comments)'), $num_comments);
+                                       printf(' '.__('(%s comments)'), $num_comments);
 
                                // Finally the pings
                                // fix the double newline on the first one
 
                                // Finally the pings
                                // fix the double newline on the first one
@@ -378,22 +383,22 @@ class MT_Import {
                                        }
                                }
                                if ( $num_pings )
                                        }
                                }
                                if ( $num_pings )
-                                       printf(__('(%s pings)'), $num_pings);
-                               
+                                       printf(' '.__('(%s pings)'), $num_pings);
+
                                echo "</li>";
                        }
                                echo "</li>";
                        }
-                       flush();
                }
 
                echo '</ol>';
 
                wp_import_cleanup($this->id);
 
                }
 
                echo '</ol>';
 
                wp_import_cleanup($this->id);
 
-               echo '<h3>'.sprintf(__('All done. <a href="%s">Have fun!</a>'), get_option('home')).'</h3>';
+               echo '<h3>'.sprintf(__('All done. <a href="%s">Have fun!</a>'), get_option('home')).'</h3></div>';
        }
 
        function import() {
                $this->id = (int) $_GET['id'];
        }
 
        function import() {
                $this->id = (int) $_GET['id'];
+               
                $this->file = get_attached_file($this->id);
                $this->get_authors_from_post();
                $this->get_entries();
                $this->file = get_attached_file($this->id);
                $this->get_authors_from_post();
                $this->get_entries();
@@ -411,20 +416,22 @@ class MT_Import {
                                $this->greet();
                                break;
                        case 1 :
                                $this->greet();
                                break;
                        case 1 :
+                               check_admin_referer('import-upload');
                                $this->select_authors();
                                break;
                        case 2:
                                $this->select_authors();
                                break;
                        case 2:
+                               check_admin_referer('import-mt');
                                $this->import();
                                break;
                }
        }
 
        function MT_Import() {
                                $this->import();
                                break;
                }
        }
 
        function MT_Import() {
-               // Nothing.     
+               // Nothing.
        }
 }
 
 $mt_import = new MT_Import();
 
        }
 }
 
 $mt_import = new MT_Import();
 
-register_importer('mt', 'Movable Type', __('Import posts and comments from your Movable Type blog'), array ($mt_import, 'dispatch'));
+register_importer('mt', __('Movable Type and Typepad'), __('Imports <strong>posts and comments</strong> from your Movable Type or Typepad blog'), array ($mt_import, 'dispatch'));
 ?>
 ?>
index e4a81673df676a6b6a54dc331efb9e32a597b19f..187c8ac2459135f04d88c30ad8638533c36a751c 100644 (file)
@@ -38,21 +38,22 @@ class RSS_Import {
                $index = 0;
                foreach ($this->posts as $post) {
                        preg_match('|<title>(.*?)</title>|is', $post, $post_title);
                $index = 0;
                foreach ($this->posts as $post) {
                        preg_match('|<title>(.*?)</title>|is', $post, $post_title);
-                       $post_title = $wpdb->escape(trim($post_title[1]));
+                       $post_title = str_replace(array('<![CDATA[', ']]>'), '', $wpdb->escape( trim($post_title[1]) ));
 
 
-                       preg_match('|<pubdate>(.*?)</pubdate>|is', $post, $post_date);
+                       preg_match('|<pubdate>(.*?)</pubdate>|is', $post, $post_date_gmt);
 
 
-                       if ($post_date) {
-                               $post_date = strtotime($post_date[1]);
+                       if ($post_date_gmt) {
+                               $post_date_gmt = strtotime($post_date_gmt[1]);
                        } else {
                                // if we don't already have something from pubDate
                        } else {
                                // if we don't already have something from pubDate
-                               preg_match('|<dc:date>(.*?)</dc:date>|is', $post, $post_date);
-                               $post_date = preg_replace('|([-+])([0-9]+):([0-9]+)$|', '\1\2\3', $post_date[1]);
-                               $post_date = str_replace('T', ' ', $post_date);
-                               $post_date = strtotime($post_date);
+                               preg_match('|<dc:date>(.*?)</dc:date>|is', $post, $post_date_gmt);
+                               $post_date_gmt = preg_replace('|([-+])([0-9]+):([0-9]+)$|', '\1\2\3', $post_date_gmt[1]);
+                               $post_date_gmt = str_replace('T', ' ', $post_date_gmt);
+                               $post_date_gmt = strtotime($post_date_gmt);
                        }
 
                        }
 
-                       $post_date = gmdate('Y-m-d H:i:s', $post_date);
+                       $post_date_gmt = gmdate('Y-m-d H:i:s', $post_date_gmt);
+                       $post_date = get_date_from_gmt( $post_date_gmt );
 
                        preg_match_all('|<category>(.*?)</category>|is', $post, $categories);
                        $categories = $categories[1];
 
                        preg_match_all('|<category>(.*?)</category>|is', $post, $categories);
                        $categories = $categories[1];
@@ -90,7 +91,7 @@ class RSS_Import {
 
                        $post_author = 1;
                        $post_status = 'publish';
 
                        $post_author = 1;
                        $post_status = 'publish';
-                       $this->posts[$index] = compact('post_author', 'post_date', 'post_content', 'post_title', 'post_status', 'guid', 'categories');
+                       $this->posts[$index] = compact('post_author', 'post_date', 'post_date_gmt', 'post_content', 'post_title', 'post_status', 'guid', 'categories');
                        $index++;
                }
        }
                        $index++;
                }
        }
@@ -153,6 +154,7 @@ class RSS_Import {
                                $this->greet();
                                break;
                        case 1 :
                                $this->greet();
                                break;
                        case 1 :
+                               check_admin_referer('import-upload');
                                $this->import();
                                break;
                }
                                $this->import();
                                break;
                }
@@ -167,5 +169,5 @@ class RSS_Import {
 
 $rss_import = new RSS_Import();
 
 
 $rss_import = new RSS_Import();
 
-register_importer('rss', 'RSS', __('Import posts from an RSS feed'), array ($rss_import, 'dispatch'));
+register_importer('rss', __('RSS'), __('Import posts from an RSS feed'), array ($rss_import, 'dispatch'));
 ?>
 ?>
index 44b0fc36755f16a41a411adcf9bc56f6966fa272..2d2b145e9e5577b7b07252afd2f9090ecf1951cf 100644 (file)
@@ -4,13 +4,13 @@
 **/
 if(!function_exists('get_catbynicename'))
 {
 **/
 if(!function_exists('get_catbynicename'))
 {
-       function get_catbynicename($category_nicename) 
+       function get_catbynicename($category_nicename)
        {
        global $wpdb;
        {
        global $wpdb;
-       
+
        $cat_id -= 0;   // force numeric
        $name = $wpdb->get_var('SELECT cat_ID FROM '.$wpdb->categories.' WHERE category_nicename="'.$category_nicename.'"');
        $cat_id -= 0;   // force numeric
        $name = $wpdb->get_var('SELECT cat_ID FROM '.$wpdb->categories.' WHERE category_nicename="'.$category_nicename.'"');
-       
+
        return $name;
        }
 }
        return $name;
        }
 }
@@ -49,15 +49,18 @@ class Textpattern_Import {
        {
                echo '</div>';
        }
        {
                echo '</div>';
        }
-       
-       function greet() 
-       {
-               echo '<p>'.__('Howdy! This importer allows you to extract posts from any Textpattern 4.0.2+ into your blog. This has not been tested on previous versions of Textpattern.  Mileage may vary.').'</p>';
+
+       function greet() {
+               echo '<div class="narrow">';
+               echo '<p>'.__('Howdy! This imports categories, users, posts, comments, and links from any Textpattern 4.0.2+ into this blog.').'</p>';
+               echo '<p>'.__('This has not been tested on previous versions of Textpattern.  Mileage may vary.').'</p>';
                echo '<p>'.__('Your Textpattern Configuration settings are as follows:').'</p>';
                echo '<form action="admin.php?import=textpattern&amp;step=1" method="post">';
                echo '<p>'.__('Your Textpattern Configuration settings are as follows:').'</p>';
                echo '<form action="admin.php?import=textpattern&amp;step=1" method="post">';
+               wp_nonce_field('import-textpattern');
                $this->db_form();
                $this->db_form();
-               echo '<input type="submit" name="submit" value="'.__('Import Categories').'" />';
+               echo '<p class="submit"><input type="submit" name="submit" value="'.attribute_escape(__('Import Categories &raquo;')).'" /></p>';
                echo '</form>';
                echo '</form>';
+               echo '</div>';
        }
 
        function get_txp_cats()
        }
 
        function get_txp_cats()
@@ -67,17 +70,17 @@ class Textpattern_Import {
                $txpdb = new wpdb(get_option('txpuser'), get_option('txppass'), get_option('txpname'), get_option('txphost'));
                set_magic_quotes_runtime(0);
                $prefix = get_option('tpre');
                $txpdb = new wpdb(get_option('txpuser'), get_option('txppass'), get_option('txpname'), get_option('txphost'));
                set_magic_quotes_runtime(0);
                $prefix = get_option('tpre');
-               
+
                // Get Categories
                // Get Categories
-               return $txpdb->get_results('SELECT 
-                                                                               id,
-                                                                               name,
-                                                                               title
-                                                                        FROM '.$prefix.'txp_category 
-                                                                        WHERE type = "article"', 
-                                                                        ARRAY_A);
+               return $txpdb->get_results('SELECT
+                       id,
+                       name,
+                       title
+                       FROM '.$prefix.'txp_category
+                       WHERE type = "article"',
+                       ARRAY_A);
        }
        }
-       
+
        function get_txp_users()
        {
                global $wpdb;
        function get_txp_users()
        {
                global $wpdb;
@@ -85,44 +88,44 @@ class Textpattern_Import {
                $txpdb = new wpdb(get_option('txpuser'), get_option('txppass'), get_option('txpname'), get_option('txphost'));
                set_magic_quotes_runtime(0);
                $prefix = get_option('tpre');
                $txpdb = new wpdb(get_option('txpuser'), get_option('txppass'), get_option('txpname'), get_option('txphost'));
                set_magic_quotes_runtime(0);
                $prefix = get_option('tpre');
-               
+
                // Get Users
                // Get Users
-               
+
                return $txpdb->get_results('SELECT
                return $txpdb->get_results('SELECT
-                                                                               user_id,
-                                                                               name,
-                                                                               RealName,
-                                                                               email,
-                                                                               privs
-                                                                       FROM '.$prefix.'txp_users', ARRAY_A);
+                       user_id,
+                       name,
+                       RealName,
+                       email,
+                       privs
+                       FROM '.$prefix.'txp_users', ARRAY_A);
        }
        }
-       
+
        function get_txp_posts()
        {
                // General Housekeeping
                $txpdb = new wpdb(get_option('txpuser'), get_option('txppass'), get_option('txpname'), get_option('txphost'));
                set_magic_quotes_runtime(0);
                $prefix = get_option('tpre');
        function get_txp_posts()
        {
                // General Housekeeping
                $txpdb = new wpdb(get_option('txpuser'), get_option('txppass'), get_option('txpname'), get_option('txphost'));
                set_magic_quotes_runtime(0);
                $prefix = get_option('tpre');
-               
+
                // Get Posts
                // Get Posts
-               return $txpdb->get_results('SELECT 
-                                                                               ID,
-                                                                               Posted,
-                                                                               AuthorID,
-                                                                               LastMod,
-                                                                               Title,
-                                                                               Body,
-                                                                               Excerpt,
-                                                                               Category1,
-                                                                               Category2,
-                                                                               Status,
-                                                                               Keywords,
-                                                                               url_title,
-                                                                               comments_count
-                                                                       FROM '.$prefix.'textpattern
-                                                                       ', ARRAY_A);
+               return $txpdb->get_results('SELECT
+                       ID,
+                       Posted,
+                       AuthorID,
+                       LastMod,
+                       Title,
+                       Body,
+                       Excerpt,
+                       Category1,
+                       Category2,
+                       Status,
+                       Keywords,
+                       url_title,
+                       comments_count
+                       FROM '.$prefix.'textpattern
+                       ', ARRAY_A);
        }
        }
-       
+
        function get_txp_comments()
        {
                global $wpdb;
        function get_txp_comments()
        {
                global $wpdb;
@@ -130,30 +133,30 @@ class Textpattern_Import {
                $txpdb = new wpdb(get_option('txpuser'), get_option('txppass'), get_option('txpname'), get_option('txphost'));
                set_magic_quotes_runtime(0);
                $prefix = get_option('tpre');
                $txpdb = new wpdb(get_option('txpuser'), get_option('txppass'), get_option('txpname'), get_option('txphost'));
                set_magic_quotes_runtime(0);
                $prefix = get_option('tpre');
-               
+
                // Get Comments
                return $txpdb->get_results('SELECT * FROM '.$prefix.'txp_discuss', ARRAY_A);
        }
                // Get Comments
                return $txpdb->get_results('SELECT * FROM '.$prefix.'txp_discuss', ARRAY_A);
        }
-       
+
                function get_txp_links()
        {
                //General Housekeeping
                $txpdb = new wpdb(get_option('txpuser'), get_option('txppass'), get_option('txpname'), get_option('txphost'));
                set_magic_quotes_runtime(0);
                $prefix = get_option('tpre');
                function get_txp_links()
        {
                //General Housekeeping
                $txpdb = new wpdb(get_option('txpuser'), get_option('txppass'), get_option('txpname'), get_option('txphost'));
                set_magic_quotes_runtime(0);
                $prefix = get_option('tpre');
-               
-               return $txpdb->get_results('SELECT 
-                                                                               id,
-                                                                               date,
-                                                                               category,
-                                                                               url,
-                                                                               linkname,
-                                                                               description
-                                                                         FROM '.$prefix.'txp_link', 
-                                                                         ARRAY_A);                                               
+
+               return $txpdb->get_results('SELECT
+                       id,
+                       date,
+                       category,
+                       url,
+                       linkname,
+                       description
+                       FROM '.$prefix.'txp_link',
+                       ARRAY_A);
        }
        }
-       
-       function cat2wp($categories='') 
+
+       function cat2wp($categories='')
        {
                // General Housekeeping
                global $wpdb;
        {
                // General Housekeeping
                global $wpdb;
@@ -163,16 +166,16 @@ class Textpattern_Import {
                if(is_array($categories))
                {
                        echo '<p>'.__('Importing Categories...').'<br /><br /></p>';
                if(is_array($categories))
                {
                        echo '<p>'.__('Importing Categories...').'<br /><br /></p>';
-                       foreach ($categories as $category) 
+                       foreach ($categories as $category)
                        {
                                $count++;
                                extract($category);
                        {
                                $count++;
                                extract($category);
-                               
-                               
+
+
                                // Make Nice Variables
                                $name = $wpdb->escape($name);
                                $title = $wpdb->escape($title);
                                // Make Nice Variables
                                $name = $wpdb->escape($name);
                                $title = $wpdb->escape($title);
-                               
+
                                if($cinfo = category_exists($name))
                                {
                                        $ret_id = wp_insert_category(array('cat_ID' => $cinfo, 'category_nicename' => $name, 'cat_name' => $title));
                                if($cinfo = category_exists($name))
                                {
                                        $ret_id = wp_insert_category(array('cat_ID' => $cinfo, 'category_nicename' => $name, 'cat_name' => $title));
@@ -183,7 +186,7 @@ class Textpattern_Import {
                                }
                                $txpcat2wpcat[$id] = $ret_id;
                        }
                                }
                                $txpcat2wpcat[$id] = $ret_id;
                        }
-                       
+
                        // Store category translation for future use
                        add_option('txpcat2wpcat',$txpcat2wpcat);
                        echo '<p>'.sprintf(__('Done! <strong>%1$s</strong> categories imported.'), $count).'<br /><br /></p>';
                        // Store category translation for future use
                        add_option('txpcat2wpcat',$txpcat2wpcat);
                        echo '<p>'.sprintf(__('Done! <strong>%1$s</strong> categories imported.'), $count).'<br /><br /></p>';
@@ -192,14 +195,14 @@ class Textpattern_Import {
                echo __('No Categories to Import!');
                return false;
        }
                echo __('No Categories to Import!');
                return false;
        }
-       
+
        function users2wp($users='')
        {
                // General Housekeeping
                global $wpdb;
                $count = 0;
                $txpid2wpid = array();
        function users2wp($users='')
        {
                // General Housekeeping
                global $wpdb;
                $count = 0;
                $txpid2wpid = array();
-               
+
                // Midnight Mojo
                if(is_array($users))
                {
                // Midnight Mojo
                if(is_array($users))
                {
@@ -208,14 +211,14 @@ class Textpattern_Import {
                        {
                                $count++;
                                extract($user);
                        {
                                $count++;
                                extract($user);
-                               
+
                                // Make Nice Variables
                                $name = $wpdb->escape($name);
                                $RealName = $wpdb->escape($RealName);
                                // Make Nice Variables
                                $name = $wpdb->escape($name);
                                $RealName = $wpdb->escape($RealName);
-                               
+
                                if($uinfo = get_userdatabylogin($name))
                                {
                                if($uinfo = get_userdatabylogin($name))
                                {
-                                       
+
                                        $ret_id = wp_insert_user(array(
                                                                'ID'                    => $uinfo->ID,
                                                                'user_login'    => $name,
                                        $ret_id = wp_insert_user(array(
                                                                'ID'                    => $uinfo->ID,
                                                                'user_login'    => $name,
@@ -225,7 +228,7 @@ class Textpattern_Import {
                                                                'display_name'  => $name)
                                                                );
                                }
                                                                'display_name'  => $name)
                                                                );
                                }
-                               else 
+                               else
                                {
                                        $ret_id = wp_insert_user(array(
                                                                'user_login'    => $name,
                                {
                                        $ret_id = wp_insert_user(array(
                                                                'user_login'    => $name,
@@ -236,10 +239,10 @@ class Textpattern_Import {
                                                                );
                                }
                                $txpid2wpid[$user_id] = $ret_id;
                                                                );
                                }
                                $txpid2wpid[$user_id] = $ret_id;
-                               
+
                                // Set Textpattern-to-WordPress permissions translation
                                $transperms = array(1 => '10', 2 => '9', 3 => '5', 4 => '4', 5 => '3', 6 => '2', 7 => '0');
                                // Set Textpattern-to-WordPress permissions translation
                                $transperms = array(1 => '10', 2 => '9', 3 => '5', 4 => '4', 5 => '3', 6 => '2', 7 => '0');
-                               
+
                                // Update Usermeta Data
                                $user = new WP_User($ret_id);
                                if('10' == $transperms[$privs]) { $user->set_role('administrator'); }
                                // Update Usermeta Data
                                $user = new WP_User($ret_id);
                                if('10' == $transperms[$privs]) { $user->set_role('administrator'); }
@@ -249,24 +252,24 @@ class Textpattern_Import {
                                if('3'  == $transperms[$privs]) { $user->set_role('contributor'); }
                                if('2'  == $transperms[$privs]) { $user->set_role('contributor'); }
                                if('0'  == $transperms[$privs]) { $user->set_role('subscriber'); }
                                if('3'  == $transperms[$privs]) { $user->set_role('contributor'); }
                                if('2'  == $transperms[$privs]) { $user->set_role('contributor'); }
                                if('0'  == $transperms[$privs]) { $user->set_role('subscriber'); }
-                               
+
                                update_usermeta( $ret_id, 'wp_user_level', $transperms[$privs] );
                                update_usermeta( $ret_id, 'rich_editing', 'false');
                        }// End foreach($users as $user)
                                update_usermeta( $ret_id, 'wp_user_level', $transperms[$privs] );
                                update_usermeta( $ret_id, 'rich_editing', 'false');
                        }// End foreach($users as $user)
-                       
+
                        // Store id translation array for future use
                        add_option('txpid2wpid',$txpid2wpid);
                        // Store id translation array for future use
                        add_option('txpid2wpid',$txpid2wpid);
-                       
-                       
+
+
                        echo '<p>'.sprintf(__('Done! <strong>%1$s</strong> users imported.'), $count).'<br /><br /></p>';
                        return true;
                }// End if(is_array($users)
                        echo '<p>'.sprintf(__('Done! <strong>%1$s</strong> users imported.'), $count).'<br /><br /></p>';
                        return true;
                }// End if(is_array($users)
-               
+
                echo __('No Users to Import!');
                return false;
                echo __('No Users to Import!');
                return false;
-               
+
        }// End function user2wp()
        }// End function user2wp()
-       
+
        function posts2wp($posts='')
        {
                // General Housekeeping
        function posts2wp($posts='')
        {
                // General Housekeeping
@@ -283,10 +286,10 @@ class Textpattern_Import {
                        {
                                $count++;
                                extract($post);
                        {
                                $count++;
                                extract($post);
-                               
+
                                // Set Textpattern-to-WordPress status translation
                                $stattrans = array(1 => 'draft', 2 => 'private', 3 => 'draft', 4 => 'publish', 5 => 'publish');
                                // Set Textpattern-to-WordPress status translation
                                $stattrans = array(1 => 'draft', 2 => 'private', 3 => 'draft', 4 => 'publish', 5 => 'publish');
-                               
+
                                //Can we do this more efficiently?
                                $uinfo = ( get_userdatabylogin( $AuthorID ) ) ? get_userdatabylogin( $AuthorID ) : 1;
                                $authorid = ( is_object( $uinfo ) ) ? $uinfo->ID : $uinfo ;
                                //Can we do this more efficiently?
                                $uinfo = ( get_userdatabylogin( $AuthorID ) ) ? get_userdatabylogin( $AuthorID ) : 1;
                                $authorid = ( is_object( $uinfo ) ) ? $uinfo->ID : $uinfo ;
@@ -295,59 +298,59 @@ class Textpattern_Import {
                                $Body = $wpdb->escape($Body);
                                $Excerpt = $wpdb->escape($Excerpt);
                                $post_status = $stattrans[$Status];
                                $Body = $wpdb->escape($Body);
                                $Excerpt = $wpdb->escape($Excerpt);
                                $post_status = $stattrans[$Status];
-                               
+
                                // Import Post data into WordPress
                                // Import Post data into WordPress
-                               
+
                                if($pinfo = post_exists($Title,$Body))
                                {
                                        $ret_id = wp_insert_post(array(
                                if($pinfo = post_exists($Title,$Body))
                                {
                                        $ret_id = wp_insert_post(array(
-                                                       'ID'                            => $pinfo,
-                                                       'post_date'                     => $Posted,
-                                                       'post_date_gmt'         => $post_date_gmt,
-                                                       'post_author'           => $authorid,
-                                                       'post_modified'         => $LastMod,
-                                                       'post_modified_gmt' => $post_modified_gmt,
-                                                       'post_title'            => $Title,
-                                                       'post_content'          => $Body,
-                                                       'post_excerpt'          => $Excerpt,
-                                                       'post_status'           => $post_status,
-                                                       'post_name'                     => $url_title,
-                                                       'comment_count'         => $comments_count)
-                                                       );
+                                               'ID'                            => $pinfo,
+                                               'post_date'                     => $Posted,
+                                               'post_date_gmt'         => $post_date_gmt,
+                                               'post_author'           => $authorid,
+                                               'post_modified'         => $LastMod,
+                                               'post_modified_gmt' => $post_modified_gmt,
+                                               'post_title'            => $Title,
+                                               'post_content'          => $Body,
+                                               'post_excerpt'          => $Excerpt,
+                                               'post_status'           => $post_status,
+                                               'post_name'                     => $url_title,
+                                               'comment_count'         => $comments_count)
+                                               );
                                }
                                }
-                               else 
+                               else
                                {
                                        $ret_id = wp_insert_post(array(
                                {
                                        $ret_id = wp_insert_post(array(
-                                                       'post_date'                     => $Posted,
-                                                       'post_date_gmt'         => $post_date_gmt,
-                                                       'post_author'           => $authorid,
-                                                       'post_modified'         => $LastMod,
-                                                       'post_modified_gmt' => $post_modified_gmt,
-                                                       'post_title'            => $Title,
-                                                       'post_content'          => $Body,
-                                                       'post_excerpt'          => $Excerpt,
-                                                       'post_status'           => $post_status,
-                                                       'post_name'                     => $url_title,
-                                                       'comment_count'         => $comments_count)
-                                                       );
+                                               'post_date'                     => $Posted,
+                                               'post_date_gmt'         => $post_date_gmt,
+                                               'post_author'           => $authorid,
+                                               'post_modified'         => $LastMod,
+                                               'post_modified_gmt' => $post_modified_gmt,
+                                               'post_title'            => $Title,
+                                               'post_content'          => $Body,
+                                               'post_excerpt'          => $Excerpt,
+                                               'post_status'           => $post_status,
+                                               'post_name'                     => $url_title,
+                                               'comment_count'         => $comments_count)
+                                               );
                                }
                                $txpposts2wpposts[$ID] = $ret_id;
                                }
                                $txpposts2wpposts[$ID] = $ret_id;
-                               
+
                                // Make Post-to-Category associations
                                $cats = array();
                                if($cat1 = get_catbynicename($Category1)) { $cats[1] = $cat1; }
                                if($cat2 = get_catbynicename($Category2)) { $cats[2] = $cat2; }
 
                                // Make Post-to-Category associations
                                $cats = array();
                                if($cat1 = get_catbynicename($Category1)) { $cats[1] = $cat1; }
                                if($cat2 = get_catbynicename($Category2)) { $cats[2] = $cat2; }
 
-                               if(!empty($cats)) { wp_set_post_cats('', $ret_id, $cats); }
+                               if(!empty($cats)) { wp_set_post_categories($ret_id, $cats); }
                        }
                }
                // Store ID translation for later use
                add_option('txpposts2wpposts',$txpposts2wpposts);
                        }
                }
                // Store ID translation for later use
                add_option('txpposts2wpposts',$txpposts2wpposts);
-               
+
                echo '<p>'.sprintf(__('Done! <strong>%1$s</strong> posts imported.'), $count).'<br /><br /></p>';
                echo '<p>'.sprintf(__('Done! <strong>%1$s</strong> posts imported.'), $count).'<br /><br /></p>';
-               return true;    
+               return true;
        }
        }
-       
+
        function comments2wp($comments='')
        {
                // General Housekeeping
        function comments2wp($comments='')
        {
                // General Housekeeping
@@ -355,7 +358,7 @@ class Textpattern_Import {
                $count = 0;
                $txpcm2wpcm = array();
                $postarr = get_option('txpposts2wpposts');
                $count = 0;
                $txpcm2wpcm = array();
                $postarr = get_option('txpposts2wpposts');
-               
+
                // Magic Mojo
                if(is_array($comments))
                {
                // Magic Mojo
                if(is_array($comments))
                {
@@ -364,7 +367,7 @@ class Textpattern_Import {
                        {
                                $count++;
                                extract($comment);
                        {
                                $count++;
                                extract($comment);
-                               
+
                                // WordPressify Data
                                $comment_ID = ltrim($discussid, '0');
                                $comment_post_ID = $postarr[$parentid];
                                // WordPressify Data
                                $comment_ID = ltrim($discussid, '0');
                                $comment_post_ID = $postarr[$parentid];
@@ -373,57 +376,57 @@ class Textpattern_Import {
                                $email = $wpdb->escape($email);
                                $web = $wpdb->escape($web);
                                $message = $wpdb->escape($message);
                                $email = $wpdb->escape($email);
                                $web = $wpdb->escape($web);
                                $message = $wpdb->escape($message);
-                               
+
                                if($cinfo = comment_exists($name, $posted))
                                {
                                        // Update comments
                                        $ret_id = wp_update_comment(array(
                                if($cinfo = comment_exists($name, $posted))
                                {
                                        // Update comments
                                        $ret_id = wp_update_comment(array(
-                                                       'comment_ID'                    => $cinfo,
-                                                       'comment_post_ID'               => $comment_post_ID,
-                                                       'comment_author'                => $name,
-                                                       'comment_author_email'  => $email,
-                                                       'comment_author_url'    => $web,
-                                                       'comment_date'                  => $posted,
-                                                       'comment_content'               => $message,
-                                                       'comment_approved'              => $comment_approved)
-                                                       );
+                                               'comment_ID'                    => $cinfo,
+                                               'comment_post_ID'               => $comment_post_ID,
+                                               'comment_author'                => $name,
+                                               'comment_author_email'  => $email,
+                                               'comment_author_url'    => $web,
+                                               'comment_date'                  => $posted,
+                                               'comment_content'               => $message,
+                                               'comment_approved'              => $comment_approved)
+                                               );
                                }
                                }
-                               else 
+                               else
                                {
                                        // Insert comments
                                        $ret_id = wp_insert_comment(array(
                                {
                                        // Insert comments
                                        $ret_id = wp_insert_comment(array(
-                                                       'comment_post_ID'               => $comment_post_ID,
-                                                       'comment_author'                => $name,
-                                                       'comment_author_email'  => $email,
-                                                       'comment_author_url'    => $web,
-                                                       'comment_author_IP'             => $ip,
-                                                       'comment_date'                  => $posted,
-                                                       'comment_content'               => $message,
-                                                       'comment_approved'              => $comment_approved)
-                                                       );
+                                               'comment_post_ID'               => $comment_post_ID,
+                                               'comment_author'                => $name,
+                                               'comment_author_email'  => $email,
+                                               'comment_author_url'    => $web,
+                                               'comment_author_IP'             => $ip,
+                                               'comment_date'                  => $posted,
+                                               'comment_content'               => $message,
+                                               'comment_approved'              => $comment_approved)
+                                               );
                                }
                                $txpcm2wpcm[$comment_ID] = $ret_id;
                        }
                        // Store Comment ID translation for future use
                                }
                                $txpcm2wpcm[$comment_ID] = $ret_id;
                        }
                        // Store Comment ID translation for future use
-                       add_option('txpcm2wpcm', $txpcm2wpcm);                  
-                       
+                       add_option('txpcm2wpcm', $txpcm2wpcm);
+
                        // Associate newly formed categories with posts
                        get_comment_count($ret_id);
                        // Associate newly formed categories with posts
                        get_comment_count($ret_id);
-                       
-                       
+
+
                        echo '<p>'.sprintf(__('Done! <strong>%1$s</strong> comments imported.'), $count).'<br /><br /></p>';
                        return true;
                }
                echo __('No Comments to Import!');
                return false;
        }
                        echo '<p>'.sprintf(__('Done! <strong>%1$s</strong> comments imported.'), $count).'<br /><br /></p>';
                        return true;
                }
                echo __('No Comments to Import!');
                return false;
        }
-       
+
        function links2wp($links='')
        {
                // General Housekeeping
                global $wpdb;
                $count = 0;
        function links2wp($links='')
        {
                // General Housekeeping
                global $wpdb;
                $count = 0;
-               
+
                // Deal with the links
                if(is_array($links))
                {
                // Deal with the links
                if(is_array($links))
                {
@@ -432,12 +435,12 @@ class Textpattern_Import {
                        {
                                $count++;
                                extract($link);
                        {
                                $count++;
                                extract($link);
-                               
+
                                // Make nice vars
                                $category = $wpdb->escape($category);
                                $linkname = $wpdb->escape($linkname);
                                $description = $wpdb->escape($description);
                                // Make nice vars
                                $category = $wpdb->escape($category);
                                $linkname = $wpdb->escape($linkname);
                                $description = $wpdb->escape($description);
-                               
+
                                if($linfo = link_exists($linkname))
                                {
                                        $ret_id = wp_insert_link(array(
                                if($linfo = link_exists($linkname))
                                {
                                        $ret_id = wp_insert_link(array(
@@ -449,7 +452,7 @@ class Textpattern_Import {
                                                                'link_updated'          => $date)
                                                                );
                                }
                                                                'link_updated'          => $date)
                                                                );
                                }
-                               else 
+                               else
                                {
                                        $ret_id = wp_insert_link(array(
                                                                'link_url'                      => $url,
                                {
                                        $ret_id = wp_insert_link(array(
                                                                'link_url'                      => $url,
@@ -470,67 +473,72 @@ class Textpattern_Import {
                echo __('No Links to Import!');
                return false;
        }
                echo __('No Links to Import!');
                return false;
        }
-               
-       function import_categories() 
-       {       
-               // Category Import      
+
+       function import_categories()
+       {
+               // Category Import
                $cats = $this->get_txp_cats();
                $this->cat2wp($cats);
                add_option('txp_cats', $cats);
                $cats = $this->get_txp_cats();
                $this->cat2wp($cats);
                add_option('txp_cats', $cats);
-               
-               
-                       
+
+
+
                echo '<form action="admin.php?import=textpattern&amp;step=2" method="post">';
                echo '<form action="admin.php?import=textpattern&amp;step=2" method="post">';
-               printf('<input type="submit" name="submit" value="%s" />', __('Import Users'));
+               wp_nonce_field('import-textpattern');
+               printf('<input type="submit" name="submit" value="%s" />', attribute_escape(__('Import Users')));
                echo '</form>';
 
        }
                echo '</form>';
 
        }
-       
+
        function import_users()
        {
                // User Import
        function import_users()
        {
                // User Import
-               $users = $this->get_txp_users(); 
+               $users = $this->get_txp_users();
                $this->users2wp($users);
                $this->users2wp($users);
-               
+
                echo '<form action="admin.php?import=textpattern&amp;step=3" method="post">';
                echo '<form action="admin.php?import=textpattern&amp;step=3" method="post">';
-               printf('<input type="submit" name="submit" value="%s" />', __('Import Posts'));
+               wp_nonce_field('import-textpattern');
+               printf('<input type="submit" name="submit" value="%s" />', attribute_escape(__('Import Posts')));
                echo '</form>';
        }
                echo '</form>';
        }
-       
+
        function import_posts()
        {
                // Post Import
                $posts = $this->get_txp_posts();
                $this->posts2wp($posts);
        function import_posts()
        {
                // Post Import
                $posts = $this->get_txp_posts();
                $this->posts2wp($posts);
-               
+
                echo '<form action="admin.php?import=textpattern&amp;step=4" method="post">';
                echo '<form action="admin.php?import=textpattern&amp;step=4" method="post">';
-               printf('<input type="submit" name="submit" value="%s" />', __('Import Comments'));
+               wp_nonce_field('import-textpattern');
+               printf('<input type="submit" name="submit" value="%s" />', attribute_escape(__('Import Comments')));
                echo '</form>';
        }
                echo '</form>';
        }
-       
+
        function import_comments()
        {
                // Comment Import
                $comments = $this->get_txp_comments();
                $this->comments2wp($comments);
        function import_comments()
        {
                // Comment Import
                $comments = $this->get_txp_comments();
                $this->comments2wp($comments);
-               
+
                echo '<form action="admin.php?import=textpattern&amp;step=5" method="post">';
                echo '<form action="admin.php?import=textpattern&amp;step=5" method="post">';
-               printf('<input type="submit" name="submit" value="%s" />', __('Import Links'));
+               wp_nonce_field('import-textpattern');
+               printf('<input type="submit" name="submit" value="%s" />', attribute_escape(__('Import Links')));
                echo '</form>';
        }
                echo '</form>';
        }
-       
+
        function import_links()
        {
                //Link Import
                $links = $this->get_txp_links();
                $this->links2wp($links);
                add_option('txp_links', $links);
        function import_links()
        {
                //Link Import
                $links = $this->get_txp_links();
                $this->links2wp($links);
                add_option('txp_links', $links);
-               
+
                echo '<form action="admin.php?import=textpattern&amp;step=6" method="post">';
                echo '<form action="admin.php?import=textpattern&amp;step=6" method="post">';
-               printf('<input type="submit" name="submit" value="%s" />', __('Finish'));
+               wp_nonce_field('import-textpattern');
+               printf('<input type="submit" name="submit" value="%s" />', attribute_escape(__('Finish')));
                echo '</form>';
        }
                echo '</form>';
        }
-       
+
        function cleanup_txpimport()
        {
                delete_option('tpre');
        function cleanup_txpimport()
        {
                delete_option('tpre');
@@ -546,7 +554,7 @@ class Textpattern_Import {
                delete_option('txphost');
                $this->tips();
        }
                delete_option('txphost');
                $this->tips();
        }
-       
+
        function tips()
        {
                echo '<p>'.__('Welcome to WordPress.  We hope (and expect!) that you will find this platform incredibly rewarding!  As a new WordPress user coming from Textpattern, there are some things that we would like to point out.  Hopefully, they will help your transition go as smoothly as possible.').'</p>';
        function tips()
        {
                echo '<p>'.__('Welcome to WordPress.  We hope (and expect!) that you will find this platform incredibly rewarding!  As a new WordPress user coming from Textpattern, there are some things that we would like to point out.  Hopefully, they will help your transition go as smoothly as possible.').'</p>';
@@ -555,29 +563,29 @@ class Textpattern_Import {
                echo '<h3>'.__('Preserving Authors').'</h3>';
                echo '<p>'.__('Secondly, we have attempted to preserve post authors.  If you are the only author or contributor to your blog, then you are safe.  In most cases, we are successful in this preservation endeavor.  However, if we cannot ascertain the name of the writer due to discrepancies between database tables, we assign it to you, the administrative user.').'</p>';
                echo '<h3>'.__('Textile').'</h3>';
                echo '<h3>'.__('Preserving Authors').'</h3>';
                echo '<p>'.__('Secondly, we have attempted to preserve post authors.  If you are the only author or contributor to your blog, then you are safe.  In most cases, we are successful in this preservation endeavor.  However, if we cannot ascertain the name of the writer due to discrepancies between database tables, we assign it to you, the administrative user.').'</p>';
                echo '<h3>'.__('Textile').'</h3>';
-               echo '<p>'.__('Also, since you\'re coming from Textpattern, you probably have been using Textile to format your comments and posts.  If this is the case, we recommend downloading and installing <a href="http://www.huddledmasses.org/2004/04/19/wordpress-plugin-textile-20/">Textile for WordPress</a>.  Trust me... You\'ll want it.').'</p>';
+               echo '<p>'.__('Also, since you\'re coming from Textpattern, you probably have been using Textile to format your comments and posts.  If this is the case, we recommend downloading and installing <a href="http://www.huddledmasses.org/category/development/wordpress/textile/">Textile for WordPress</a>.  Trust me... You\'ll want it.').'</p>';
                echo '<h3>'.__('WordPress Resources').'</h3>';
                echo '<p>'.__('Finally, there are numerous WordPress resources around the internet.  Some of them are:').'</p>';
                echo '<ul>';
                echo '<li>'.__('<a href="http://www.wordpress.org">The official WordPress site</a>').'</li>';
                echo '<h3>'.__('WordPress Resources').'</h3>';
                echo '<p>'.__('Finally, there are numerous WordPress resources around the internet.  Some of them are:').'</p>';
                echo '<ul>';
                echo '<li>'.__('<a href="http://www.wordpress.org">The official WordPress site</a>').'</li>';
-               echo '<li>'.__('<a href="http://wordpress.org/support/">The WordPress support forums').'</li>';
+               echo '<li>'.__('<a href="http://wordpress.org/support/">The WordPress support forums</a>').'</li>';
                echo '<li>'.__('<a href="http://codex.wordpress.org">The Codex (In other words, the WordPress Bible)</a>').'</li>';
                echo '</ul>';
                echo '<p>'.sprintf(__('That\'s it! What are you waiting for? Go <a href="%1$s">login</a>!'), '/wp-login.php').'</p>';
        }
                echo '<li>'.__('<a href="http://codex.wordpress.org">The Codex (In other words, the WordPress Bible)</a>').'</li>';
                echo '</ul>';
                echo '<p>'.sprintf(__('That\'s it! What are you waiting for? Go <a href="%1$s">login</a>!'), '/wp-login.php').'</p>';
        }
-       
+
        function db_form()
        {
        function db_form()
        {
-               echo '<ul>';
-               printf('<li><label for="dbuser">%s</label> <input type="text" name="dbuser" id="dbuser" /></li>', __('Textpattern Database User:'));
-               printf('<li><label for="dbpass">%s</label> <input type="password" name="dbpass" id="dbpass" /></li>', __('Textpattern Database Password:'));
-               printf('<li><label for="dbname">%s</label> <input type="text" id="dbname" name="dbname" /></li>', __('Textpattern Database Name:'));
-               printf('<li><label for="dbhost">%s</label> <input type="text" id="dbhost" name="dbhost" value="localhost" /></li>', __('Textpattern Database Host:'));
-               printf('<li><label for="dbprefix">%s</label> <input type="text" name="dbprefix" id="dbprefix"  /></li>', __('Textpattern Table prefix (if any):'));
-               echo '</ul>';
+               echo '<table class="editform">';
+               printf('<tr><th scope="row"><label for="dbuser">%s</label></th><td><input type="text" name="dbuser" id="dbuser" /></td></tr>', __('Textpattern Database User:'));
+               printf('<tr><th scope="row"><label for="dbpass">%s</label></th><td><input type="password" name="dbpass" id="dbpass" /></td></tr>', __('Textpattern Database Password:'));
+               printf('<tr><th scope="row"><label for="dbname">%s</label></th><td><input type="text" id="dbname" name="dbname" /></td></tr>', __('Textpattern Database Name:'));
+               printf('<tr><th scope="row"><label for="dbhost">%s</label></th><td><input type="text" id="dbhost" name="dbhost" value="localhost" /></td></tr>', __('Textpattern Database Host:'));
+               printf('<tr><th scope="row"><label for="dbprefix">%s</label></th><td><input type="text" name="dbprefix" id="dbprefix"  /></td></tr>', __('Textpattern Table prefix (if any):'));
+               echo '</table>';
        }
        }
-       
-       function dispatch() 
+
+       function dispatch()
        {
 
                if (empty ($_GET['step']))
        {
 
                if (empty ($_GET['step']))
@@ -585,45 +593,47 @@ class Textpattern_Import {
                else
                        $step = (int) $_GET['step'];
                $this->header();
                else
                        $step = (int) $_GET['step'];
                $this->header();
-               
-               if ( $step > 0 ) 
+
+               if ( $step > 0 )
                {
                {
+                       check_admin_referer('import-textpattern');
+
                        if($_POST['dbuser'])
                        {
                                if(get_option('txpuser'))
                        if($_POST['dbuser'])
                        {
                                if(get_option('txpuser'))
-                                       delete_option('txpuser');       
-                               add_option('txpuser',$_POST['dbuser']);
+                                       delete_option('txpuser');
+                               add_option('txpuser', sanitize_user($_POST['dbuser'], true));
                        }
                        if($_POST['dbpass'])
                        {
                                if(get_option('txppass'))
                        }
                        if($_POST['dbpass'])
                        {
                                if(get_option('txppass'))
-                                       delete_option('txppass');       
-                               add_option('txppass',$_POST['dbpass']);
+                                       delete_option('txppass');
+                               add_option('txppass',  sanitize_user($_POST['dbpass'], true));
                        }
                        }
-                       
+
                        if($_POST['dbname'])
                        {
                                if(get_option('txpname'))
                        if($_POST['dbname'])
                        {
                                if(get_option('txpname'))
-                                       delete_option('txpname');       
-                               add_option('txpname',$_POST['dbname']);
+                                       delete_option('txpname');
+                               add_option('txpname',  sanitize_user($_POST['dbname'], true));
                        }
                        if($_POST['dbhost'])
                        {
                                if(get_option('txphost'))
                                        delete_option('txphost');
                        }
                        if($_POST['dbhost'])
                        {
                                if(get_option('txphost'))
                                        delete_option('txphost');
-                               add_option('txphost',$_POST['dbhost']); 
+                               add_option('txphost',  sanitize_user($_POST['dbhost'], true));
                        }
                        if($_POST['dbprefix'])
                        {
                                if(get_option('tpre'))
                                        delete_option('tpre');
                        }
                        if($_POST['dbprefix'])
                        {
                                if(get_option('tpre'))
                                        delete_option('tpre');
-                               add_option('tpre',$_POST['dbprefix']); 
-                       }                       
+                               add_option('tpre',  sanitize_user($_POST['dbprefix']));
+                       }
 
 
                }
 
 
 
                }
 
-               switch ($step) 
+               switch ($step)
                {
                        default:
                        case 0 :
                {
                        default:
                        case 0 :
@@ -648,16 +658,16 @@ class Textpattern_Import {
                                $this->cleanup_txpimport();
                                break;
                }
                                $this->cleanup_txpimport();
                                break;
                }
-               
+
                $this->footer();
        }
 
                $this->footer();
        }
 
-       function Textpattern_Import() 
+       function Textpattern_Import()
        {
        {
-               // Nothing.     
+               // Nothing.
        }
 }
 
 $txp_import = new Textpattern_Import();
        }
 }
 
 $txp_import = new Textpattern_Import();
-register_importer('textpattern', 'Textpattern', __('Import posts from a Textpattern Blog'), array ($txp_import, 'dispatch'));
+register_importer('textpattern', __('Textpattern'), __('Import categories, users, posts, comments, and links from a Textpattern blog'), array ($txp_import, 'dispatch'));
 ?>
 ?>
index a951efd863d16109e6e064757521cabeadfcdac5..734b349e64c1518d818392ded300c5569f4c6cd0 100644 (file)
@@ -25,7 +25,7 @@ if ( isset($rss->items) && 0 != count($rss->items) ) {
 $rss->items = array_slice($rss->items, 0, 10);
 foreach ($rss->items as $item ) {
 ?>
 $rss->items = array_slice($rss->items, 0, 10);
 foreach ($rss->items as $item ) {
 ?>
-       <li><a href="<?php echo wp_filter_kses($item['link']); ?>"><?php echo wp_specialchars($item['title']); ?></a></li>
+       <li><a href="<?php echo wp_filter_kses($item['link']); ?>"><?php echo wptexturize(wp_specialchars($item['title'])); ?></a></li>
 <?php } ?>
 </ul>
 </div>
 <?php } ?>
 </ul>
 </div>
index d0bd82503b9b5977a676df07b7842ad6629f0fd3..212f1159f0ebd9fa49c74a44195ea83fd1031a19 100644 (file)
@@ -24,6 +24,8 @@ for ($i=0; $i<count($wpvarstoreset); $i += 1) {
        }
 }
 
        }
 }
 
+$all = ( 'true' == $all ) ? 'true' : 'false';
+$start = (int) $start;
 $post = (int) $post;
 $images_width = 1;
 
 $post = (int) $post;
 $images_width = 1;
 
@@ -238,7 +240,7 @@ srcb[{$ID}] = '{$image['guid']}';
                        $xpadding = (128 - $image['uwidth']) / 2;
                        $ypadding = (96 - $image['uheight']) / 2;
                        $style .= "#target{$ID} img { padding: {$ypadding}px {$xpadding}px; }\n";
                        $xpadding = (128 - $image['uwidth']) / 2;
                        $ypadding = (96 - $image['uheight']) / 2;
                        $style .= "#target{$ID} img { padding: {$ypadding}px {$xpadding}px; }\n";
-                       $title = wp_specialchars($image['post_title'], ENT_QUOTES);
+                       $title = attribute_escape($image['post_title']);
                        $script .= "aa[{$ID}] = '<a id=\"p{$ID}\" rel=\"attachment\" class=\"imagelink\" href=\"$href\" onclick=\"doPopup({$ID});return false;\" title=\"{$title}\">';
 ab[{$ID}] = '<a class=\"imagelink\" href=\"{$image['guid']}\" onclick=\"doPopup({$ID});return false;\" title=\"{$title}\">';
 imga[{$ID}] = '<img id=\"image{$ID}\" src=\"$src\" alt=\"{$title}\" $height_width />';
                        $script .= "aa[{$ID}] = '<a id=\"p{$ID}\" rel=\"attachment\" class=\"imagelink\" href=\"$href\" onclick=\"doPopup({$ID});return false;\" title=\"{$title}\">';
 ab[{$ID}] = '<a class=\"imagelink\" href=\"{$image['guid']}\" onclick=\"doPopup({$ID});return false;\" title=\"{$title}\">';
 imga[{$ID}] = '<img id=\"image{$ID}\" src=\"$src\" alt=\"{$title}\" $height_width />';
@@ -258,7 +260,7 @@ imgb[{$ID}] = '<img id=\"image{$ID}\" src=\"{$image['guid']}\" alt=\"{$title}\"
 </div>
 ";
                } else {
 </div>
 ";
                } else {
-                       $title = wp_specialchars($attachment['post_title'], ENT_QUOTES);
+                       $title = attribute_escape($attachment['post_title']);
                        $filename = basename($attachment['guid']);
                        $icon = get_attachment_icon($ID);
                        $toggle_icon = "<a id=\"I{$ID}\" onclick=\"toggleOtherIcon({$ID});return false;\" href=\"javascript:void()\">$__using_title</a>";
                        $filename = basename($attachment['guid']);
                        $icon = get_attachment_icon($ID);
                        $toggle_icon = "<a id=\"I{$ID}\" onclick=\"toggleOtherIcon({$ID});return false;\" href=\"javascript:void()\">$__using_title</a>";
@@ -429,7 +431,7 @@ richedit = ( typeof tinyMCE == 'object' && tinyMCE.configs.length > 0 );
 function sendToEditor(n) {
        o = document.getElementById('div'+n);
        h = o.innerHTML.replace(new RegExp('^\\s*(.*?)\\s*$', ''), '$1'); // Trim
 function sendToEditor(n) {
        o = document.getElementById('div'+n);
        h = o.innerHTML.replace(new RegExp('^\\s*(.*?)\\s*$', ''), '$1'); // Trim
-       h = h.replace(new RegExp(' (class|title|width|height|id|onclick|onmousedown)=([^\'"][^ ]*)( |/|>)', 'g'), ' $1="$2"$3'); // Enclose attribs in quotes
+       h = h.replace(new RegExp(' (class|title|width|height|id|onclick|onmousedown)=([^\'"][^ ]*)(?=( |/|>))', 'g'), ' $1="$2"'); // Enclose attribs in quotes
        h = h.replace(new RegExp(' (width|height)=".*?"', 'g'), ''); // Drop size constraints
        h = h.replace(new RegExp(' on(click|mousedown)="[^"]*"', 'g'), ''); // Drop menu events
        h = h.replace(new RegExp('<(/?)A', 'g'), '<$1a'); // Lowercase tagnames
        h = h.replace(new RegExp(' (width|height)=".*?"', 'g'), ''); // Drop size constraints
        h = h.replace(new RegExp(' on(click|mousedown)="[^"]*"', 'g'), ''); // Drop menu events
        h = h.replace(new RegExp('<(/?)A', 'g'), '<$1a'); // Lowercase tagnames
index ffa33ce79b36a0c9587316c0d68ddf5362b65da3..eb635aa206702870f3117932869dcd84a3078546 100644 (file)
@@ -166,10 +166,9 @@ $wpdb->query("INSERT INTO $wpdb->posts (post_author, post_date, post_date_gmt, p
 $wpdb->query( "INSERT INTO $wpdb->post2cat (`rel_id`, `post_id`, `category_id`) VALUES (1, 1, 1)" );
 
 // Default comment
 $wpdb->query( "INSERT INTO $wpdb->post2cat (`rel_id`, `post_id`, `category_id`) VALUES (1, 1, 1)" );
 
 // Default comment
-$wpdb->query("INSERT INTO $wpdb->comments (comment_post_ID, comment_author, comment_author_email, comment_author_url, comment_date, comment_date_gmt, comment_content) VALUES ('1', '".$wpdb->escape(__('Mr WordPress'))."', '', 'http://wordpress.org/', '$now', '$now_gmt', '".$wpdb->escape(__('Hi, this is a comment.<br />To delete a comment, just log in, and view the posts\' comments, there you will have the option to edit or delete them.'))."')");
+$wpdb->query("INSERT INTO $wpdb->comments (comment_post_ID, comment_author, comment_author_email, comment_author_url, comment_date, comment_date_gmt, comment_content) VALUES ('1', '".$wpdb->escape(__('Mr WordPress'))."', '', 'http://wordpress.org/', '$now', '$now_gmt', '".$wpdb->escape(__('Hi, this is a comment.<br />To delete a comment, just log in and view the post&#039;s comments. There you will have the option to edit or delete them.'))."')");
 
 // First Page
 
 // First Page
-
 $wpdb->query("INSERT INTO $wpdb->posts (post_author, post_date, post_date_gmt, post_content, post_excerpt, post_title, post_category, post_name, post_modified, post_modified_gmt, post_status, to_ping, pinged, post_content_filtered) VALUES ('1', '$now', '$now_gmt', '".$wpdb->escape(__('This is an example of a WordPress page, you could edit this to put information about yourself or your site so readers know where you are coming from. You can create as many pages like this one or sub-pages as you like and manage all of your content inside of WordPress.'))."', '', '".$wpdb->escape(__('About'))."', '0', '".$wpdb->escape(__('about'))."', '$now', '$now_gmt', 'static', '', '', '')");
 $wp_rewrite->flush_rules();
 
 $wpdb->query("INSERT INTO $wpdb->posts (post_author, post_date, post_date_gmt, post_content, post_excerpt, post_title, post_category, post_name, post_modified, post_modified_gmt, post_status, to_ping, pinged, post_content_filtered) VALUES ('1', '$now', '$now_gmt', '".$wpdb->escape(__('This is an example of a WordPress page, you could edit this to put information about yourself or your site so readers know where you are coming from. You can create as many pages like this one or sub-pages as you like and manage all of your content inside of WordPress.'))."', '', '".$wpdb->escape(__('About'))."', '0', '".$wpdb->escape(__('about'))."', '$now', '$now_gmt', 'static', '', '', '')");
 $wp_rewrite->flush_rules();
 
@@ -182,7 +181,7 @@ $wpdb->query("INSERT INTO $wpdb->usermeta (user_id, meta_key, meta_value) VALUES
 $admin_caps = serialize(array('administrator' => true));
 $wpdb->query("INSERT INTO $wpdb->usermeta (user_id, meta_key, meta_value) VALUES ({$wpdb->insert_id}, '{$table_prefix}capabilities', '{$admin_caps}');");
 
 $admin_caps = serialize(array('administrator' => true));
 $wpdb->query("INSERT INTO $wpdb->usermeta (user_id, meta_key, meta_value) VALUES ({$wpdb->insert_id}, '{$table_prefix}capabilities', '{$admin_caps}');");
 
-$message_headers = 'From: ' . $weblog_title . ' <wordpress@' . $_SERVER['SERVER_NAME'] . '>';
+$message_headers = 'From: "' . $weblog_title . '" <wordpress@' . $_SERVER['SERVER_NAME'] . '>';
 $message = sprintf(__("Your new WordPress blog has been successfully set up at:
 
 %1\$s
 $message = sprintf(__("Your new WordPress blog has been successfully set up at:
 
 %1\$s
index 0ebf4b255e95782ce245bb5a1d49e62c06eaef80..d3adf7632768fd482d3baa64b914eca3b4b0d874 100644 (file)
@@ -124,7 +124,7 @@ switch ($action) {
 <table class="editform" width="100%" cellspacing="2" cellpadding="5">
 <tr>
        <th width="33%" scope="row"><?php _e('Name:') ?></th>
 <table class="editform" width="100%" cellspacing="2" cellpadding="5">
 <tr>
        <th width="33%" scope="row"><?php _e('Name:') ?></th>
-       <td width="67%"><input name="cat_name" type="text" value="<?php echo wp_specialchars($row->cat_name)?>" size="30" /></td>
+       <td width="67%"><input name="cat_name" type="text" value="<?php echo attribute_escape($row->cat_name)?>" size="30" /></td>
 </tr>
 <tr>
        <th scope="row"><?php _e('Show:') ?></th>
 </tr>
 <tr>
        <th scope="row"><?php _e('Show:') ?></th>
@@ -309,7 +309,7 @@ $results = $wpdb->get_results("SELECT cat_id, cat_name, auto_toggle, show_images
          . " show_rating, show_updated, sort_order, sort_desc, text_before_link, text_after_link, "
          . " text_after_all, list_limit FROM $wpdb->linkcategories ORDER BY cat_id");
 $i = 1;
          . " show_rating, show_updated, sort_order, sort_desc, text_before_link, text_after_link, "
          . " text_after_all, list_limit FROM $wpdb->linkcategories ORDER BY cat_id");
 $i = 1;
-foreach ($results as $row) {
+foreach ( (array) $results as $row) {
     if ($row->list_limit == -1) {
         $row->list_limit = __('none');
     }
     if ($row->list_limit == -1) {
         $row->list_limit = __('none');
     }
@@ -356,8 +356,14 @@ foreach ($results as $row) {
                 <td nowrap="nowrap"><?php echo wp_specialchars($row->text_after_all)?></td>
                 <td><?php echo $row->list_limit ?></td>
                 <td><a href="link-categories.php?cat_id=<?php echo $row->cat_id?>&amp;action=Edit" class="edit"><?php _e('Edit') ?></a></td>
                 <td nowrap="nowrap"><?php echo wp_specialchars($row->text_after_all)?></td>
                 <td><?php echo $row->list_limit ?></td>
                 <td><a href="link-categories.php?cat_id=<?php echo $row->cat_id?>&amp;action=Edit" class="edit"><?php _e('Edit') ?></a></td>
-                <td><a href="<?php echo wp_nonce_url("link-categories.php?cat_id=$row->cat_id?>&amp;action=Delete", 'delete-link-category_' . $row->cat_id) ?>" onclick="return deleteSomething( 'link category', <?php echo $row->cat_id . ", '" . sprintf(__("You are about to delete the &quot;%s&quot; link category.\\n&quot;Cancel&quot; to stop, &quot;OK&quot; to delete."), js_escape($row->cat_name)); ?>' );" class="delete"><?php _e('Delete') ?></a></td>
-              </tr>
+                <td>
+                               <?php if (1 == $row->cat_id ) { 
+                                       _e('Default');
+                               } else { ?>
+                                       <a href="<?php echo wp_nonce_url("link-categories.php?cat_id=$row->cat_id?>&amp;action=Delete", 'delete-link-category_' . $row->cat_id) ?>" onclick="return deleteSomething( 'link category', <?php echo $row->cat_id . ", '" . sprintf(__("You are about to delete the &quot;%s&quot; link category.\\n&quot;Cancel&quot; to stop, &quot;OK&quot; to delete."), js_escape($row->cat_name)); ?>' );" class="delete"><?php _e('Delete') ?></a>
+                               <?php } ?>
+              </td>
+          </tr>
 <?php
         ++$i;
     }
 <?php
         ++$i;
     }
index 723d1921581f47b0c6683a055c03b17866ecc2b8..c6119e6fda3cd4d2ecb5b0a7c177b8e27a658173 100644 (file)
@@ -26,7 +26,7 @@ switch ($step) {
 <form enctype="multipart/form-data" action="link-import.php" method="post" name="blogroll">
 <?php wp_nonce_field('import-bookmarks') ?>
 
 <form enctype="multipart/form-data" action="link-import.php" method="post" name="blogroll">
 <?php wp_nonce_field('import-bookmarks') ?>
 
-<p><?php _e('If a program or website you use allows you to export your links or subscriptions as OPML you may import them here.'); ?>
+<p><?php _e('If a program or website you use allows you to export your links or subscriptions as OPML you may import them here.'); ?></p>
 <div style="width: 70%; margin: auto; height: 8em;">
 <input type="hidden" name="step" value="1" />
 <input type="hidden" name="MAX_FILE_SIZE" value="30000" />
 <div style="width: 70%; margin: auto; height: 8em;">
 <input type="hidden" name="step" value="1" />
 <input type="hidden" name="MAX_FILE_SIZE" value="30000" />
@@ -74,10 +74,9 @@ foreach ($categories as $category) {
 
      <h2><?php _e('Importing...') ?></h2>
 <?php
 
      <h2><?php _e('Importing...') ?></h2>
 <?php
-                $cat_id = $_POST['cat_id'];
-                if (($cat_id == '') || ($cat_id == 0)) {
-                    $cat_id  = 1;
-                }
+                               $cat_id = abs( (int) $_POST['cat_id'] );
+                               if ( $cat_id < 1 )
+                                       $cat_id  = 1;
 
                 $opml_url = $_POST['opml_url'];
                 if (isset($opml_url) && $opml_url != '' && $opml_url != 'http://') {
 
                 $opml_url = $_POST['opml_url'];
                 if (isset($opml_url) && $opml_url != '' && $opml_url != 'http://') {
index 4818397941f4bd7e6d238af974fc870eed8485ad..b859ec9e94a83cecfb6d8a0cc37958bd7327f9ca 100644 (file)
@@ -63,6 +63,7 @@ switch ($action) {
     $q = $wpdb->query("update $wpdb->links SET link_owner='$newowner' WHERE link_id IN ($all_links)");
 
     wp_redirect($this_file);
     $q = $wpdb->query("update $wpdb->links SET link_owner='$newowner' WHERE link_id IN ($all_links)");
 
     wp_redirect($this_file);
+    exit;
     break;
   }
   case 'visibility':
     break;
   }
   case 'visibility':
@@ -100,6 +101,7 @@ switch ($action) {
     }
 
     wp_redirect($this_file);
     }
 
     wp_redirect($this_file);
+    exit;
     break;
   }
   case 'move':
     break;
   }
   case 'move':
@@ -120,6 +122,7 @@ switch ($action) {
     $q = $wpdb->query("update $wpdb->links SET link_category='$category' WHERE link_id IN ($all_links)");
 
     wp_redirect($this_file);
     $q = $wpdb->query("update $wpdb->links SET link_category='$category' WHERE link_id IN ($all_links)");
 
     wp_redirect($this_file);
+    exit();
     break;
   }
 
     break;
   }
 
@@ -130,6 +133,7 @@ switch ($action) {
        add_link();
        
     wp_redirect(wp_get_referer() . '?added=true');
        add_link();
        
     wp_redirect(wp_get_referer() . '?added=true');
+    exit;
     break;
   } // end Add
 
     break;
   } // end Add
 
@@ -151,6 +155,7 @@ switch ($action) {
        
     setcookie('links_show_cat_id_' . COOKIEHASH, $links_show_cat_id, time()+600);
     wp_redirect($this_file);
        
     setcookie('links_show_cat_id_' . COOKIEHASH, $links_show_cat_id, time()+600);
     wp_redirect($this_file);
+    exit;
     break;
   } // end Save
 
     break;
   } // end Save
 
@@ -174,6 +179,7 @@ switch ($action) {
     $links_show_cat_id = $cat_id;
     setcookie('links_show_cat_id_' . COOKIEHASH, $links_show_cat_id, time()+600);
     wp_redirect($this_file);
     $links_show_cat_id = $cat_id;
     setcookie('links_show_cat_id_' . COOKIEHASH, $links_show_cat_id, time()+600);
     wp_redirect($this_file);
+    exit;
     break;
   } // end Delete
 
     break;
   } // end Delete
 
@@ -321,7 +327,7 @@ function checkAll(form)
     <?php wp_nonce_field('bulk-bookmarks') ?>
     <input type="hidden" name="link_id" value="" />
     <input type="hidden" name="action" value="" />
     <?php wp_nonce_field('bulk-bookmarks') ?>
     <input type="hidden" name="link_id" value="" />
     <input type="hidden" name="action" value="" />
-    <input type="hidden" name="order_by" value="<?php echo wp_specialchars($order_by, 1); ?>" />
+    <input type="hidden" name="order_by" value="<?php echo attribute_escape($order_by); ?>" />
     <input type="hidden" name="cat_id" value="<?php echo (int) $cat_id ?>" />
   <table id="the-list-x" width="100%" cellpadding="3" cellspacing="3">
     <tr>
     <input type="hidden" name="cat_id" value="<?php echo (int) $cat_id ?>" />
   <table id="the-list-x" width="100%" cellpadding="3" cellspacing="3">
     <tr>
@@ -351,10 +357,10 @@ function checkAll(form)
     $links = $wpdb->get_results($sql);
     if ($links) {
         foreach ($links as $link) {
     $links = $wpdb->get_results($sql);
     if ($links) {
         foreach ($links as $link) {
-           $link->link_name = wp_specialchars($link->link_name);
+           $link->link_name = attribute_escape($link->link_name);
            $link->link_category = wp_specialchars($link->link_category);
            $link->link_description = wp_specialchars($link->link_description);
            $link->link_category = wp_specialchars($link->link_category);
            $link->link_description = wp_specialchars($link->link_description);
-            $link->link_url = wp_specialchars($link->link_url);
+            $link->link_url = attribute_escape($link->link_url);
             $short_url = str_replace('http://', '', $link->link_url);
             $short_url = str_replace('www.', '', $short_url);
             if ('/' == substr($short_url, -1))
             $short_url = str_replace('http://', '', $link->link_url);
             $short_url = str_replace('www.', '', $short_url);
             if ('/' == substr($short_url, -1))
index ed58186c2e1c8e11477f0bd9b8dc9c19275e0f42..c95d60d1e1e3ed57912f0617fafb75c1dc9e51b6 100644 (file)
@@ -55,7 +55,7 @@ foreach ($menu as $menu_page) {
 }
 
 do_action('admin_menu', '');
 }
 
 do_action('admin_menu', '');
-ksort($menu); // make it all pretty
+uksort($menu, "strnatcasecmp"); // make it all pretty
 
 if (! user_can_access_admin_page()) {
        die( __('You do not have sufficient permissions to access this page.') );
 
 if (! user_can_access_admin_page()) {
        die( __('You do not have sufficient permissions to access this page.') );
index 66fd75c6c9ae0f64ade34bfd268e0455820f9eec..065f8bdfc0fcbc5380c1361704eb253cf8b3747d 100644 (file)
@@ -152,10 +152,10 @@ echo '<a href="post.php?action=editcomment&amp;comment='.$comment->comment_ID.'"
 <a href="<?php echo get_permalink($comment->comment_post_ID); ?>"><?php _e('View Post') ?></a> | 
 <?php 
 echo " <a href=\"" . wp_nonce_url("post.php?action=deletecomment&amp;p=".$comment->comment_post_ID."&amp;comment=".$comment->comment_ID, 'delete-comment_' . $comment->comment_ID) . "\" onclick=\"return deleteSomething( 'comment', $comment->comment_ID, '" . __("You are about to delete this comment.\\n&quot;Cancel&quot; to stop, &quot;OK&quot; to delete.") . "' );\">" . __('Delete just this comment') . "</a> | "; ?>  <?php _e('Bulk action:') ?>
 <a href="<?php echo get_permalink($comment->comment_post_ID); ?>"><?php _e('View Post') ?></a> | 
 <?php 
 echo " <a href=\"" . wp_nonce_url("post.php?action=deletecomment&amp;p=".$comment->comment_post_ID."&amp;comment=".$comment->comment_ID, 'delete-comment_' . $comment->comment_ID) . "\" onclick=\"return deleteSomething( 'comment', $comment->comment_ID, '" . __("You are about to delete this comment.\\n&quot;Cancel&quot; to stop, &quot;OK&quot; to delete.") . "' );\">" . __('Delete just this comment') . "</a> | "; ?>  <?php _e('Bulk action:') ?>
-       <input type="radio" name="comment[<?php echo $comment->comment_ID; ?>]" id="comment-<?php echo $comment->comment_ID; ?>-approve" value="approve" /> <label for="comment[<?php echo $comment->comment_ID; ?>]-approve"><?php _e('Approve') ?></label>
-       <input type="radio" name="comment[<?php echo $comment->comment_ID; ?>]" id="comment-<?php echo $comment->comment_ID; ?>-spam" value="spam" /> <label for="comment[<?php echo $comment->comment_ID; ?>]-spam"><?php _e('Spam') ?></label>
-       <input type="radio" name="comment[<?php echo $comment->comment_ID; ?>]" id="comment-<?php echo $comment->comment_ID; ?>-delete" value="delete" /> <label for="comment[<?php echo $comment->comment_ID; ?>]-delete"><?php _e('Delete') ?></label>
-       <input type="radio" name="comment[<?php echo $comment->comment_ID; ?>]" id="comment-<?php echo $comment->comment_ID; ?>-nothing" value="later" checked="checked" /> <label for="comment[<?php echo $comment->comment_ID; ?>]-nothing"><?php _e('Defer until later') ?></label>
+       <input type="radio" name="comment[<?php echo $comment->comment_ID; ?>]" id="comment-<?php echo $comment->comment_ID; ?>-approve" value="approve" /> <label for="comment-<?php echo $comment->comment_ID; ?>-approve"><?php _e('Approve') ?></label>
+       <input type="radio" name="comment[<?php echo $comment->comment_ID; ?>]" id="comment-<?php echo $comment->comment_ID; ?>-spam" value="spam" /> <label for="comment-<?php echo $comment->comment_ID; ?>-spam"><?php _e('Spam') ?></label>
+       <input type="radio" name="comment[<?php echo $comment->comment_ID; ?>]" id="comment-<?php echo $comment->comment_ID; ?>-delete" value="delete" /> <label for="comment-<?php echo $comment->comment_ID; ?>-delete"><?php _e('Delete') ?></label>
+       <input type="radio" name="comment[<?php echo $comment->comment_ID; ?>]" id="comment-<?php echo $comment->comment_ID; ?>-nothing" value="later" checked="checked" /> <label for="comment-<?php echo $comment->comment_ID; ?>-nothing"><?php _e('Defer until later') ?></label>
        </p>
 
        </li>
        </p>
 
        </li>
index 247c01f071e07e5417b86cf0c0944696a990a17c..fc0aa7410a66f224264036b562dfa5786e7405f8 100644 (file)
@@ -71,7 +71,7 @@ if ($action == 'retrospam') {
 </fieldset>
 <fieldset class="options">
 <legend><?php _e('Comment Moderation') ?></legend>
 </fieldset>
 <fieldset class="options">
 <legend><?php _e('Comment Moderation') ?></legend>
-<p><?php printf(__('Hold a comment in the queue if it contains more than %s links. (A common characteristic of comment spam is a large number of hyperlinks.)'), '<input name="comment_max_links" type="text" id="comment_max_links" size="3" value="' . get_settings('comment_max_links'). '" />' ) ?></p>
+<p><?php printf(__('Hold a comment in the queue if it contains %s or more links. (A common characteristic of comment spam is a large number of hyperlinks.)'), '<input name="comment_max_links" type="text" id="comment_max_links" size="3" value="' . get_settings('comment_max_links'). '" />' ) ?></p>
 
 <p><?php _e('When a comment contains any of these words in its content, name, URI, e-mail, or IP, hold it in the moderation queue: (Separate multiple words with new lines.) <a href="http://codex.wordpress.org/Spam_Words">Common spam words</a>.') ?></p>
 <p> 
 
 <p><?php _e('When a comment contains any of these words in its content, name, URI, e-mail, or IP, hold it in the moderation queue: (Separate multiple words with new lines.) <a href="http://codex.wordpress.org/Spam_Words">Common spam words</a>.') ?></p>
 <p> 
index 664dc3a1b4f451c1f801aa0169e760d999d7f7b3..00d6cf89545c4a45db0c7fe933fff9576fca1b87 100644 (file)
@@ -83,7 +83,7 @@ foreach($wp_roles->role_names as $role => $name) {
 </tr> 
 <tr>
 <th scope="row">&nbsp;</th>
 </tr> 
 <tr>
 <th scope="row">&nbsp;</th>
-<td><?php _e('<a href="http://codex.wordpress.org/Formatting_Date_and_Time">Documentation on date formatting</a>. Save option to update sample output.') ?> </td>
+<td><?php _e('<a href="http://codex.wordpress.org/Formatting_Date_and_Time">Documentation on date formatting</a>. Click "Update options" to update sample output.') ?> </td>
 </tr>
 <tr>
 <th scope="row"><?php _e('Weeks in the calendar should start on:') ?></th>
 </tr>
 <tr>
 <th scope="row"><?php _e('Weeks in the calendar should start on:') ?></th>
index b4ff4efb0036319a0503e49c7309e1b1ba848a39..2b6e33a5dffc74d7b179c5f0e0af326e79d612a1 100644 (file)
@@ -17,7 +17,7 @@ include('admin-header.php');
 <table class="editform optiontable">
 <tr valign="top">
 <th scope="row"><?php _e('Store uploads in this folder'); ?>:</th>
 <table class="editform optiontable">
 <tr valign="top">
 <th scope="row"><?php _e('Store uploads in this folder'); ?>:</th>
-<td><input name="upload_path" type="text" id="upload_path" class="code" value="<?php echo str_replace(ABSPATH, '', get_settings('upload_path')); ?>" size="40" />
+<td><input name="upload_path" type="text" id="upload_path" class="code" value="<?php echo attribute_escape(str_replace(ABSPATH, '', get_settings('upload_path'))); ?>" size="40" />
 <br />
 <?php _e('Default is <code>wp-content/uploads</code>'); ?>
 </td>
 <br />
 <?php _e('Default is <code>wp-content/uploads</code>'); ?>
 </td>
index cf16d89b43f04476525178d7f04de459ef09607d..68c44aaa0d3d43c7090ef49520f6e25134570427 100644 (file)
@@ -148,7 +148,7 @@ checked="checked"
 </label>
 <br />
 </p>
 </label>
 <br />
 </p>
-<p id="customstructure"><?php _e('Custom structure'); ?>: <input name="permalink_structure" id="permalink_structure" type="text" class="code" style="width: 60%;" value="<?php echo $permalink_structure; ?>" size="50" /></p>
+<p id="customstructure"><?php _e('Custom structure'); ?>: <input name="permalink_structure" id="permalink_structure" type="text" class="code" style="width: 60%;" value="<?php echo attribute_escape($permalink_structure); ?>" size="50" /></p>
 
 <h3><?php _e('Optional'); ?></h3>
 <?php if ($is_apache) : ?>
 
 <h3><?php _e('Optional'); ?></h3>
 <?php if ($is_apache) : ?>
@@ -157,7 +157,7 @@ checked="checked"
        <p><?php _e('If you like, you may enter a custom prefix for your category URIs here. For example, <code>/index.php/taxonomy/tags</code> would make your category links like <code>http://example.org/index.php/taxonomy/tags/uncategorized/</code>. If you leave this blank the default will be used.') ?></p>
 <?php endif; ?>
        <p> 
        <p><?php _e('If you like, you may enter a custom prefix for your category URIs here. For example, <code>/index.php/taxonomy/tags</code> would make your category links like <code>http://example.org/index.php/taxonomy/tags/uncategorized/</code>. If you leave this blank the default will be used.') ?></p>
 <?php endif; ?>
        <p> 
-  <?php _e('Category base'); ?>: <input name="category_base" type="text" class="code"  value="<?php echo $category_base; ?>" size="30" /> 
+  <?php _e('Category base'); ?>: <input name="category_base" type="text" class="code"  value="<?php echo attribute_escape($category_base); ?>" size="30" /> 
      </p> 
     <p class="submit"> 
       <input type="submit" name="submit" value="<?php _e('Update Permalink Structure &raquo;') ?>" /> 
      </p> 
     <p class="submit"> 
       <input type="submit" name="submit" value="<?php _e('Update Permalink Structure &raquo;') ?>" /> 
@@ -168,7 +168,7 @@ checked="checked"
 <form action="options-permalink.php" method="post">
 <?php wp_nonce_field('update-permalink') ?>
    <p>
 <form action="options-permalink.php" method="post">
 <?php wp_nonce_field('update-permalink') ?>
    <p>
-<textarea rows="5" style="width: 98%;" name="rules"><?php echo $wp_rewrite->mod_rewrite_rules(); ?>
+<textarea rows="5" style="width: 98%;" name="rules"><?php echo wp_specialchars($wp_rewrite->mod_rewrite_rules()); ?>
 </textarea>
     </p>
 </form>
 </textarea>
     </p>
 </form>
index 3c5b8dbf4dafcfd30b29d681e52f5d4e97f3210e..bd8b2b0d54e976c5f9629ac8094dbb2739a1153d 100644 (file)
@@ -24,6 +24,67 @@ for ($i=0; $i<count($wpvarstoreset); $i += 1) {
 if ( !current_user_can('manage_options') )
        die ( __('Cheatin&#8217; uh?') );
 
 if ( !current_user_can('manage_options') )
        die ( __('Cheatin&#8217; uh?') );
 
+function sanitize_option($option, $value) {
+
+       switch ($option) {
+               case 'admin_email':
+                       $value = sanitize_email($value);
+                       break;
+
+               case 'default_post_edit_rows':
+               case 'mailserver_port':
+               case 'comment_max_links':
+                       $value = abs((int) $value);
+                       break;
+
+               case 'posts_per_page':
+               case 'posts_per_rss':
+                       $value = (int) $value;
+                       if ( empty($value) ) $value = 1;
+                       if ( $value < -1 ) $value = abs($value);
+                       break;
+
+               case 'default_ping_status':
+               case 'default_comment_status':
+                       // Options that if not there have 0 value but need to be something like "closed"
+                       if ( $value == '0' || $value == '')
+                               $value = 'closed';
+                       break;
+
+               case 'blogdescription':
+               case 'blogname':
+                       if (current_user_can('unfiltered_html') == false)
+                               $value = wp_filter_post_kses( $value );
+                       break;
+
+               case 'blog_charset':
+                       $value = preg_replace('/[^a-zA-Z0-9_-]/', '', $value);
+                       break;
+
+               case 'date_format':
+               case 'time_format':
+               case 'mailserver_url':
+               case 'mailserver_login':
+               case 'mailserver_pass':
+               case 'ping_sites':
+               case 'upload_path':
+                       $value = strip_tags($value);
+                       $value = wp_filter_kses($value);
+                       break;
+
+               case 'gmt_offset':
+                       $value = preg_replace('/[^0-9:.-]/', '', $value);
+                       break;
+
+               case 'siteurl':
+               case 'home':
+                       $value = clean_url($value);
+                       break;
+       }
+
+       return $value;  
+}
+
 switch($action) {
 
 case 'update':
 switch($action) {
 
 case 'update':
@@ -31,9 +92,10 @@ case 'update':
        
        check_admin_referer('update-options');
 
        
        check_admin_referer('update-options');
 
-       if (!$_POST['page_options']) {
-               foreach ($_POST as $key => $value) {
-                       $options[] = $key;
+       if ( !$_POST['page_options'] ) {
+               foreach ( (array) $_POST as $key => $value) {
+                       if ( !in_array($key, array('_wpnonce', '_wp_http_referer')) )
+                               $options[] = $key;
                }
        } else {
                $options = explode(',', stripslashes($_POST['page_options']));
                }
        } else {
                $options = explode(',', stripslashes($_POST['page_options']));
@@ -43,19 +105,11 @@ case 'update':
        $old_siteurl = get_settings('siteurl');
        $old_home = get_settings('home');
 
        $old_siteurl = get_settings('siteurl');
        $old_home = get_settings('home');
 
-       // HACK
-       // Options that if not there have 0 value but need to be something like "closed"
-       $nonbools = array('default_ping_status', 'default_comment_status');
        if ($options) {
                foreach ($options as $option) {
                        $option = trim($option);
                        $value = trim(stripslashes($_POST[$option]));
        if ($options) {
                foreach ($options as $option) {
                        $option = trim($option);
                        $value = trim(stripslashes($_POST[$option]));
-                               if( in_array($option, $nonbools) && ( $value == '0' || $value == '') )
-                               $value = 'closed';
-                       
-                       if( $option == 'blogdescription' || $option == 'blogname' )
-                               if (current_user_can('unfiltered_html') == false)
-                                       $value = wp_filter_post_kses( $value );
+                       $value = sanitize_option($option, $value);
                        
                        if (update_option($option, $value) ) {
                                $any_changed++;
                        
                        if (update_option($option, $value) ) {
                                $any_changed++;
@@ -87,26 +141,49 @@ default:
        include('admin-header.php'); ?>
 
 <div class="wrap">
        include('admin-header.php'); ?>
 
 <div class="wrap">
-  <h2><?php _e('All options'); ?></h2>
-  <form name="form" action="options.php" method="post">
+  <h2><?php _e('All Options'); ?></h2>
+  <form name="form" action="options.php" method="post" id="all-options">
   <?php wp_nonce_field('update-options') ?>
   <input type="hidden" name="action" value="update" />
   <table width="98%">
 <?php
 $options = $wpdb->get_results("SELECT * FROM $wpdb->options ORDER BY option_name");
 
   <?php wp_nonce_field('update-options') ?>
   <input type="hidden" name="action" value="update" />
   <table width="98%">
 <?php
 $options = $wpdb->get_results("SELECT * FROM $wpdb->options ORDER BY option_name");
 
-foreach ($options as $option) :
-       $value = wp_specialchars($option->option_value);
+foreach ( (array) $options as $option) :
+       $disabled = '';
+       $option->option_name = attribute_escape($option->option_name);
+       if ( is_serialized($option->option_value) ) {
+               if ( is_serialized_string($option->option_value) ) {
+                       // this is a serialized string, so we should display it
+                       $value = maybe_unserialize($option->option_value);
+                       $options_to_update[] = $option->option_name;
+                       $class = 'all-options';
+               } else {
+                       $value = 'SERIALIZED DATA';
+                       $disabled = ' disabled="disabled"';
+                       $class = 'all-options disabled';
+               }
+       } else {
+               $value = $option->option_value;
+               $options_to_update[] = $option->option_name;
+               $class = 'all-options';
+       }
        echo "
 <tr>
        <th scope='row'><label for='$option->option_name'>$option->option_name</label></th>
        echo "
 <tr>
        <th scope='row'><label for='$option->option_name'>$option->option_name</label></th>
-       <td><input type='text' name='$option->option_name' id='$option->option_name' size='30' value='" . $value . "' /></td>
+<td>";
+
+       if (strpos($value, "\n") !== false) echo "<textarea class='$class' name='$option->option_name' id='$option->option_name' cols='30' rows='5'>" . wp_specialchars($value) . "</textarea>";
+       else echo "<input class='$class' type='text' name='$option->option_name' id='$option->option_name' size='30' value='" . attribute_escape($value) . "'$disabled />";
+
+       echo "</td>
        <td>$option->option_description</td>
 </tr>";
 endforeach;
 ?>
   </table>
        <td>$option->option_description</td>
 </tr>";
 endforeach;
 ?>
   </table>
-<p class="submit"><input type="submit" name="Update" value="<?php _e('Update Settings &raquo;') ?>" /></p>
+<?php $options_to_update = implode(',', $options_to_update); ?>
+<p class="submit"><input type="hidden" name="page_options" value="<?php echo $options_to_update; ?>" /><input type="submit" name="Update" value="<?php _e('Update Options &raquo;') ?>" /></p>
   </form>
 </div>
 
   </form>
 </div>
 
index 4157e8c6dc28e075a82247cadfedf2fd5947f753..70d76e1df958b301969dbc2e3aede4fe9959e782 100644 (file)
@@ -7,7 +7,7 @@ require_once('admin-header.php');
 ?>
 
 <?php if ( isset($_GET['saved']) ) : ?>
 ?>
 
 <?php if ( isset($_GET['saved']) ) : ?>
-<div id="message" class="updated fade"><p><strong><?php _e('Page saved.') ?> <a href="edit-pages.php"><?php _e('Manage pages'); ?> &raquo;</a></strong></p></div>
+<div id="message" class="updated fade"><p><strong><?php _e('Page saved.') ?></strong> <a href="edit-pages.php"><?php _e('Manage pages'); ?></a> | <a href="<?php echo get_page_link( $_GET['saved'] ); ?>"><?php _e('View page'); ?> &raquo;</a></p></div>
 <?php endif; ?>
 
 <?php
 <?php endif; ?>
 
 <?php
@@ -20,4 +20,4 @@ if ( current_user_can('edit_pages') ) {
 }
 ?>
 
 }
 ?>
 
-<?php include('admin-footer.php'); ?> 
\ No newline at end of file
+<?php include('admin-footer.php'); ?>
index 9424b39826d87868259333f49b232547c304d5e4..21db39d01954e56b263ac62c41d23cdad082c392 100644 (file)
@@ -88,12 +88,6 @@ if (empty($plugins)) {
 <?php
        $style = '';
 
 <?php
        $style = '';
 
-       function sort_plugins($plug1, $plug2) {
-               return strnatcasecmp($plug1['Name'], $plug2['Name']);
-       }
-       
-       uksort($plugins, 'sort_plugins');
-
        foreach($plugins as $plugin_file => $plugin_data) {
                $style = ('class="alternate"' == $style|| 'class="alternate active"' == $style) ? '' : 'alternate';
 
        foreach($plugins as $plugin_file => $plugin_data) {
                $style = ('class="alternate"' == $style|| 'class="alternate active"' == $style) ? '' : 'alternate';
 
index a427d321e2f7bb9430c5b90cab200041ec16921e..44a3ea2dba1705129b211c9a9638edf6f1f3bda9 100644 (file)
@@ -48,11 +48,11 @@ case 'post':
                        break;
                }
        } else {
                        break;
                }
        } else {
-               $location = 'post.php?posted=true';
+               $location = "post.php?posted=$post_ID";
        }
 
        if ( 'static' == $_POST['post_status'] )
        }
 
        if ( 'static' == $_POST['post_status'] )
-               $location = "page-new.php?saved=true";
+               $location = "page-new.php?saved=$post_ID";
 
        if ( isset($_POST['save']) )
                $location = "post.php?action=edit&post=$post_ID";
 
        if ( isset($_POST['save']) )
                $location = "post.php?action=edit&post=$post_ID";
@@ -81,7 +81,7 @@ case 'edit':
        ?>
        <div id='preview' class='wrap'>
        <h2 id="preview-post"><?php _e('Post Preview (updated when post is saved)'); ?> <small class="quickjump"><a href="#write-post"><?php _e('edit &uarr;'); ?></a></small></h2>
        ?>
        <div id='preview' class='wrap'>
        <h2 id="preview-post"><?php _e('Post Preview (updated when post is saved)'); ?> <small class="quickjump"><a href="#write-post"><?php _e('edit &uarr;'); ?></a></small></h2>
-               <iframe src="<?php echo add_query_arg('preview', 'true', get_permalink($post->ID)); ?>" width="100%" height="600" ></iframe>
+               <iframe src="<?php echo clean_url(apply_filters('preview_post_link', add_query_arg('preview', 'true', get_permalink($post->ID)))); ?>" width="100%" height="600" ></iframe>
        </div>
        <?php
        break;
        </div>
        <?php
        break;
@@ -138,10 +138,13 @@ case 'editpost':
 
 case 'delete':
        $post_id = (isset($_GET['post']))  ? intval($_GET['post']) : intval($_POST['post_ID']);
 
 case 'delete':
        $post_id = (isset($_GET['post']))  ? intval($_GET['post']) : intval($_POST['post_ID']);
-       check_admin_referer('delete-post_' . $post_id);
 
        $post = & get_post($post_id);
 
        $post = & get_post($post_id);
-       
+       if ( 'static' == $post->post_status )
+               check_admin_referer('delete-page_' . $post_id);
+       else
+               check_admin_referer('delete-post_' . $post_id);
+
        if ( !current_user_can('edit_post', $post_id) ) 
                die( __('You are not allowed to delete this post.') );
 
        if ( !current_user_can('edit_post', $post_id) ) 
                die( __('You are not allowed to delete this post.') );
 
@@ -154,9 +157,12 @@ case 'delete':
        }
 
        $sendback = wp_get_referer();
        }
 
        $sendback = wp_get_referer();
-       if (strstr($sendback, 'post.php')) $sendback = get_settings('siteurl') .'/wp-admin/post.php';
-       elseif (strstr($sendback, 'attachments.php')) $sendback = get_settings('siteurl') .'/wp-admin/attachments.php';
-       $sendback = preg_replace('|[^a-z0-9-~+_.?#=&;,/:]|i', '', $sendback);
+       if ( 'static' == $post->post_status )
+               $sendback = get_option('siteurl') . '/wp-admin/edit-pages.php';
+       elseif ( strstr($sendback, 'post.php') )
+               $sendback = get_option('siteurl') .'/wp-admin/post.php';
+       elseif ( strstr($sendback, 'attachments.php') )
+               $sendback = get_option('siteurl') .'/wp-admin/attachments.php';
        wp_redirect($sendback);
        break;
 
        wp_redirect($sendback);
        break;
 
@@ -188,7 +194,7 @@ case 'confirmdeletecomment':
        $comment = (int) $_GET['comment'];
        $p = (int) $_GET['p'];
 
        $comment = (int) $_GET['comment'];
        $p = (int) $_GET['p'];
 
-       if ( ! $comment = get_comment($comment) )
+       if ( ! $comment = get_comment_to_edit($comment) )
                die(sprintf(__('Oops, no comment with this ID. <a href="%s">Go back</a>!'), 'edit.php'));
 
        if ( !current_user_can('edit_post', $comment->comment_post_ID) )        
                die(sprintf(__('Oops, no comment with this ID. <a href="%s">Go back</a>!'), 'edit.php'));
 
        if ( !current_user_can('edit_post', $comment->comment_post_ID) )        
@@ -335,13 +341,10 @@ case 'editedcomment':
 
        edit_comment();
 
 
        edit_comment();
 
-       $referredby = $_POST['referredby'];
-       if (!empty($referredby)) {
-               wp_redirect($referredby);
-       } else {
-               wp_redirect("edit.php?p=$comment_post_ID&c=1#comments");
-       }
-
+       $location = ( empty($_POST['referredby']) ? "edit.php?p=$comment_post_ID&c=1" : $_POST['referredby'] ) . '#comment-' . $comment_ID;
+       $location = apply_filters('comment_edit_redirect', $location, $comment_ID);
+       wp_redirect($location);
+       exit();
        break;
 
 default:
        break;
 
 default:
@@ -349,7 +352,7 @@ default:
        require_once ('./admin-header.php');
 ?>
 <?php if ( isset($_GET['posted']) ) : ?>
        require_once ('./admin-header.php');
 ?>
 <?php if ( isset($_GET['posted']) ) : ?>
-<div id="message" class="updated fade"><p><?php printf(__('Post saved. <a href="%s">View site &raquo;</a>'), get_bloginfo('home') . '/'); ?></p></div>
+<div id="message" class="updated fade"><p><strong><?php _e('Post saved.'); ?></strong> <a href="<?php echo get_permalink( $_GET['posted'] ); ?>"><?php _e('View post'); ?> &raquo;</a></p></div>
 <?php endif; ?>
 <?php
        if ( current_user_can('edit_posts') ) {
 <?php endif; ?>
 <?php
        if ( current_user_can('edit_posts') ) {
@@ -384,7 +387,7 @@ default:
 
                include('edit-form-advanced.php');
 ?>
 
                include('edit-form-advanced.php');
 ?>
-<div class="wrap">
+<div id="wp-bookmarklet" class="wrap">
 <?php echo '<h3>'.__('WordPress bookmarklet').'</h3>
 <p>'.__('Right click on the following link and choose "Add to favorites" to create a posting shortcut.').'</p>'; ?>
 <p>
 <?php echo '<h3>'.__('WordPress bookmarklet').'</h3>
 <p>'.__('Right click on the following link and choose "Add to favorites" to create a posting shortcut.').'</p>'; ?>
 <p>
index 04f2fc492c776454087580c9ac4811cd42a0badd..9f42bb2bf16cca664893bc83a81a5d8cfbd8fe05 100644 (file)
@@ -5,7 +5,7 @@ $title = __('Profile');
 
 $parent_file = 'profile.php';
 include_once('admin-header.php');
 
 $parent_file = 'profile.php';
 include_once('admin-header.php');
-$profileuser = new WP_User($user_ID);
+$profileuser = get_user_to_edit($user_ID);
 
 $bookmarklet_height= 440;
 ?>
 
 $bookmarklet_height= 440;
 ?>
index 4631ac42dc113dbafbc7240a39bc17fe489098e1..5f678046aba5b412643638a9a4559018aadcbdbd 100644 (file)
@@ -71,14 +71,17 @@ default:
 
        update_recently_edited($file);
 
 
        update_recently_edited($file);
 
-       if (!is_file($real_file))
+       if ( !is_file($real_file) ) {
                $error = true;
                $error = true;
-       
-       if (!$error) {
+       } else {
                $f = @ fopen($real_file, 'r');
                if ( $f ) {
                $f = @ fopen($real_file, 'r');
                if ( $f ) {
-                       $content = fread($f, filesize($real_file));
-                       $content = htmlspecialchars($content);
+                       if ( filesize($real_file ) > 0 ) {
+                               $content = fread($f, filesize($real_file));
+                               $content = htmlspecialchars($content);
+                       } else {
+                               $content = '';
+                       }
                } else {
                        $error = true;
                }
                } else {
                        $error = true;
                }
@@ -108,7 +111,7 @@ if ( $recents ) :
 <?php
 echo '<ol>';
 foreach ($recents as $recent) :
 <?php
 echo '<ol>';
 foreach ($recents as $recent) :
-       echo "<li><a href='templates.php?file=$recent'>" . get_file_description(basename($recent)) . "</a></li>";
+       echo "<li><a href='templates.php?file=" . attribute_escape($recent) . "'>" . wp_specialchars(get_file_description(basename($recent))) . "</a></li>";
 endforeach;
 echo '</ol>';
 endif;
 endforeach;
 echo '</ol>';
 endif;
index b2788cf3a7490bb544cda73e854a7de3f24a9c04..9aa846bfeed83daaed270682d2c2ced28fd4a9de 100644 (file)
@@ -58,11 +58,15 @@ case 'update':
                $f = fopen($real_file, 'w+');
                fwrite($f, $newcontent);
                fclose($f);
                $f = fopen($real_file, 'w+');
                fwrite($f, $newcontent);
                fclose($f);
-               wp_redirect("theme-editor.php?file=$file&theme=$theme&a=te");
+               $location = "theme-editor.php?file=$file&theme=$theme&a=te";
        } else {
        } else {
-               wp_redirect("theme-editor.php?file=$file&theme=$theme");
+               $location = "theme-editor.php?file=$file&theme=$theme";
        }
 
        }
 
+       $location = wp_kses_no_null($location);
+       $strip = array('%0d', '%0a');
+       $location = str_replace($strip, '', $location);
+       header("Location: $location");
        exit();
 
 break;
        exit();
 
 break;
@@ -97,7 +101,7 @@ default:
                $theme_name = $a_theme['Name'];
                if ($theme_name == $theme) $selected = " selected='selected'";
                else $selected = '';
                $theme_name = $a_theme['Name'];
                if ($theme_name == $theme) $selected = " selected='selected'";
                else $selected = '';
-               $theme_name = wp_specialchars($theme_name, true);
+               $theme_name = attribute_escape($theme_name);
                echo "\n\t<option value=\"$theme_name\" $selected>$theme_name</option>";
        }
 ?>
                echo "\n\t<option value=\"$theme_name\" $selected>$theme_name</option>";
        }
 ?>
index 1bcdb45a218b6d97bc00ba2adf818b38bdb15f55..9567960ed3b2a5a55cab84d0e2f565a9a3775fd2 100644 (file)
@@ -123,7 +123,8 @@ CREATE TABLE $wpdb->posts (
   post_mime_type varchar(100) NOT NULL default '',
   comment_count bigint(20) NOT NULL default '0',
   PRIMARY KEY  (ID),
   post_mime_type varchar(100) NOT NULL default '',
   comment_count bigint(20) NOT NULL default '0',
   PRIMARY KEY  (ID),
-  KEY post_name (post_name)
+  KEY post_name (post_name),
+  KEY post_status (post_status)
 );
 CREATE TABLE $wpdb->users (
   ID bigint(20) unsigned NOT NULL auto_increment,
 );
 CREATE TABLE $wpdb->users (
   ID bigint(20) unsigned NOT NULL auto_increment,
index 3c30d940a4c568e07bef1bfb4bef6549fdc9d9c3..aa459514772d6ec5383cc190b5c857927b108ff1 100644 (file)
@@ -67,7 +67,7 @@ text-align: center; border-top: 1px solid #ccc; padding-top: 1em; font-style: it
 switch($step) {
 
        case 0:
 switch($step) {
 
        case 0:
-       $goback = wp_specialchars(wp_get_referer());
+       $goback = clean_url(stripslashes(wp_get_referer()));
 ?> 
 <p><?php _e('This file upgrades you from any previous version of WordPress to the latest. It may take a while though, so be patient.'); ?></p> 
        <h2 class="step"><a href="upgrade.php?step=1&amp;backto=<?php echo $goback; ?>"><?php _e('Upgrade WordPress &raquo;'); ?></a></h2>
 ?> 
 <p><?php _e('This file upgrades you from any previous version of WordPress to the latest. It may take a while though, so be patient.'); ?></p> 
        <h2 class="step"><a href="upgrade.php?step=1&amp;backto=<?php echo $goback; ?>"><?php _e('Upgrade WordPress &raquo;'); ?></a></h2>
@@ -86,7 +86,7 @@ switch($step) {
        if ( empty( $_GET['backto'] ) )
                $backto = __get_option('home');
        else
        if ( empty( $_GET['backto'] ) )
                $backto = __get_option('home');
        else
-               $backto = wp_specialchars( $_GET['backto'] , 1 );
+               $backto = clean_url(stripslashes($_GET['backto']));
 ?> 
 <h2><?php _e('Step 1'); ?></h2> 
        <p><?php printf(__("There's actually only one step. So if you see this, you're done. <a href='%s'>Have fun</a>!"),  $backto); ?></p>
 ?> 
 <h2><?php _e('Step 1'); ?></h2> 
        <p><?php printf(__("There's actually only one step. So if you see this, you're done. <a href='%s'>Have fun</a>!"),  $backto); ?></p>
index ac6d4d6e7ec97d38c76c6853237ddeb8b410bc02..1d5975872e977a8eb83282f7c9c88ec8b5f1be81 100644 (file)
@@ -21,6 +21,11 @@ for ($i=0; $i<count($wpvarstoreset); $i += 1) {
        }
 }
 
        }
 }
 
+$user_id = (int) $user_id;
+
+if ( !$user_id )
+       die(__('Invalid user ID.'));
+
 switch ($action) {
 case 'switchposts':
 
 switch ($action) {
 case 'switchposts':
 
@@ -37,7 +42,7 @@ check_admin_referer('update-user_' . $user_id);
 $errors = array();
 
 if (!current_user_can('edit_users'))
 $errors = array();
 
 if (!current_user_can('edit_users'))
-       $errors['head'] = __('You do not have permission to edit this user.');
+       die(__('You do not have permission to edit this user.'));
 else
        $errors = edit_user($user_id);
 
 else
        $errors = edit_user($user_id);
 
@@ -49,9 +54,11 @@ if(count($errors) == 0) {
 default:
 include ('admin-header.php');
 
 default:
 include ('admin-header.php');
 
-$profileuser = new WP_User($user_id);
+$profileuser = get_user_to_edit($user_id);
+
+if (!current_user_can('edit_users')) 
+       die__('You do not have permission to edit this user.');
 
 
-if (!current_user_can('edit_users')) $errors['head'] = __('You do not have permission to edit this user.');
 ?>
 
 <?php if ( isset($_GET['updated']) ) : ?>
 ?>
 
 <?php if ( isset($_GET['updated']) ) : ?>
@@ -105,7 +112,7 @@ echo '</select>';
 <p><label><?php _e('Nickname:') ?><br />
 <input type="text" name="nickname" value="<?php echo $profileuser->nickname ?>" /></label></p>
 
 <p><label><?php _e('Nickname:') ?><br />
 <input type="text" name="nickname" value="<?php echo $profileuser->nickname ?>" /></label></p>
 
-</p><label><?php _e('Display name publicly as:') ?> <br />
+<p><label><?php _e('Display name publicly as:') ?> <br />
 <select name="display_name">
 <option value="<?php echo $profileuser->display_name; ?>"><?php echo $profileuser->display_name; ?></option>
 <option value="<?php echo $profileuser->nickname ?>"><?php echo $profileuser->nickname ?></option>
 <select name="display_name">
 <option value="<?php echo $profileuser->display_name; ?>"><?php echo $profileuser->display_name; ?></option>
 <option value="<?php echo $profileuser->nickname ?>"><?php echo $profileuser->nickname ?></option>
index 76a00cd443bbbd12f69a8d75264a887fcbe19c1e..fcd4fe03e8a0f3da33775ee3324dee947f27e04c 100644 (file)
@@ -15,6 +15,7 @@ case 'promote':
 
        if (empty($_POST['users'])) {
                wp_redirect('users.php');
 
        if (empty($_POST['users'])) {
                wp_redirect('users.php');
+               exit();
        }
 
        if ( !current_user_can('edit_users') )
        }
 
        if ( !current_user_can('edit_users') )
@@ -34,6 +35,7 @@ case 'promote':
        }
                
        wp_redirect('users.php?update=' . $update);
        }
                
        wp_redirect('users.php?update=' . $update);
+       exit();
 
 break;
 
 
 break;
 
@@ -43,6 +45,7 @@ case 'dodelete':
 
        if ( empty($_POST['users']) ) {
                wp_redirect('users.php');
 
        if ( empty($_POST['users']) ) {
                wp_redirect('users.php');
+               exit();
        }
 
        if ( !current_user_can('edit_users') )
        }
 
        if ( !current_user_can('edit_users') )
@@ -67,15 +70,17 @@ case 'dodelete':
        }
 
        wp_redirect('users.php?update=' . $update);
        }
 
        wp_redirect('users.php?update=' . $update);
-
+       exit();
 break;
 
 case 'delete':
 
        check_admin_referer('bulk-users');
 
 break;
 
 case 'delete':
 
        check_admin_referer('bulk-users');
 
-       if ( empty($_POST['users']) )
+       if ( empty($_POST['users']) ) {
                wp_redirect('users.php');
                wp_redirect('users.php');
+               exit();
+       }
 
        if ( !current_user_can('edit_users') )
                $error['edit_users'] = __('You can&#8217;t delete users.');
 
        if ( !current_user_can('edit_users') )
                $error['edit_users'] = __('You can&#8217;t delete users.');
@@ -135,9 +140,9 @@ case 'adduser':
        
        $errors = add_user();
        
        
        $errors = add_user();
        
-       if(count($errors) == 0) {
+       if ( count($errors) == 0 ) {
                wp_redirect('users.php?update=add');
                wp_redirect('users.php?update=add');
-               die();
+               exit();
        }
 
 default:
        }
 
 default:
@@ -206,7 +211,7 @@ default:
   <table cellpadding="3" cellspacing="3" width="100%">
        <?php
        foreach($roleclasses as $role => $roleclass) {
   <table cellpadding="3" cellspacing="3" width="100%">
        <?php
        foreach($roleclasses as $role => $roleclass) {
-               ksort($roleclass);
+               uksort($roleclass, "strnatcasecmp");
                ?>
 
        <tr>
                ?>
 
        <tr>
index abc8959a3af10307021ff242221dfb8f1f87e919..fcfdbdff1cee3d592f965c365b74b4e432826068 100644 (file)
@@ -357,6 +357,14 @@ table .vers, table .name {
        text-align: center;
 }
 
        text-align: center;
 }
 
+textarea.all-options, input.all-options {
+       width: 250px;
+}
+
+input.disabled, textarea.disabled {
+       background: #ccc;
+}
+
 #adminmenu {
        background: #6da6d1;
        border-top: 3px solid #448abd;
 #adminmenu {
        background: #6da6d1;
        border-top: 3px solid #448abd;
@@ -880,7 +888,7 @@ table .vers, table .name {
        background: #2685af url(images/box-head-right.gif) no-repeat top right;
 }
 
        background: #2685af url(images/box-head-right.gif) no-repeat top right;
 }
 
-#advancedstuff div.dbx-handle-wrapper {
+#advancedstuff div.dbx-h-andle-wrapper {
        margin: 0 0 0 -7px;
        background: #fff url(images/box-head-left.gif) no-repeat top left;
 }
        margin: 0 0 0 -7px;
        background: #fff url(images/box-head-left.gif) no-repeat top left;
 }
@@ -896,7 +904,7 @@ table .vers, table .name {
        padding-right: 17px;
 }
 
        padding-right: 17px;
 }
 
-#advancedstuff div.dbx-content-wrapper {
+#advancedstuff div.dbx-c-ontent-wrapper {
        margin-left: -7px;
        margin-right: 0;
        background: url(images/box-bg-left.gif) repeat-y left;
        margin-left: -7px;
        margin-right: 0;
        background: url(images/box-bg-left.gif) repeat-y left;
@@ -908,11 +916,11 @@ table .vers, table .name {
        background: url(images/box-butt-right.gif) no-repeat bottom right;
 }
 
        background: url(images/box-butt-right.gif) no-repeat bottom right;
 }
 
-#advancedstuff div.dbx-box-wrapper {
+#advancedstuff div.dbx-b-ox-wrapper {
        background: url(images/box-butt-left.gif) no-repeat bottom left;
 }
 
        background: url(images/box-butt-left.gif) no-repeat bottom left;
 }
 
-#advancedstuff .dbx-box-closed div.dbx-content-wrapper {
+#advancedstuff .dbx-box-closed div.dbx-c-ontent-wrapper {
        padding-bottom: 2px;
        background: url(images/box-butt-left.gif) no-repeat bottom left;
 }
        padding-bottom: 2px;
        background: url(images/box-butt-left.gif) no-repeat bottom left;
 }
index 3be6142c62a3ab501f24b2023f41125cdfbf142b..47926c12b873721b3c890d7a69a67a167742563b 100644 (file)
@@ -25,14 +25,20 @@ $comment_content      = trim($_POST['comment']);
 
 // If the user is logged in
 $user = wp_get_current_user();
 
 // If the user is logged in
 $user = wp_get_current_user();
-if ( $user->ID ) :
+if ( $user->ID ) {
        $comment_author       = $wpdb->escape($user->display_name);
        $comment_author_email = $wpdb->escape($user->user_email);
        $comment_author_url   = $wpdb->escape($user->user_url);
        $comment_author       = $wpdb->escape($user->display_name);
        $comment_author_email = $wpdb->escape($user->user_email);
        $comment_author_url   = $wpdb->escape($user->user_url);
-else :
+       if ( current_user_can('unfiltered_html') ) {
+               if ( wp_create_nonce('unfiltered-html-comment_' . $comment_post_ID) != $_POST['_wp_unfiltered_html_comment'] ) {
+                       kses_remove_filters(); // start with a clean slate
+                       kses_init_filters(); // set up the filters
+               }
+       }
+} else {
        if ( get_option('comment_registration') )
                die( __('Sorry, you must be logged in to post a comment.') );
        if ( get_option('comment_registration') )
                die( __('Sorry, you must be logged in to post a comment.') );
-endif;
+}
 
 $comment_type = '';
 
 
 $comment_type = '';
 
@@ -57,8 +63,9 @@ if ( !$user->ID ) :
        setcookie('comment_author_url_' . COOKIEHASH, clean_url($comment->comment_author_url), time() + 30000000, COOKIEPATH, COOKIE_DOMAIN);
 endif;
 
        setcookie('comment_author_url_' . COOKIEHASH, clean_url($comment->comment_author_url), time() + 30000000, COOKIEPATH, COOKIE_DOMAIN);
 endif;
 
-$location = ( empty( $_POST['redirect_to'] ) ) ? get_permalink( $comment_post_ID ) : $_POST['redirect_to']; 
+$location = ( empty($_POST['redirect_to']) ? get_permalink($comment_post_ID) : $_POST['redirect_to'] ) . '#comment-' . $comment_id;
+$location = apply_filters('comment_post_redirect', $location, $comment);
 
 
-wp_redirect( $location );
+wp_redirect($location);
 
 ?>
 
 ?>
diff --git a/wp-content/plugins/akismet/akismet.gif b/wp-content/plugins/akismet/akismet.gif
new file mode 100644 (file)
index 0000000..0b93a89
Binary files /dev/null and b/wp-content/plugins/akismet/akismet.gif differ
index 8d8997aba62e73a54e06c4156b9c441722672b1d..53e9a9fff5eea0e78bebbcc4da0346f8e8819535 100644 (file)
 /*
 Plugin Name: Akismet
 Plugin URI: http://akismet.com/
 /*
 Plugin Name: Akismet
 Plugin URI: http://akismet.com/
-Description: Akismet checks your comments against the Akismet web serivce to see if they look like spam or not. You need a <a href="http://wordpress.com/api-keys/">WordPress.com API key</a> to use this service. You can review the spam it catches under "Manage" and it automatically deletes old spam after 15 days. Hat tip: <a href="http://ioerror.us/">Michael Hampton</a> and <a href="http://chrisjdavis.org/">Chris J. Davis</a> for help with the plugin.
+Description: Akismet checks your comments against the Akismet web service to see if they look like spam or not. You need a <a href="http://wordpress.com/api-keys/">WordPress.com API key</a> to use it. You can review the spam it catches under "Comments." To show off your Akismet stats just put <code>&lt;?php akismet_counter(); ?></code> in your template.
+Version: 2.0.2
 Author: Matt Mullenweg
 Author: Matt Mullenweg
-Version: 1.15
 Author URI: http://photomatt.net/
 */
 
 Author URI: http://photomatt.net/
 */
 
-add_action('admin_menu', 'ksd_config_page');
+// If you hardcode a WP.com API key here, all key config screens will be hidden
+$wpcom_api_key = '';
 
 
-if ( ! function_exists('wp_nonce_field') ) {
-       function akismet_nonce_field($action = -1) {
-               return; 
-       }
+function akismet_init() {
+       global $wpcom_api_key, $akismet_api_host, $akismet_api_port;
+
+       if ( $wpcom_api_key )
+               $akismet_api_host = $wpcom_api_key . '.rest.akismet.com';
+       else
+               $akismet_api_host = get_option('wordpress_api_key') . '.rest.akismet.com';
+
+       $akismet_api_port = 80;
+       add_action('admin_menu', 'akismet_config_page');
+}
+add_action('init', 'akismet_init');
+
+if ( !function_exists('wp_nonce_field') ) {
+       function akismet_nonce_field($action = -1) { return; }
        $akismet_nonce = -1;
 } else {
        $akismet_nonce = -1;
 } else {
-       function akismet_nonce_field($action = -1) {
-               return wp_nonce_field($action);
-       }
+       function akismet_nonce_field($action = -1) { return wp_nonce_field($action); }
        $akismet_nonce = 'akismet-update-key';
 }
 
        $akismet_nonce = 'akismet-update-key';
 }
 
-function ksd_config_page() {
-       global $wpdb;
+function akismet_config_page() {
        if ( function_exists('add_submenu_page') )
        if ( function_exists('add_submenu_page') )
-               add_submenu_page('plugins.php', __('Akismet Configuration'), __('Akismet Configuration'), 'manage_options', __FILE__, 'akismet_conf');
+               add_submenu_page('plugins.php', __('Akismet Configuration'), __('Akismet Configuration'), 'manage_options', 'akismet-key-config', 'akismet_conf');
 }
 
 function akismet_conf() {
 }
 
 function akismet_conf() {
-       global $akismet_nonce;
+       global $akismet_nonce, $wpcom_api_key;
+
        if ( isset($_POST['submit']) ) {
        if ( isset($_POST['submit']) ) {
-               if ( !current_user_can('manage_options') )
+               if ( function_exists('current_user_can') && !current_user_can('manage_options') )
                        die(__('Cheatin&#8217; uh?'));
 
                        die(__('Cheatin&#8217; uh?'));
 
-               check_admin_referer($akismet_nonce);
-               $key = preg_replace('/[^a-h0-9]/i', '', $_POST['key']);
-               if ( akismet_verify_key( $key ) )
+               check_admin_referer( $akismet_nonce );
+               $key = preg_replace( '/[^a-h0-9]/i', '', $_POST['key'] );
+
+               if ( empty($key) ) {
+                       $key_status = 'empty';
+                       $ms[] = 'new_key_empty';
+                       delete_option('wordpress_api_key');
+               } else {
+                       $key_status = akismet_verify_key( $key );
+               }
+
+               if ( $key_status == 'valid' ) {
                        update_option('wordpress_api_key', $key);
                        update_option('wordpress_api_key', $key);
+                       $ms[] = 'new_key_valid';
+               } else if ( $key_status == 'invalid' ) {
+                       $ms[] = 'new_key_invalid';
+               } else if ( $key_status == 'failed' ) {
+                       $ms[] = 'new_key_failed';
+               }
+
+               if ( isset( $_POST['akismet_discard_month'] ) )
+                       update_option( 'akismet_discard_month', 'true' );
                else
                else
-                       $invalid_key = true;
+                       update_option( 'akismet_discard_month', 'false' );
        }
        }
-       if ( !akismet_verify_key( get_option('wordpress_api_key') ) )
-               $invalid_key = true;
-?>
 
 
+       if ( $key_status != 'valid' ) {
+               $key = get_option('wordpress_api_key');
+               if ( empty( $key ) ) {
+                       if ( $key_status != 'failed' ) {
+                               if ( akismet_verify_key( '1234567890ab' ) == 'failed' )
+                                       $ms[] = 'no_connection';
+                               else
+                                       $ms[] = 'key_empty';
+                       }
+                       $key_status = 'empty';
+               } else {
+                       $key_status = akismet_verify_key( $key );
+               }
+               if ( $key_status == 'valid' ) {
+                       $ms[] = 'key_valid';
+               } else if ( $key_status == 'invalid' ) {
+                       delete_option('wordpress_api_key');
+                       $ms[] = 'key_empty';
+               } else if ( !empty($key) && $key_status == 'failed' ) {
+                       $ms[] = 'key_failed';
+               }
+       }
+
+       $messages = array(
+               'new_key_empty' => array('color' => 'aa0', 'text' => __('Your key has been cleared.')),
+               'new_key_valid' => array('color' => '2d2', 'text' => __('Your key has been verified. Happy blogging!')),
+               'new_key_invalid' => array('color' => 'd22', 'text' => __('The key you entered is invalid. Please double-check it.')),
+               'new_key_failed' => array('color' => 'd22', 'text' => __('The key you entered could not be verified because a connection to akismet.com could not be established. Please check your server configuration.')),
+               'no_connection' => array('color' => 'd22', 'text' => __('There was a problem connecting to the Akismet server. Please check your server configuration.')),
+               'key_empty' => array('color' => 'aa0', 'text' => sprintf(__('Please enter an API key. (<a href="%s" style="color:#fff">Get your key.</a>)'), 'http://wordpress.com/profile/')),
+               'key_valid' => array('color' => '2d2', 'text' => __('This key is valid.')),
+               'key_failed' => array('color' => 'aa0', 'text' => __('The key below was previously validated but a connection to akismet.com can not be established at this time. Please check your server configuration.')));
+?>
+<?php if ( !empty($_POST ) ) : ?>
+<div id="message" class="updated fade"><p><strong><?php _e('Options saved.') ?></strong></p></div>
+<?php endif; ?>
 <div class="wrap">
 <h2><?php _e('Akismet Configuration'); ?></h2>
 <div class="wrap">
 <h2><?php _e('Akismet Configuration'); ?></h2>
+<div class="narrow">
+<form action="" method="post" id="akismet-conf" style="margin: auto; width: 400px; ">
+<?php if ( !$wpcom_api_key ) { ?>
        <p><?php printf(__('For many people, <a href="%1$s">Akismet</a> will greatly reduce or even completely eliminate the comment and trackback spam you get on your site. If one does happen to get through, simply mark it as "spam" on the moderation screen and Akismet will learn from the mistakes. If you don\'t have a WordPress.com account yet, you can get one at <a href="%2$s">WordPress.com</a>.'), 'http://akismet.com/', 'http://wordpress.com/api-keys/'); ?></p>
 
        <p><?php printf(__('For many people, <a href="%1$s">Akismet</a> will greatly reduce or even completely eliminate the comment and trackback spam you get on your site. If one does happen to get through, simply mark it as "spam" on the moderation screen and Akismet will learn from the mistakes. If you don\'t have a WordPress.com account yet, you can get one at <a href="%2$s">WordPress.com</a>.'), 'http://akismet.com/', 'http://wordpress.com/api-keys/'); ?></p>
 
-<form action="" method="post" id="akismet-conf" style="margin: auto; width: 25em; ">
 <?php akismet_nonce_field($akismet_nonce) ?>
 <h3><label for="key"><?php _e('WordPress.com API Key'); ?></label></h3>
 <?php akismet_nonce_field($akismet_nonce) ?>
 <h3><label for="key"><?php _e('WordPress.com API Key'); ?></label></h3>
+<?php foreach ( $ms as $m ) : ?>
+       <p style="padding: .5em; background-color: #<?php echo $messages[$m]['color']; ?>; color: #fff; font-weight: bold;"><?php echo $messages[$m]['text']; ?></p>
+<?php endforeach; ?>
+<p><input id="key" name="key" type="text" size="15" maxlength="12" value="<?php echo get_option('wordpress_api_key'); ?>" style="font-family: 'Courier New', Courier, mono; font-size: 1.5em;" /> (<?php _e('<a href="http://faq.wordpress.com/2005/10/19/api-key/">What is this?</a>'); ?>)</p>
 <?php if ( $invalid_key ) { ?>
 <?php if ( $invalid_key ) { ?>
-       <p style="padding: .5em; background-color: #f33; color: #fff; font-weight: bold;"><?php _e('Your key appears invalid. Double-check it.'); ?></p>
+<h3><?php _e('Why might my key be invalid?'); ?></h3>
+<p><?php _e('This can mean one of two things, either you copied the key wrong or that the plugin is unable to reach the Akismet servers, which is most often caused by an issue with your web host around firewalls or similar.'); ?></p>
 <?php } ?>
 <?php } ?>
-<p><input id="key" name="key" type="text" size="15" maxlength="12" value="<?php echo get_option('wordpress_api_key'); ?>" style="font-family: 'Courier New', Courier, mono; font-size: 1.5em;" /> (<?php _e('<a href="http://faq.wordpress.com/2005/10/19/api-key/">What is this?</a>'); ?>)</p>
-       <p class="submit"><input type="submit" name="submit" value="<?php _e('Update API Key &raquo;'); ?>" /></p>
+<?php } ?>
+<p><label><input name="akismet_discard_month" id="akismet_discard_month" value="true" type="checkbox" <?php if ( get_option('akismet_discard_month') == 'true' ) echo ' checked="checked" '; ?> /> <?php _e('Automatically discard spam comments on posts older than a month.'); ?></label></p>
+       <p class="submit"><input type="submit" name="submit" value="<?php _e('Update options &raquo;'); ?>" /></p>
 </form>
 </div>
 </form>
 </div>
+</div>
 <?php
 }
 
 function akismet_verify_key( $key ) {
 <?php
 }
 
 function akismet_verify_key( $key ) {
-       global $auto_comment_approved, $ksd_api_host, $ksd_api_port;
+       global $akismet_api_host, $akismet_api_port, $wpcom_api_key;
        $blog = urlencode( get_option('home') );
        $blog = urlencode( get_option('home') );
-       $response = ksd_http_post("key=$key&blog=$blog", 'rest.akismet.com', '/1.1/verify-key', $ksd_api_port);
-       if ( 'valid' == $response[1] )
-               return true;
-       else
-               return false;
+       if ( $wpcom_api_key )
+               $key = $wpcom_api_key;
+       $response = akismet_http_post("key=$key&blog=$blog", 'rest.akismet.com', '/1.1/verify-key', $akismet_api_port);
+       if ( !is_array($response) || !isset($response[1]) || $response[1] != 'valid' && $response[1] != 'invalid' )
+               return 'failed';
+       return $response[1];
 }
 
 }
 
-if ( !get_option('wordpress_api_key') && !isset($_POST['submit']) ) {
+if ( !get_option('wordpress_api_key') && !$wpcom_api_key && !isset($_POST['submit']) ) {
        function akismet_warning() {
        function akismet_warning() {
-       $path = plugin_basename(__FILE__);
                echo "
                echo "
-               <div id='akismet-warning' class='updated fade-ff0000'><p><strong>".__('Akismet is not active.')."</strong> ".sprintf(__('You must <a href="%1$s">enter your WordPress.com API key</a> for it to work.'), "plugins.php?page=$path")."</p></div>
+               <div id='akismet-warning' class='updated fade-ff0000'><p><strong>".__('Akismet is not active.')."</strong> ".sprintf(__('You must <a href="%1$s">enter your WordPress.com API key</a> for it to work.'), "plugins.php?page=akismet-key-config")."</p></div>
                <style type='text/css'>
                #adminmenu { margin-bottom: 5em; }
                #akismet-warning { position: absolute; top: 7em; }
                <style type='text/css'>
                #adminmenu { margin-bottom: 5em; }
                #akismet-warning { position: absolute; top: 7em; }
@@ -87,24 +157,20 @@ if ( !get_option('wordpress_api_key') && !isset($_POST['submit']) ) {
        return;
 }
 
        return;
 }
 
-$ksd_api_host = get_option('wordpress_api_key') . '.rest.akismet.com';
-$ksd_api_port = 80;
-$ksd_user_agent = "WordPress/$wp_version | Akismet/1.15";
-
-// Returns array with headers in $response[0] and entity in $response[1]
-function ksd_http_post($request, $host, $path, $port = 80) {
-       global $ksd_user_agent;
+// Returns array with headers in $response[0] and body in $response[1]
+function akismet_http_post($request, $host, $path, $port = 80) {
+       global $wp_version;
 
        $http_request  = "POST $path HTTP/1.0\r\n";
        $http_request .= "Host: $host\r\n";
 
        $http_request  = "POST $path HTTP/1.0\r\n";
        $http_request .= "Host: $host\r\n";
-       $http_request .= "Content-Type: application/x-www-form-urlencoded; charset=" . get_settings('blog_charset') . "\r\n";
+       $http_request .= "Content-Type: application/x-www-form-urlencoded; charset=" . get_option('blog_charset') . "\r\n";
        $http_request .= "Content-Length: " . strlen($request) . "\r\n";
        $http_request .= "Content-Length: " . strlen($request) . "\r\n";
-       $http_request .= "User-Agent: $ksd_user_agent\r\n";
+       $http_request .= "User-Agent: WordPress/$wp_version | Akismet/2.0\r\n";
        $http_request .= "\r\n";
        $http_request .= $request;
 
        $response = '';
        $http_request .= "\r\n";
        $http_request .= $request;
 
        $response = '';
-       if( false !== ( $fs = @fsockopen($host, $port, $errno, $errstr, 10) ) ) {
+       if( false != ( $fs = @fsockopen($host, $port, $errno, $errstr, 10) ) ) {
                fwrite($fs, $http_request);
 
                while ( !feof($fs) )
                fwrite($fs, $http_request);
 
                while ( !feof($fs) )
@@ -115,8 +181,9 @@ function ksd_http_post($request, $host, $path, $port = 80) {
        return $response;
 }
 
        return $response;
 }
 
-function ksd_auto_check_comment( $comment ) {
-       global $auto_comment_approved, $ksd_api_host, $ksd_api_port;
+function akismet_auto_check_comment( $comment ) {
+       global $akismet_api_host, $akismet_api_port;
+
        $comment['user_ip']    = preg_replace( '/[^0-9., ]/', '', $_SERVER['REMOTE_ADDR'] );
        $comment['user_agent'] = $_SERVER['HTTP_USER_AGENT'];
        $comment['referrer']   = $_SERVER['HTTP_REFERER'];
        $comment['user_ip']    = preg_replace( '/[^0-9., ]/', '', $_SERVER['REMOTE_ADDR'] );
        $comment['user_agent'] = $_SERVER['HTTP_USER_AGENT'];
        $comment['referrer']   = $_SERVER['HTTP_REFERER'];
@@ -132,10 +199,18 @@ function ksd_auto_check_comment( $comment ) {
        foreach ( $comment as $key => $data )
                $query_string .= $key . '=' . urlencode( stripslashes($data) ) . '&';
 
        foreach ( $comment as $key => $data )
                $query_string .= $key . '=' . urlencode( stripslashes($data) ) . '&';
 
-       $response = ksd_http_post($query_string, $ksd_api_host, '/1.1/comment-check', $ksd_api_port);
+       $response = akismet_http_post($query_string, $akismet_api_host, '/1.1/comment-check', $akismet_api_port);
        if ( 'true' == $response[1] ) {
        if ( 'true' == $response[1] ) {
-               $auto_comment_approved = 'spam';
+               add_filter('pre_comment_approved', create_function('$a', 'return \'spam\';'));
                update_option( 'akismet_spam_count', get_option('akismet_spam_count') + 1 );
                update_option( 'akismet_spam_count', get_option('akismet_spam_count') + 1 );
+
+               $post = get_post( $comment['comment_post_ID'] );
+               $last_updated = strtotime( $post->post_modified_gmt );
+               $diff = time() - $last_updated;
+               $diff = $diff / 86400;
+
+               if ( $post->post_type == 'post' && $diff > 30 && get_option( 'akismet_discard_month' ) == 'true' )
+                       die;
        }
        akismet_delete_old();
        return $comment;
        }
        akismet_delete_old();
        return $comment;
@@ -145,20 +220,13 @@ function akismet_delete_old() {
        global $wpdb;
        $now_gmt = current_time('mysql', 1);
        $wpdb->query("DELETE FROM $wpdb->comments WHERE DATE_SUB('$now_gmt', INTERVAL 15 DAY) > comment_date_gmt AND comment_approved = 'spam'");
        global $wpdb;
        $now_gmt = current_time('mysql', 1);
        $wpdb->query("DELETE FROM $wpdb->comments WHERE DATE_SUB('$now_gmt', INTERVAL 15 DAY) > comment_date_gmt AND comment_approved = 'spam'");
-       $n = mt_rand(1, 5);
-       if ( $n % 5 )
+       $n = mt_rand(1, 5000);
+       if ( $n == 11 ) // lucky number
                $wpdb->query("OPTIMIZE TABLE $wpdb->comments");
 }
 
                $wpdb->query("OPTIMIZE TABLE $wpdb->comments");
 }
 
-function ksd_auto_approved( $approved ) {
-       global $auto_comment_approved;
-       if ( 'spam' == $auto_comment_approved )
-               $approved = $auto_comment_approved;
-       return $approved;
-}
-
-function ksd_submit_nonspam_comment ( $comment_id ) {
-       global $wpdb, $ksd_api_host, $ksd_api_port;
+function akismet_submit_nonspam_comment ( $comment_id ) {
+       global $wpdb, $akismet_api_host, $akismet_api_port;
 
        $comment = $wpdb->get_row("SELECT * FROM $wpdb->comments WHERE comment_ID = '$comment_id'");
        if ( !$comment ) // it was deleted
 
        $comment = $wpdb->get_row("SELECT * FROM $wpdb->comments WHERE comment_ID = '$comment_id'");
        if ( !$comment ) // it was deleted
@@ -167,11 +235,11 @@ function ksd_submit_nonspam_comment ( $comment_id ) {
        $query_string = '';
        foreach ( $comment as $key => $data )
                $query_string .= $key . '=' . urlencode( stripslashes($data) ) . '&';
        $query_string = '';
        foreach ( $comment as $key => $data )
                $query_string .= $key . '=' . urlencode( stripslashes($data) ) . '&';
-       $response = ksd_http_post($query_string, $ksd_api_host, "/1.1/submit-ham", $ksd_api_port);
+       $response = akismet_http_post($query_string, $akismet_api_host, "/1.1/submit-ham", $akismet_api_port);
 }
 
 }
 
-function ksd_submit_spam_comment ( $comment_id ) {
-       global $wpdb, $ksd_api_host, $ksd_api_port;
+function akismet_submit_spam_comment ( $comment_id ) {
+       global $wpdb, $akismet_api_host, $akismet_api_port;
 
        $comment = $wpdb->get_row("SELECT * FROM $wpdb->comments WHERE comment_ID = '$comment_id'");
        if ( !$comment ) // it was deleted
 
        $comment = $wpdb->get_row("SELECT * FROM $wpdb->comments WHERE comment_ID = '$comment_id'");
        if ( !$comment ) // it was deleted
@@ -183,32 +251,38 @@ function ksd_submit_spam_comment ( $comment_id ) {
        foreach ( $comment as $key => $data )
                $query_string .= $key . '=' . urlencode( stripslashes($data) ) . '&';
 
        foreach ( $comment as $key => $data )
                $query_string .= $key . '=' . urlencode( stripslashes($data) ) . '&';
 
-       $response = ksd_http_post($query_string, $ksd_api_host, "/1.1/submit-spam", $ksd_api_port);
+       $response = akismet_http_post($query_string, $akismet_api_host, "/1.1/submit-spam", $akismet_api_port);
 }
 
 }
 
-add_action('wp_set_comment_status', 'ksd_submit_spam_comment');
-add_action('edit_comment', 'ksd_submit_spam_comment');
-add_action('preprocess_comment', 'ksd_auto_check_comment', 1);
-add_filter('pre_comment_approved', 'ksd_auto_approved');
+add_action('wp_set_comment_status', 'akismet_submit_spam_comment');
+add_action('edit_comment', 'akismet_submit_spam_comment');
+add_action('preprocess_comment', 'akismet_auto_check_comment', 1);
 
 
-
-function ksd_spam_count() {
+function akismet_spam_count() {
        global $wpdb, $comments;
        global $wpdb, $comments;
-       $count = $wpdb->get_var("SELECT COUNT(comment_ID) FROM $wpdb->comments WHERE comment_approved = 'spam'");
+       $count = wp_cache_get( 'akismet_spam_count', 'widget' );
+       if ( false === $count ) {
+               $count = $wpdb->get_var("SELECT COUNT(comment_ID) FROM $wpdb->comments WHERE comment_approved = 'spam'");
+               wp_cache_set( 'akismet_spam_count', $count, 'widget', 3600 );
+       }
        return $count;
 }
 
        return $count;
 }
 
-function ksd_manage_page() {
-       global $wpdb;
-       $count = sprintf(__('Akismet Spam (%s)'), ksd_spam_count());
-       if ( function_exists('add_management_page') )
-               add_management_page(__('Akismet Spam'), $count, 'moderate_comments', __FILE__, 'ksd_caught');
+function akismet_manage_page() {
+       global $wpdb, $submenu;
+       $count = sprintf(__('Akismet Spam (%s)'), akismet_spam_count());
+       if ( isset( $submenu['edit-comments.php'] ) )
+               add_submenu_page('edit-comments.php', __('Akismet Spam'), $count, 'moderate_comments', 'akismet-admin', 'akismet_caught' );
+       elseif ( function_exists('add_management_page') )
+               add_management_page(__('Akismet Spam'), $count, 'moderate_comments', 'akismet-admin', 'akismet_caught');
 }
 
 }
 
-function ksd_caught() {
-       global $wpdb, $comment;
+function akismet_caught() {
+       global $wpdb, $comment, $akismet_caught, $akismet_nonce;
+       akismet_recheck_queue();
        if (isset($_POST['submit']) && 'recover' == $_POST['action'] && ! empty($_POST['not_spam'])) {
        if (isset($_POST['submit']) && 'recover' == $_POST['action'] && ! empty($_POST['not_spam'])) {
-               if ( ! current_user_can('moderate_comments') )
+               check_admin_referer( $akismet_nonce );
+               if ( function_exists('current_user_can') && !current_user_can('moderate_comments') )
                        die(__('You do not have sufficient permission to moderate comments.'));
                
                $i = 0;
                        die(__('You do not have sufficient permission to moderate comments.'));
                
                $i = 0;
@@ -218,25 +292,38 @@ function ksd_caught() {
                                wp_set_comment_status($comment, 'approve');
                        else
                                $wpdb->query("UPDATE $wpdb->comments SET comment_approved = '1' WHERE comment_ID = '$comment'");
                                wp_set_comment_status($comment, 'approve');
                        else
                                $wpdb->query("UPDATE $wpdb->comments SET comment_approved = '1' WHERE comment_ID = '$comment'");
-                       ksd_submit_nonspam_comment($comment);
+                       akismet_submit_nonspam_comment($comment);
                        ++$i;
                endforeach;
                        ++$i;
                endforeach;
-               echo '<div class="updated"><p>' . sprintf(__('%1$s comments recovered.'), $i) . "</p></div>";
+               $to = add_query_arg( 'recovered', $i, $_SERVER['HTTP_REFERER'] );
+               wp_redirect( $to );
+               exit;
        }
        if ('delete' == $_POST['action']) {
        }
        if ('delete' == $_POST['action']) {
-               if ( ! current_user_can('moderate_comments') )
+               check_admin_referer( $akismet_nonce );
+               if ( function_exists('current_user_can') && !current_user_can('moderate_comments') )
                        die(__('You do not have sufficient permission to moderate comments.'));
 
                $delete_time = addslashes( $_POST['display_time'] );
                $nuked = $wpdb->query( "DELETE FROM $wpdb->comments WHERE comment_approved = 'spam' AND '$delete_time' > comment_date_gmt" );
                        die(__('You do not have sufficient permission to moderate comments.'));
 
                $delete_time = addslashes( $_POST['display_time'] );
                $nuked = $wpdb->query( "DELETE FROM $wpdb->comments WHERE comment_approved = 'spam' AND '$delete_time' > comment_date_gmt" );
-               if (isset($nuked)) {
-                       echo '<div class="updated"><p>';
-                       if ($nuked) {
-                               _e('All spam deleted.');
-                       }
-                       echo "</p></div>";
-               }
+               wp_cache_delete( 'akismet_spam_count', 'widget' );
+               $to = add_query_arg( 'deleted', 'all', $_SERVER['HTTP_REFERER'] );
+               wp_redirect( $to );
+               exit;
        }
        }
+
+if ( isset( $_GET['recovered'] ) ) {
+       $i = (int) $_GET['recovered'];
+       echo '<div class="updated"><p>' . sprintf(__('%1$s comments recovered.'), $i) . "</p></div>";
+}
+
+if (isset( $_GET['deleted'] ) )
+       echo '<div class="updated"><p>' . __('All spam deleted.') . '</p></div>';
+
+if ( isset( $GLOBALS['submenu']['edit-comments.php'] ) )
+       $link = 'edit-comments.php';
+else
+       $link = 'edit.php';
 ?>
 <div class="wrap">
 <h2><?php _e('Caught Spam') ?></h2>
 ?>
 <div class="wrap">
 <h2><?php _e('Caught Spam') ?></h2>
@@ -247,35 +334,104 @@ if ( $count ) {
 <p><?php printf(__('Akismet has caught <strong>%1$s spam</strong> for you since you first installed it.'), number_format($count) ); ?></p>
 <?php
 }
 <p><?php printf(__('Akismet has caught <strong>%1$s spam</strong> for you since you first installed it.'), number_format($count) ); ?></p>
 <?php
 }
-$spam_count = ksd_spam_count();
+$spam_count = akismet_spam_count();
 if (0 == $spam_count) {
        echo '<p>'.__('You have no spam currently in the queue. Must be your lucky day. :)').'</p>';
        echo '</div>';
 } else {
        echo '<p>'.__('You can delete all of the spam from your database with a single click. This operation cannot be undone, so you may wish to check to ensure that no legitimate comments got through first. Spam is automatically deleted after 15 days, so don&#8217;t sweat it.').'</p>';
 ?>
 if (0 == $spam_count) {
        echo '<p>'.__('You have no spam currently in the queue. Must be your lucky day. :)').'</p>';
        echo '</div>';
 } else {
        echo '<p>'.__('You can delete all of the spam from your database with a single click. This operation cannot be undone, so you may wish to check to ensure that no legitimate comments got through first. Spam is automatically deleted after 15 days, so don&#8217;t sweat it.').'</p>';
 ?>
-<form method="post" action="">
+<?php if ( !isset( $_POST['s'] ) ) { ?>
+<form method="post" action="<?php echo attribute_escape( add_query_arg( 'noheader', 'true' ) ); ?>">
+<?php akismet_nonce_field($akismet_nonce) ?>
 <input type="hidden" name="action" value="delete" />
 <?php printf(__('There are currently %1$s comments identified as spam.'), $spam_count); ?>&nbsp; &nbsp; <input type="submit" name="Submit" value="<?php _e('Delete all'); ?>" />
 <input type="hidden" name="display_time" value="<?php echo current_time('mysql', 1); ?>" />
 </form>
 <input type="hidden" name="action" value="delete" />
 <?php printf(__('There are currently %1$s comments identified as spam.'), $spam_count); ?>&nbsp; &nbsp; <input type="submit" name="Submit" value="<?php _e('Delete all'); ?>" />
 <input type="hidden" name="display_time" value="<?php echo current_time('mysql', 1); ?>" />
 </form>
+<?php } ?>
 </div>
 <div class="wrap">
 </div>
 <div class="wrap">
+<?php if ( isset( $_POST['s'] ) ) { ?>
+<h2><?php _e('Search'); ?></h2>
+<?php } else { ?>
 <h2><?php _e('Latest Spam'); ?></h2>
 <?php echo '<p>'.__('These are the latest comments identified as spam by Akismet. If you see any mistakes, simply mark the comment as "not spam" and Akismet will learn from the submission. If you wish to recover a comment from spam, simply select the comment, and click Not Spam. After 15 days we clean out the junk for you.').'</p>'; ?>
 <h2><?php _e('Latest Spam'); ?></h2>
 <?php echo '<p>'.__('These are the latest comments identified as spam by Akismet. If you see any mistakes, simply mark the comment as "not spam" and Akismet will learn from the submission. If you wish to recover a comment from spam, simply select the comment, and click Not Spam. After 15 days we clean out the junk for you.').'</p>'; ?>
+<?php } ?>
 <?php
 <?php
-$comments = $wpdb->get_results("SELECT * FROM $wpdb->comments WHERE comment_approved = 'spam' ORDER BY comment_date DESC LIMIT 150");
+if ( isset( $_POST['s'] ) ) {
+       $s = $wpdb->escape($_POST['s']);
+       $comments = $wpdb->get_results("SELECT * FROM $wpdb->comments  WHERE
+               (comment_author LIKE '%$s%' OR
+               comment_author_email LIKE '%$s%' OR
+               comment_author_url LIKE ('%$s%') OR
+               comment_author_IP LIKE ('%$s%') OR
+               comment_content LIKE ('%$s%') ) AND
+               comment_approved = 'spam'
+               ORDER BY comment_date DESC");
+} else {
+       if ( isset( $_GET['apage'] ) )
+               $page = (int) $_GET['apage'];
+       else
+               $page = 1;
+
+       if ( $page < 2 )
+               $page = 1;
+
+       $start = ( $page - 1 ) * 50;
+       $end = $start + 50;
+
+       $comments = $wpdb->get_results("SELECT * FROM $wpdb->comments WHERE comment_approved = 'spam' ORDER BY comment_date DESC LIMIT $start, $end");
+       $total = $wpdb->get_var( "SELECT COUNT(*) FROM $wpdb->comments WHERE comment_approved = 'spam'" );
+}
 
 if ($comments) {
 ?>
 
 if ($comments) {
 ?>
-<form method="post" action="<?php echo $_SERVER['REQUEST_URI']; ?>">
+
+<?php if ( $total > 50 ) {
+$total_pages = ceil( $total / 50 );
+$r = '';
+if ( 1 < $page ) {
+       $args['apage'] = ( 1 == $page - 1 ) ? '' : $page - 1;
+       $r .=  '<a class="prev" href="' . clean_url(add_query_arg( $args )) . '">&laquo; '. __('Previous Page') .'</a>' . "\n";
+}
+if ( ( $total_pages = ceil( $total / 50 ) ) > 1 ) {
+       for ( $page_num = 1; $page_num <= $total_pages; $page_num++ ) :
+               if ( $page == $page_num ) :
+                       $r .=  "<strong>$page_num</strong>\n";
+               else :
+                       $p = false;
+                       if ( $page_num < 3 || ( $page_num >= $page - 3 && $page_num <= $page + 3 ) || $page_num > $total_pages - 3 ) :
+                               $args['apage'] = ( 1 == $page_num ) ? '' : $page_num;
+                               $r .= '<a class="page-numbers" href="' . clean_url(add_query_arg($args)) . '">' . ( $page_num ) . "</a>\n";
+                               $in = true;
+                       elseif ( $in == true ) :
+                               $r .= "...\n";
+                               $in = false;
+                       endif;
+               endif;
+       endfor;
+}
+if ( ( $page ) * 50 < $total || -1 == $total ) {
+       $args['apage'] = $page + 1;
+       $r .=  '<a class="next" href="' . clean_url(add_query_arg($args)) . '">'. __('Next Page') .' &raquo;</a>' . "\n";
+}
+echo "<p>$r</p>";
+?>
+
+<?php } ?>
+<form method="post" action="<?php echo attribute_escape("$link?page=akismet-admin"); ?>" id="akismetsearch">
+<p>  <input type="text" name="s" value="<?php if (isset($_POST['s'])) echo attribute_escape($_POST['s']); ?>" size="17" /> 
+  <input type="submit" name="submit" value="<?php echo attribute_escape(__('Search')) ?>"  />  </p>
+</form>
+<form method="post" action="<?php echo attribute_escape( add_query_arg( 'noheader', 'true' ) ); ?>">
+<?php akismet_nonce_field($akismet_nonce) ?>
 <input type="hidden" name="action" value="recover" />
 <ul id="spam-list" class="commentlist" style="list-style: none; margin: 0; padding: 0;">
 <?php
 $i = 0;
 foreach($comments as $comment) {
        $i++;
 <input type="hidden" name="action" value="recover" />
 <ul id="spam-list" class="commentlist" style="list-style: none; margin: 0; padding: 0;">
 <?php
 $i = 0;
 foreach($comments as $comment) {
        $i++;
-       $comment_date = mysql2date(get_settings("date_format") . " @ " . get_settings("time_format"), $comment->comment_date);
+       $comment_date = mysql2date(get_option("date_format") . " @ " . get_option("time_format"), $comment->comment_date);
        $post = get_post($comment->comment_post_ID);
        $post_title = $post->post_title;
        if ($i % 2) $class = 'class="alternate"';
        $post = get_post($comment->comment_post_ID);
        $post_title = $post->post_title;
        if ($i % 2) $class = 'class="alternate"';
@@ -300,25 +456,64 @@ $post_title = ('' == $post_title) ? "# $comment->comment_post_ID" : $post_title;
 
 <?php
 }
 
 <?php
 }
-}
 ?>
 </ul>
 ?>
 </ul>
+<?php if ( $total > 50 ) {
+$total_pages = ceil( $total / 50 );
+$r = '';
+if ( 1 < $page ) {
+       $args['apage'] = ( 1 == $page - 1 ) ? '' : $page - 1;
+       $r .=  '<a class="prev" href="' . clean_url(add_query_arg( $args )) . '">&laquo; '. __('Previous Page') .'</a>' . "\n";
+}
+if ( ( $total_pages = ceil( $total / 50 ) ) > 1 ) {
+       for ( $page_num = 1; $page_num <= $total_pages; $page_num++ ) :
+               if ( $page == $page_num ) :
+                       $r .=  "<strong>$page_num</strong>\n";
+               else :
+                       $p = false;
+                       if ( $page_num < 3 || ( $page_num >= $page - 3 && $page_num <= $page + 3 ) || $page_num > $total_pages - 3 ) :
+                               $args['apage'] = ( 1 == $page_num ) ? '' : $page_num;
+                               $r .= '<a class="page-numbers" href="' . clean_url(add_query_arg($args)) . '">' . ( $page_num ) . "</a>\n";
+                               $in = true;
+                       elseif ( $in == true ) :
+                               $r .= "...\n";
+                               $in = false;
+                       endif;
+               endif;
+       endfor;
+}
+if ( ( $page ) * 50 < $total || -1 == $total ) {
+       $args['apage'] = $page + 1;
+       $r .=  '<a class="next" href="' . clean_url(add_query_arg($args)) . '">'. __('Next Page') .' &raquo;</a>' . "\n";
+}
+echo "<p>$r</p>";
+}
+?>
 <p class="submit"> 
 <p class="submit"> 
-<input type="submit" name="submit" value="<?php _e('De-spam marked comments &raquo;'); ?>" />
+<input type="submit" name="submit" value="<?php echo attribute_escape(__('De-spam marked comments &raquo;')); ?>" />
 </p>
 <p><?php _e('Comments you de-spam will be submitted to Akismet as mistakes so it can learn and get better.'); ?></p>
 </form>
 </p>
 <p><?php _e('Comments you de-spam will be submitted to Akismet as mistakes so it can learn and get better.'); ?></p>
 </form>
-<form method="post" action="">
+<?php
+} else {
+?>
+<p><?php _e('No results found.'); ?></p>
+<?php } ?>
+
+<?php if ( !isset( $_POST['s'] ) ) { ?>
+<form method="post" action="<?php echo attribute_escape( add_query_arg( 'noheader', 'true' ) ); ?>">
+<?php akismet_nonce_field($akismet_nonce) ?>
 <p><input type="hidden" name="action" value="delete" />
 <p><input type="hidden" name="action" value="delete" />
-<?php printf(__('There are currently %1$s comments identified as spam.'), $spam_count); ?>&nbsp; &nbsp; <input type="submit" name="Submit" value="<?php _e('Delete all'); ?>" />
+<?php printf(__('There are currently %1$s comments identified as spam.'), $spam_count); ?>&nbsp; &nbsp; <input type="submit" name="Submit" value="<?php echo attribute_escape(__('Delete all')); ?>" />
 <input type="hidden" name="display_time" value="<?php echo current_time('mysql', 1); ?>" /></p>
 </form>
 <input type="hidden" name="display_time" value="<?php echo current_time('mysql', 1); ?>" /></p>
 </form>
+<?php } ?>
 </div>
 <?php
        }
 }
 
 </div>
 <?php
        }
 }
 
-add_action('admin_menu', 'ksd_manage_page');
+add_action('admin_menu', 'akismet_manage_page');
 
 function akismet_stats() {
        $count = get_option('akismet_spam_count');
 
 function akismet_stats() {
        $count = get_option('akismet_spam_count');
@@ -326,9 +521,161 @@ function akismet_stats() {
                return;
        $path = plugin_basename(__FILE__);
        echo '<h3>'.__('Spam').'</h3>';
                return;
        $path = plugin_basename(__FILE__);
        echo '<h3>'.__('Spam').'</h3>';
-       echo '<p>'.sprintf(__('<a href="%1$s">Akismet</a> has protected your site from <a href="%2$s">%3$s spam comments</a>.'), 'http://akismet.com/', "edit.php?page=$path", number_format($count) ).'</p>';
+       global $submenu;
+       if ( isset( $submenu['edit-comments.php'] ) )
+               $link = 'edit-comments.php';
+       else
+               $link = 'edit.php';
+       echo '<p>'.sprintf(__('<a href="%1$s">Akismet</a> has protected your site from <a href="%2$s">%3$s spam comments</a>.'), 'http://akismet.com/', clean_url("$link?page=akismet-admin"), number_format($count) ).'</p>';
 }
 
 add_action('activity_box_end', 'akismet_stats');
 
 }
 
 add_action('activity_box_end', 'akismet_stats');
 
+
+if ( 'moderation.php' == $pagenow ) {
+       function akismet_recheck_button( $page ) {
+               global $submenu;
+               if ( isset( $submenu['edit-comments.php'] ) )
+                       $link = 'edit-comments.php';
+               else
+                       $link = 'edit.php';
+               $button = "<a href='$link?page=akismet-admin&amp;recheckqueue=true&amp;noheader=true' style='display: block; width: 100px; position: absolute; right: 7%; padding: 5px; font-size: 14px; text-decoration: underline; background: #fff; border: 1px solid #ccc;'>" . __('Recheck Queue for Spam') . "</a>";
+               $page = str_replace( '<div class="wrap">', '<div class="wrap">' . $button, $page );
+               return $page;
+       }
+
+       if ( $wpdb->get_var( "SELECT COUNT(*) FROM $wpdb->comments WHERE comment_approved = '0'" ) )
+               ob_start( 'akismet_recheck_button' );
+}
+
+function akismet_recheck_queue() {
+       global $wpdb, $akismet_api_host, $akismet_api_port;
+
+       if ( !isset( $_GET['recheckqueue'] ) )
+               return;
+
+       $moderation = $wpdb->get_results( "SELECT * FROM $wpdb->comments WHERE comment_approved = '0'", ARRAY_A );
+       foreach ( $moderation as $c ) {
+               $c['user_ip']    = $c['comment_author_IP'];
+               $c['user_agent'] = $c['comment_agent'];
+               $c['referrer']   = '';
+               $c['blog']       = get_option('home');
+               $id = $c['comment_ID'];
+               
+               $query_string = '';
+               foreach ( $c as $key => $data )
+               $query_string .= $key . '=' . urlencode( stripslashes($data) ) . '&';
+               
+               $response = akismet_http_post($query_string, $akismet_api_host, '/1.1/comment-check', $akismet_api_port);
+               if ( 'true' == $response[1] ) {
+                       $wpdb->query( "UPDATE $wpdb->comments SET comment_approved = 'spam' WHERE comment_ID = $id" );
+               }
+       }
+       wp_redirect( $_SERVER['HTTP_REFERER'] );
+       exit;
+}
+
+function akismet_check_db_comment( $id ) {
+       global $wpdb, $akismet_api_host, $akismet_api_port;
+
+       $id = (int) $id;
+       $c = $wpdb->get_row( "SELECT * FROM $wpdb->comments WHERE comment_ID = '$id'", ARRAY_A );
+       if ( !$c )
+               return;
+
+       $c['user_ip']    = $c['comment_author_IP'];
+       $c['user_agent'] = $c['comment_agent'];
+       $c['referrer']   = '';
+       $c['blog']       = get_option('home');
+       $id = $c['comment_ID'];
+       
+       $query_string = '';
+       foreach ( $c as $key => $data )
+       $query_string .= $key . '=' . urlencode( stripslashes($data) ) . '&';
+       
+       $response = akismet_http_post($query_string, $akismet_api_host, '/1.1/comment-check', $akismet_api_port);
+       return $response[1];
+}
+
+// This option causes tons of FPs, was removed in 2.1
+function akismet_kill_proxy_check( $option ) { return 0; }
+add_filter('option_open_proxy_check', 'akismet_kill_proxy_check');
+
+// Widget stuff
+function widget_akismet_register() {
+       if ( function_exists('register_sidebar_widget') ) :
+       function widget_akismet($args) {
+               extract($args);
+               $options = get_option('widget_akismet');
+               $count = number_format(get_option('akismet_spam_count'));
+               $text = __('%d spam comments have been blocked by <a href="http://akismet.com">Akismet</a>.');
+               ?>
+                       <?php echo $before_widget; ?>
+                               <?php echo $before_title . $options['title'] . $after_title; ?>
+                               <div id="akismetwrap"><div id="akismetstats"><a id="aka" href="http://akismet.com" title=""><?php printf( __( '%1$s %2$sspam comments%3$s %4$sblocked by%5$s<br />%6$sAkismet%7$s' ), '<div id="akismet1"><span id="akismetcount">' . $count . '</span>', '<span id="akismetsc">', '</span></div>', '<div id="akismet2"><span id="akismetbb">', '</span>', '<span id="akismeta">', '</span></div>' ); ?></a></div></div>
+                       <?php echo $after_widget; ?>
+       <?php
+       }
+       
+       function widget_akismet_style() {
+               ?>
+<style type="text/css">
+#aka,#aka:link,#aka:hover,#aka:visited,#aka:active{color:#fff;text-decoration:none}
+#aka:hover{border:none;text-decoration:none}
+#aka:hover #akismet1{display:none}
+#aka:hover #akismet2,#akismet1{display:block}
+#akismet2{display:none;padding-top:2px}
+#akismeta{font-size:16px;font-weight:bold;line-height:18px;text-decoration:none}
+#akismetcount{display:block;font:15px Verdana,Arial,Sans-Serif;font-weight:bold;text-decoration:none}
+#akismetwrap #akismetstats{background:url(<?php echo get_option('siteurl'); ?>/wp-content/plugins/akismet/akismet.gif) no-repeat top left;border:none;color:#fff;font:11px 'Trebuchet MS','Myriad Pro',sans-serif;height:40px;line-height:100%;overflow:hidden;padding:8px 0 0;text-align:center;width:120px}
+</style>
+               <?php
+       }
+
+       function widget_akismet_control() {
+               $options = $newoptions = get_option('widget_akismet');
+               if ( $_POST["akismet-submit"] ) {
+                       $newoptions['title'] = strip_tags(stripslashes($_POST["akismet-title"]));
+                       if ( empty($newoptions['title']) ) $newoptions['title'] = 'Spam Blocked';
+               }
+               if ( $options != $newoptions ) {
+                       $options = $newoptions;
+                       update_option('widget_akismet', $options);
+               }
+               $title = htmlspecialchars($options['title'], ENT_QUOTES);
+       ?>
+                               <p><label for="akismet-title"><?php _e('Title:'); ?> <input style="width: 250px;" id="akismet-title" name="akismet-title" type="text" value="<?php echo $title; ?>" /></label></p>
+                               <input type="hidden" id="akismet-submit" name="akismet-submit" value="1" />
+       <?php
+       }
+
+       register_sidebar_widget('Akismet', 'widget_akismet', null, 'akismet');
+       register_widget_control('Akismet', 'widget_akismet_control', 300, 75, 'akismet');
+       if ( is_active_widget('widget_akismet') )
+               add_action('wp_head', 'widget_akismet_style');
+       endif;
+}
+
+add_action('init', 'widget_akismet_register');
+
+// Counter for non-widget users
+function akismet_counter() {
+?>
+<style type="text/css">
+#akismetwrap #aka,#aka:link,#aka:hover,#aka:visited,#aka:active{color:#fff;text-decoration:none}
+#aka:hover{border:none;text-decoration:none}
+#aka:hover #akismet1{display:none}
+#aka:hover #akismet2,#akismet1{display:block}
+#akismet2{display:none;padding-top:2px}
+#akismeta{font-size:16px;font-weight:bold;line-height:18px;text-decoration:none}
+#akismetcount{display:block;font:15px Verdana,Arial,Sans-Serif;font-weight:bold;text-decoration:none}
+#akismetwrap #akismetstats{background:url(<?php echo get_option('siteurl'); ?>/wp-content/plugins/akismet/akismet.gif) no-repeat top left;border:none;color:#fff;font:11px 'Trebuchet MS','Myriad Pro',sans-serif;height:40px;line-height:100%;overflow:hidden;padding:8px 0 0;text-align:center;width:120px}
+</style>
+<?php
+$count = number_format(get_option('akismet_spam_count'));
+?>
+<div id="akismetwrap"><div id="akismetstats"><a id="aka" href="http://akismet.com" title=""><div id="akismet1"><span id="akismetcount"><?php echo $count; ?></span> <span id="akismetsc"><?php _e('spam comments') ?></span></div> <div id="akismet2"><span id="akismetbb"><?php _e('blocked by') ?></span><br /><span id="akismeta">Akismet</span></div></a></div></div>
+<?php
+}
+
 ?>
 ?>
index 4c92a7f608b634d22892cd5d1e3b3bfe4d141f25..2a6974c8e5f4a2f8f04f9a54ae37cff241143439 100644 (file)
@@ -4,7 +4,7 @@ Plugin Name: WordPress Database Backup
 Plugin URI: http://www.skippy.net/blog/plugins/
 Description: On-demand backup of your WordPress database.
 Author: Scott Merrill
 Plugin URI: http://www.skippy.net/blog/plugins/
 Description: On-demand backup of your WordPress database.
 Author: Scott Merrill
-Version: 1.7
+Version: 1.8
 Author URI: http://www.skippy.net/
 
 Much of this was modified from Mark Ghosh's One Click Backup, which
 Author URI: http://www.skippy.net/
 
 Much of this was modified from Mark Ghosh's One Click Backup, which
@@ -69,7 +69,8 @@ class wpdbBackup {
                        $via = isset($_GET['via']) ? $_GET['via'] : 'http';
                        
                        $this->backup_file = $_GET['backup'];
                        $via = isset($_GET['via']) ? $_GET['via'] : 'http';
                        
                        $this->backup_file = $_GET['backup'];
-                       
+                       $this->validate_file($this->backup_file);
+
                        switch($via) {
                        case 'smtp':
                        case 'email':
                        switch($via) {
                        case 'smtp':
                        case 'email':
@@ -95,6 +96,7 @@ class wpdbBackup {
                }
                if (isset($_GET['fragment'] )) {
                        list($table, $segment, $filename) = explode(':', $_GET['fragment']);
                }
                if (isset($_GET['fragment'] )) {
                        list($table, $segment, $filename) = explode(':', $_GET['fragment']);
+                       $this->validate_file($filename);
                        $this->backup_fragment($table, $segment, $filename);
                }
 
                        $this->backup_fragment($table, $segment, $filename);
                }
 
@@ -881,6 +883,18 @@ class wpdbBackup {
                
                return;
        } // wp_cron_db_backup
                
                return;
        } // wp_cron_db_backup
+
+       function validate_file($file) {
+               if (false !== strpos($file, '..'))
+                       die(__("Cheatin' uh ?"));
+
+               if (false !== strpos($file, './'))
+                       die(__("Cheatin' uh ?"));
+
+               if (':' == substr($file, 1, 1))
+                       die(__("Cheatin' uh ?"));
+       }
+
 }
 
 function wpdbBackup_init() {
 }
 
 function wpdbBackup_init() {
index 0969e730c36404635d548b6c8cd4e152aef1b78e..ef49d42d0b08de84d0fcb300597a659d75646c6e 100644 (file)
@@ -60,7 +60,7 @@ if (!empty($commentstatus->post_password) && $_COOKIE['wp-postpass_'. COOKIEHASH
          <input type="text" name="author" id="author" class="textarea" value="<?php echo $comment_author; ?>" size="28" tabindex="1" />
           <label for="author"><?php _e("Name"); ?></label>
        <input type="hidden" name="comment_post_ID" value="<?php echo $id; ?>" />
          <input type="text" name="author" id="author" class="textarea" value="<?php echo $comment_author; ?>" size="28" tabindex="1" />
           <label for="author"><?php _e("Name"); ?></label>
        <input type="hidden" name="comment_post_ID" value="<?php echo $id; ?>" />
-       <input type="hidden" name="redirect_to" value="<?php echo wp_specialchars($_SERVER["REQUEST_URI"]); ?>" />
+       <input type="hidden" name="redirect_to" value="<?php echo attribute_escape($_SERVER["REQUEST_URI"]); ?>" />
        </p>
 
        <p>
        </p>
 
        <p>
index 46dee78461e77c68e01ff9521f41f4ae38a2833e..6788dee90c35771bba48e2441d12d7b2145f10fe 100644 (file)
@@ -12,7 +12,7 @@
  </li>
  <li id="search">
    <label for="s"><?php _e('Search:'); ?></label>      
  </li>
  <li id="search">
    <label for="s"><?php _e('Search:'); ?></label>      
-   <form id="searchform" method="get" action="<?php echo $_SERVER['PHP_SELF']; ?>">
+   <form id="searchform" method="get" action="<?php bloginfo('home'); ?>">
        <div>
                <input type="text" name="s" id="s" size="15" /><br />
                <input type="submit" value="<?php _e('Search'); ?>" />
        <div>
                <input type="text" name="s" id="s" size="15" /><br />
                <input type="submit" value="<?php _e('Search'); ?>" />
index 3cd58a66285ff58e5460e578c062329b4a212318..063a39182d348293d434aef72f867389b25ec0a9 100644 (file)
@@ -60,7 +60,7 @@ if (!empty($post->post_password) && $_COOKIE['wp-postpass_'. COOKIEHASH] != $pos
          <input type="text" name="author" id="author" class="textarea" value="<?php echo $comment_author; ?>" size="28" tabindex="1" />
           <label for="author">Name</label>
        <input type="hidden" name="comment_post_ID" value="<?php echo $id; ?>" />
          <input type="text" name="author" id="author" class="textarea" value="<?php echo $comment_author; ?>" size="28" tabindex="1" />
           <label for="author">Name</label>
        <input type="hidden" name="comment_post_ID" value="<?php echo $id; ?>" />
-       <input type="hidden" name="redirect_to" value="<?php echo wp_specialchars($_SERVER["REQUEST_URI"]); ?>" />
+       <input type="hidden" name="redirect_to" value="<?php echo attribute_escape($_SERVER["REQUEST_URI"]); ?>" />
        </p>
 
        <p>
        </p>
 
        <p>
index b2c78f656d67dd2521283f4ecd4b66945bfe4ff0..5f10d7f9135484a540c110ed7a33f6b7a9767bf9 100644 (file)
-<?php\r
-\r
-function kubrick_head() {\r
-       $head = "<style type='text/css'>\n<!--";\r
-       $output = '';\r
-       if ( kubrick_header_image() ) {\r
-               $url =  kubrick_header_image_url() ;\r
-               $output .= "#header { background: url('$url') no-repeat bottom center; }\n";\r
-       }\r
-       if ( false !== ( $color = kubrick_header_color() ) ) {\r
-               $output .= "#headerimg h1 a, #headerimg h1 a:visited, #headerimg .description { color: $color; }\n";\r
-       }\r
-       if ( false !== ( $display = kubrick_header_display() ) ) {\r
-               $output .= "#headerimg { display: $display }\n";\r
-       }\r
-       $foot = "--></style>\n";\r
-       if ( '' != $output )\r
-               echo $head . $output . $foot;\r
-}\r
-\r
-add_action('wp_head', 'kubrick_head');\r
-\r
-function kubrick_header_image() {\r
-       return apply_filters('kubrick_header_image', get_settings('kubrick_header_image'));\r
-}\r
-\r
-function kubrick_upper_color() {\r
-       if ( strstr( $url = kubrick_header_image_url(), 'header-img.php?' ) ) {\r
-               parse_str(substr($url, strpos($url, '?') + 1), $q);\r
-               return $q['upper'];\r
-       } else\r
-               return '69aee7';\r
-}\r
-\r
-function kubrick_lower_color() {\r
-       if ( strstr( $url = kubrick_header_image_url(), 'header-img.php?' ) ) {\r
-               parse_str(substr($url, strpos($url, '?') + 1), $q);\r
-               return $q['lower'];\r
-       } else\r
-               return '4180b6';\r
-}\r
-\r
-function kubrick_header_image_url() {\r
-       if ( $image = kubrick_header_image() )\r
-               $url = get_template_directory_uri() . '/images/' . $image;\r
-       else\r
-               $url = get_template_directory_uri() . '/images/kubrickheader.jpg';\r
-\r
-       return $url;\r
-}\r
-\r
-function kubrick_header_color() {\r
-       return apply_filters('kubrick_header_color', get_settings('kubrick_header_color'));\r
-}\r
-\r
-function kubrick_header_color_string() {\r
-       $color = kubrick_header_color();\r
-       if ( false === $color )\r
-               return 'white';\r
-\r
-       return $color;\r
-}\r
-\r
-function kubrick_header_display() {\r
-       return apply_filters('kubrick_header_display', get_settings('kubrick_header_display'));\r
-}\r
-\r
-function kubrick_header_display_string() {\r
-       $display = kubrick_header_display();\r
-       return $display ? $display : 'inline';\r
-}\r
-\r
-add_action('admin_menu', 'kubrick_add_theme_page');\r
-\r
-function kubrick_add_theme_page() {\r
-       if ( $_GET['page'] == basename(__FILE__) ) {\r
-               if ( 'save' == $_REQUEST['action'] ) {\r
-                       if ( isset($_REQUEST['njform']) ) {\r
-                               if ( isset($_REQUEST['defaults']) ) {\r
-                                       delete_option('kubrick_header_image');\r
-                                       delete_option('kubrick_header_color');\r
-                                       delete_option('kubrick_header_display');\r
-                               } else {\r
-                                       if ( '' == $_REQUEST['njfontcolor'] )\r
-                                               delete_option('kubrick_header_color');\r
-                                       else\r
-                                               update_option('kubrick_header_color', $_REQUEST['njfontcolor']);\r
-\r
-                                       if ( preg_match('/[0-9A-F]{6}|[0-9A-F]{3}/i', $_REQUEST['njuppercolor'], $uc) && preg_match('/[0-9A-F]{6}|[0-9A-F]{3}/i', $_REQUEST['njlowercolor'], $lc) ) {\r
-                                               $uc = ( strlen($uc[0]) == 3 ) ? $uc[0]{0}.$uc[0]{0}.$uc[0]{1}.$uc[0]{1}.$uc[0]{2}.$uc[0]{2} : $uc[0];\r
-                                               $lc = ( strlen($lc[0]) == 3 ) ? $lc[0]{0}.$lc[0]{0}.$lc[0]{1}.$lc[0]{1}.$lc[0]{2}.$lc[0]{2} : $lc[0];\r
-                                               update_option('kubrick_header_image', "header-img.php?upper=$uc&amp;lower=$lc");\r
-                                       }\r
-\r
-                                       if ( isset($_REQUEST['toggledisplay']) ) {\r
-                                               if ( false === get_settings('kubrick_header_display') )\r
-                                                       update_option('kubrick_header_display', 'none');\r
-                                               else\r
-                                                       delete_option('kubrick_header_display');\r
-                                       }\r
-                               }\r
-                       } else {\r
-\r
-                               if ( isset($_REQUEST['headerimage']) ) {\r
-                                       if ( '' == $_REQUEST['headerimage'] )\r
-                                               delete_option('kubrick_header_image');\r
-                                       else\r
-                                               update_option('kubrick_header_image', $_REQUEST['headerimage']);\r
-                               }\r
-\r
-                               if ( isset($_REQUEST['fontcolor']) ) {\r
-                                       if ( '' == $_REQUEST['fontcolor'] )\r
-                                               delete_option('kubrick_header_color');\r
-                                       else\r
-                                               update_option('kubrick_header_color', $_REQUEST['fontcolor']);\r
-                               }\r
-\r
-                               if ( isset($_REQUEST['fontdisplay']) ) {\r
-                                       if ( '' == $_REQUEST['fontdisplay'] || 'inline' == $_REQUEST['fontdisplay'] )\r
-                                               delete_option('kubrick_header_display');\r
-                                       else\r
-                                               update_option('kubrick_header_display', 'none');\r
-                               }\r
-                       }\r
-                       //print_r($_REQUEST);\r
-                       wp_redirect("themes.php?page=functions.php&saved=true");\r
-                       die;\r
-               }\r
-               add_action('admin_head', 'kubrick_theme_page_head');\r
-       }\r
-       add_theme_page('Customize Header', 'Header Image and Color', 'edit_themes', basename(__FILE__), 'kubrick_theme_page');\r
-}\r
-\r
-function kubrick_theme_page_head() {\r
-?>\r
-<script type="text/javascript" src="../wp-includes/js/colorpicker.js"></script>\r
-<script type='text/javascript'>\r
-// <![CDATA[\r
-       function pickColor(color) {\r
-               ColorPicker_targetInput.value = color;\r
-               kUpdate(ColorPicker_targetInput.id);\r
-       }\r
-       function PopupWindow_populate(contents) {\r
-               contents += '<br /><p style="text-align:center;margin-top:0px;"><input type="button" value="Close Color Picker" onclick="cp.hidePopup(\'prettyplease\')"></input></p>';\r
-               this.contents = contents;\r
-               this.populated = false;\r
-       }\r
-       function PopupWindow_hidePopup(magicword) {\r
-               if ( magicword != 'prettyplease' )\r
-                       return false;\r
-               if (this.divName != null) {\r
-                       if (this.use_gebi) {\r
-                               document.getElementById(this.divName).style.visibility = "hidden";\r
-                       }\r
-                       else if (this.use_css) {\r
-                               document.all[this.divName].style.visibility = "hidden";\r
-                       }\r
-                       else if (this.use_layers) {\r
-                               document.layers[this.divName].visibility = "hidden";\r
-                       }\r
-               }\r
-               else {\r
-                       if (this.popupWindow && !this.popupWindow.closed) {\r
-                               this.popupWindow.close();\r
-                               this.popupWindow = null;\r
-                       }\r
-               }\r
-               return false;\r
-       }\r
-       function colorSelect(t,p) {\r
-               if ( cp.p == p && document.getElementById(cp.divName).style.visibility != "hidden" )\r
-                       cp.hidePopup('prettyplease');\r
-               else {\r
-                       cp.p = p;\r
-                       cp.select(t,p);\r
-               }\r
-       }\r
-       function PopupWindow_setSize(width,height) {\r
-               this.width = 162;\r
-               this.height = 210;\r
-       }\r
-\r
-       var cp = new ColorPicker();\r
-       function advUpdate(val, obj) {\r
-               document.getElementById(obj).value = val;\r
-               kUpdate(obj);\r
-       }\r
-       function kUpdate(oid) {\r
-               if ( 'uppercolor' == oid || 'lowercolor' == oid ) {\r
-                       uc = document.getElementById('uppercolor').value.replace('#', '');\r
-                       lc = document.getElementById('lowercolor').value.replace('#', '');\r
-                       hi = document.getElementById('headerimage');\r
-                       hi.value = 'header-img.php?upper='+uc+'&lower='+lc;\r
-                       document.getElementById('header').style.background = 'url("<?php echo get_template_directory_uri(); ?>/images/'+hi.value+'") center no-repeat';\r
-                       document.getElementById('advuppercolor').value = '#'+uc;\r
-                       document.getElementById('advlowercolor').value = '#'+lc;\r
-               }\r
-               if ( 'fontcolor' == oid ) {\r
-                       document.getElementById('header').style.color = document.getElementById('fontcolor').value;\r
-                       document.getElementById('advfontcolor').value = document.getElementById('fontcolor').value;\r
-               }\r
-               if ( 'fontdisplay' == oid ) {\r
-                       document.getElementById('headerimg').style.display = document.getElementById('fontdisplay').value;\r
-               }\r
-       }\r
-       function toggleDisplay() {\r
-               td = document.getElementById('fontdisplay');\r
-               td.value = ( td.value == 'none' ) ? 'inline' : 'none';\r
-               kUpdate('fontdisplay');\r
-       }\r
-       function toggleAdvanced() {\r
-               a = document.getElementById('jsAdvanced');\r
-               if ( a.style.display == 'none' )\r
-                       a.style.display = 'block';\r
-               else\r
-                       a.style.display = 'none';\r
-       }\r
-       function kDefaults() {\r
-               document.getElementById('headerimage').value = '';\r
-               document.getElementById('advuppercolor').value = document.getElementById('uppercolor').value = '#69aee7';\r
-               document.getElementById('advlowercolor').value = document.getElementById('lowercolor').value = '#4180b6';\r
-               document.getElementById('header').style.background = 'url("<?php echo get_template_directory_uri(); ?>/images/kubrickheader.jpg") center no-repeat';\r
-               document.getElementById('header').style.color = '#FFFFFF';\r
-               document.getElementById('advfontcolor').value = document.getElementById('fontcolor').value = '';\r
-               document.getElementById('fontdisplay').value = 'inline';\r
-               document.getElementById('headerimg').style.display = document.getElementById('fontdisplay').value;\r
-       }\r
-       function kRevert() {\r
-               document.getElementById('headerimage').value = '<?php echo kubrick_header_image(); ?>';\r
-               document.getElementById('advuppercolor').value = document.getElementById('uppercolor').value = '#<?php echo kubrick_upper_color(); ?>';\r
-               document.getElementById('advlowercolor').value = document.getElementById('lowercolor').value = '#<?php echo kubrick_lower_color(); ?>';\r
-               document.getElementById('header').style.background = 'url("<?php echo kubrick_header_image_url(); ?>") center no-repeat';\r
-               document.getElementById('header').style.color = '';\r
-               document.getElementById('advfontcolor').value = document.getElementById('fontcolor').value = '<?php echo kubrick_header_color_string(); ?>';\r
-               document.getElementById('fontdisplay').value = '<?php echo kubrick_header_display_string(); ?>';\r
-               document.getElementById('headerimg').style.display = document.getElementById('fontdisplay').value;\r
-       }\r
-       function kInit() {\r
-               document.getElementById('jsForm').style.display = 'block';\r
-               document.getElementById('nonJsForm').style.display = 'none';\r
-       }\r
-       addLoadEvent(kInit);\r
-// ]]>\r
-</script>\r
-<style type='text/css'>\r
-       #headwrap {\r
-               text-align: center;\r
-       }\r
-       #kubrick-header {\r
-               font-size: 80%;\r
-       }\r
-       #kubrick-header .hibrowser {\r
-               width: 780px;\r
-               height: 260px;\r
-               overflow: scroll;\r
-       }\r
-       #kubrick-header #hitarget {\r
-               display: none;\r
-       }\r
-       #kubrick-header #header h1 {\r
-               font-family: 'Trebuchet MS', 'Lucida Grande', Verdana, Arial, Sans-Serif;\r
-               font-weight: bold;\r
-               font-size: 4em;\r
-               text-align: center;\r
-               padding-top: 70px;\r
-               margin: 0;\r
-       }\r
-\r
-       #kubrick-header #header .description {\r
-               font-family: 'Lucida Grande', Verdana, Arial, Sans-Serif;\r
-               font-size: 1.2em;\r
-               text-align: center;\r
-       }\r
-       #kubrick-header #header {\r
-               text-decoration: none;\r
-               color: <?php echo kubrick_header_color_string(); ?>;\r
-               padding: 0;\r
-               margin: 0;\r
-               height: 200px;\r
-               text-align: center;\r
-               background: url('<?php echo kubrick_header_image_url(); ?>') center no-repeat;\r
-       }\r
-       #kubrick-header #headerimg {\r
-               margin: 0;\r
-               height: 200px;\r
-               width: 100%;\r
-               display: <?php echo kubrick_header_display_string(); ?>;\r
-       }\r
-       #jsForm {\r
-               display: none;\r
-               text-align: center;\r
-       }\r
-       #jsForm input.submit, #jsForm input.button, #jsAdvanced input.button {\r
-               padding: 0px;\r
-               margin: 0px;\r
-       }\r
-       #advanced {\r
-               text-align: center;\r
-               width: 620px;\r
-       }\r
-       html>body #advanced {\r
-               text-align: center;\r
-               position: relative;\r
-               left: 50%;\r
-               margin-left: -380px;\r
-       }\r
-       #jsAdvanced {\r
-               text-align: right;\r
-       }\r
-       #nonJsForm {\r
-               position: relative;\r
-               text-align: left;\r
-               margin-left: -370px;\r
-               left: 50%;\r
-       }\r
-       #nonJsForm label {\r
-               padding-top: 6px;\r
-               padding-right: 5px;\r
-               float: left;\r
-               width: 100px;\r
-               text-align: right;\r
-       }\r
-       .defbutton {\r
-               font-weight: bold;\r
-       }\r
-       .zerosize {\r
-               width: 0px;\r
-               height: 0px;\r
-               overflow: hidden;\r
-       }\r
-       #colorPickerDiv a, #colorPickerDiv a:hover {\r
-               padding: 1px;\r
-               text-decoration: none;\r
-               border-bottom: 0px;\r
-       }\r
-</style>\r
-<?php\r
-}\r
-\r
-function kubrick_theme_page() {\r
-       if ( $_REQUEST['saved'] ) echo '<div id="message" class="updated fade"><p><strong>Options saved.</strong></p></div>';\r
-?>\r
-<div class='wrap'>\r
-       <div id="kubrick-header">\r
-               <h2>Header Image and Color</h2>\r
-               <div id="headwrap">\r
-                       <div id="header">\r
-                               <div id="headerimg">\r
-                                       <h1><?php bloginfo('name'); ?></h1>\r
-                                       <div class="description"><?php bloginfo('description'); ?></div>\r
-                               </div>\r
-                       </div>\r
-               </div>\r
-               <br />\r
-               <div id="nonJsForm">\r
-                       <form method="post" action="">\r
-                               <div class="zerosize"><input type="submit" name="defaultsubmit" value="Save" /></div>\r
-                               <label for="njfontcolor">Font Color:</label><input type="text" name="njfontcolor" id="njfontcolor" value="<?php echo kubrick_header_color(); ?>" /> Any CSS color (<code>red</code> or <code>#FF0000</code> or <code>rgb(255, 0, 0)</code>)<br />\r
-                               <label for="njuppercolor">Upper Color:</label><input type="text" name="njuppercolor" id="njuppercolor" value="#<?php echo kubrick_upper_color(); ?>" /> HEX only (<code>#FF0000</code> or <code>#F00</code>)<br />\r
-                               <label for="njlowercolor">Lower Color:</label><input type="text" name="njlowercolor" id="njlowercolor" value="#<?php echo kubrick_lower_color(); ?>" /> HEX only (<code>#FF0000</code> or <code>#F00</code>)<br />\r
-                               <input type="hidden" name="hi" id="hi" value="<?php echo kubrick_header_image(); ?>" />\r
-                               <input type="submit" name="toggledisplay" id="toggledisplay" value="Toggle Text" />\r
-                               <input type="submit" name="defaults" value="Use Defaults" />\r
-                               <input type="submit" class="defbutton" name="submitform" value="&nbsp;&nbsp;Save&nbsp;&nbsp;" />\r
-                               <input type="hidden" name="action" value="save" />\r
-                               <input type="hidden" name="njform" value="true" />\r
-                       </form>\r
-               </div>\r
-               <div id="jsForm">\r
-                       <form style="display:inline;" method="post" name="hicolor" id="hicolor" action="<?php echo $_SERVER['REQUEST_URI']; ?>">\r
-                               <input type="button" onclick="tgt=document.getElementById('fontcolor');colorSelect(tgt,'pick1');return false;" name="pick1" id="pick1" value="Font Color"></input>\r
-                               <input type="button" onclick="tgt=document.getElementById('uppercolor');colorSelect(tgt,'pick2');return false;" name="pick2" id="pick2" value="Upper Color"></input>\r
-                               <input type="button" onclick="tgt=document.getElementById('lowercolor');colorSelect(tgt,'pick3');return false;" name="pick3" id="pick3" value="Lower Color"></input>\r
-                               <input type="button" name="revert" value="Revert" onclick="kRevert()" />\r
-                               <input type="button" value="Advanced" onclick="toggleAdvanced()" />\r
-                               <input type="submit" name="submitform" class="defbutton" value="Save" onclick="cp.hidePopup('prettyplease')" />\r
-                               <input type="hidden" name="action" value="save" />\r
-                               <input type="hidden" name="fontdisplay" id="fontdisplay" value="<?php echo kubrick_header_display(); ?>" />\r
-                               <input type="hidden" name="fontcolor" id="fontcolor" value="<?php echo kubrick_header_color(); ?>" />\r
-                               <input type="hidden" name="uppercolor" id="uppercolor" value="<?php echo kubrick_upper_color(); ?>" />\r
-                               <input type="hidden" name="lowercolor" id="lowercolor" value="<?php echo kubrick_lower_color(); ?>" />\r
-                               <input type="hidden" name="headerimage" id="headerimage" value="<?php echo kubrick_header_image(); ?>" />\r
-                       </form>\r
-                       <div id="colorPickerDiv" style="z-index: 100;background:#eee;border:1px solid #ccc;position:absolute;visibility:hidden;"> </div>\r
-                       <div id="advanced">\r
-                               <form id="jsAdvanced" style="display:none;" action="">\r
-                                       <label for="advfontcolor">Font Color (CSS): </label><input type="text" id="advfontcolor" onchange="advUpdate(this.value, 'fontcolor')" value="<?php echo kubrick_header_color(); ?>" /><br />\r
-                                       <label for="advuppercolor">Upper Color (HEX): </label><input type="text" id="advuppercolor" onchange="advUpdate(this.value, 'uppercolor')" value="#<?php echo kubrick_upper_color(); ?>" /><br />\r
-                                       <label for="advlowercolor">Lower Color (HEX): </label><input type="text" id="advlowercolor" onchange="advUpdate(this.value, 'lowercolor')" value="#<?php echo kubrick_lower_color(); ?>" /><br />\r
-                                       <input type="button" name="default" value="Select Default Colors" onclick="kDefaults()" /><br />\r
-                                       <input type="button" onclick="toggleDisplay();return false;" name="pick" id="pick" value="Toggle Text Display"></input><br />\r
-                               </form>\r
-                       </div>\r
-               </div>\r
-       </div>\r
-</div>\r
-<?php } ?>\r
+<?php
+
+function kubrick_head() {
+       $head = "<style type='text/css'>\n<!--";
+       $output = '';
+       if ( kubrick_header_image() ) {
+               $url =  kubrick_header_image_url() ;
+               $output .= "#header { background: url('$url') no-repeat bottom center; }\n";
+       }
+       if ( false !== ( $color = kubrick_header_color() ) ) {
+               $output .= "#headerimg h1 a, #headerimg h1 a:visited, #headerimg .description { color: $color; }\n";
+       }
+       if ( false !== ( $display = kubrick_header_display() ) ) {
+               $output .= "#headerimg { display: $display }\n";
+       }
+       $foot = "--></style>\n";
+       if ( '' != $output )
+               echo $head . $output . $foot;
+}
+
+add_action('wp_head', 'kubrick_head');
+
+function kubrick_header_image() {
+       return apply_filters('kubrick_header_image', get_option('kubrick_header_image'));
+}
+
+function kubrick_upper_color() {
+       if (strpos($url = kubrick_header_image_url(), 'header-img.php?') !== false) {
+               parse_str(substr($url, strpos($url, '?') + 1), $q);
+               return $q['upper'];
+       } else
+               return '69aee7';
+}
+
+function kubrick_lower_color() {
+       if (strpos($url = kubrick_header_image_url(), 'header-img.php?') !== false) {
+               parse_str(substr($url, strpos($url, '?') + 1), $q);
+               return $q['lower'];
+       } else
+               return '4180b6';
+}
+
+function kubrick_header_image_url() {
+       if ( $image = kubrick_header_image() )
+               $url = get_template_directory_uri() . '/images/' . $image;
+       else
+               $url = get_template_directory_uri() . '/images/kubrickheader.jpg';
+
+       return $url;
+}
+
+function kubrick_header_color() {
+       return apply_filters('kubrick_header_color', get_option('kubrick_header_color'));
+}
+
+function kubrick_header_color_string() {
+       $color = kubrick_header_color();
+       if ( false === $color )
+               return 'white';
+
+       return $color;
+}
+
+function kubrick_header_display() {
+       return apply_filters('kubrick_header_display', get_option('kubrick_header_display'));
+}
+
+function kubrick_header_display_string() {
+       $display = kubrick_header_display();
+       return $display ? $display : 'inline';
+}
+
+add_action('admin_menu', 'kubrick_add_theme_page');
+
+function kubrick_add_theme_page() {
+       if ( $_GET['page'] == basename(__FILE__) ) {
+               if ( 'save' == $_REQUEST['action'] ) {
+                       check_admin_referer('kubrick-header');
+                       if ( isset($_REQUEST['njform']) ) {
+                               if ( isset($_REQUEST['defaults']) ) {
+                                       delete_option('kubrick_header_image');
+                                       delete_option('kubrick_header_color');
+                                       delete_option('kubrick_header_display');
+                               } else {
+                                       if ( '' == $_REQUEST['njfontcolor'] )
+                                               delete_option('kubrick_header_color');
+                                       else {
+                                               $fontcolor = preg_replace('/^.*(#[0-9a-fA-F]{6})?.*$/', '$1', $_REQUEST['njfontcolor']);
+                                               update_option('kubrick_header_color', $fontcolor);
+                                       }
+                                       if ( preg_match('/[0-9A-F]{6}|[0-9A-F]{3}/i', $_REQUEST['njuppercolor'], $uc) && preg_match('/[0-9A-F]{6}|[0-9A-F]{3}/i', $_REQUEST['njlowercolor'], $lc) ) {
+                                               $uc = ( strlen($uc[0]) == 3 ) ? $uc[0]{0}.$uc[0]{0}.$uc[0]{1}.$uc[0]{1}.$uc[0]{2}.$uc[0]{2} : $uc[0];
+                                               $lc = ( strlen($lc[0]) == 3 ) ? $lc[0]{0}.$lc[0]{0}.$lc[0]{1}.$lc[0]{1}.$lc[0]{2}.$lc[0]{2} : $lc[0];
+                                               update_option('kubrick_header_image', "header-img.php?upper=$uc&amp;lower=$lc");
+                                       }
+
+                                       if ( isset($_REQUEST['toggledisplay']) ) {
+                                               if ( false === get_option('kubrick_header_display') )
+                                                       update_option('kubrick_header_display', 'none');
+                                               else
+                                                       delete_option('kubrick_header_display');
+                                       }
+                               }
+                       } else {
+
+                               if ( isset($_REQUEST['headerimage']) ) {
+                                       check_admin_referer('kubrick-header');
+                                       if ( '' == $_REQUEST['headerimage'] )
+                                               delete_option('kubrick_header_image');
+                                       else {
+                                               $headerimage = preg_replace('/^.*?(header-img.php\?upper=[0-9a-fA-F]{6}&lower=[0-9a-fA-F]{6})?.*$/', '$1', $_REQUEST['headerimage']);
+                                               update_option('kubrick_header_image', $headerimage);
+                                       }
+                               }
+
+                               if ( isset($_REQUEST['fontcolor']) ) {
+                                       check_admin_referer('kubrick-header');
+                                       if ( '' == $_REQUEST['fontcolor'] )
+                                               delete_option('kubrick_header_color');
+                                       else {
+                                               $fontcolor = preg_replace('/^.*?(#[0-9a-fA-F]{6})?.*$/', '$1', $_REQUEST['fontcolor']);
+                                               update_option('kubrick_header_color', $fontcolor);
+                                       }
+                               }
+
+                               if ( isset($_REQUEST['fontdisplay']) ) {
+                                       check_admin_referer('kubrick-header');
+                                       if ( '' == $_REQUEST['fontdisplay'] || 'inline' == $_REQUEST['fontdisplay'] )
+                                               delete_option('kubrick_header_display');
+                                       else
+                                               update_option('kubrick_header_display', 'none');
+                               }
+                       }
+                       //print_r($_REQUEST);
+                       wp_redirect("themes.php?page=functions.php&saved=true");
+                       die;
+               }
+               add_action('admin_head', 'kubrick_theme_page_head');
+       }
+       add_theme_page('Customize Header', 'Header Image and Color', 'edit_themes', basename(__FILE__), 'kubrick_theme_page');
+}
+
+function kubrick_theme_page_head() {
+?>
+<script type="text/javascript" src="../wp-includes/js/colorpicker.js"></script>
+<script type='text/javascript'>
+// <![CDATA[
+       function pickColor(color) {
+               ColorPicker_targetInput.value = color;
+               kUpdate(ColorPicker_targetInput.id);
+       }
+       function PopupWindow_populate(contents) {
+               contents += '<br /><p style="text-align:center;margin-top:0px;"><input type="button" value="Close Color Picker" onclick="cp.hidePopup(\'prettyplease\')"></input></p>';
+               this.contents = contents;
+               this.populated = false;
+       }
+       function PopupWindow_hidePopup(magicword) {
+               if ( magicword != 'prettyplease' )
+                       return false;
+               if (this.divName != null) {
+                       if (this.use_gebi) {
+                               document.getElementById(this.divName).style.visibility = "hidden";
+                       }
+                       else if (this.use_css) {
+                               document.all[this.divName].style.visibility = "hidden";
+                       }
+                       else if (this.use_layers) {
+                               document.layers[this.divName].visibility = "hidden";
+                       }
+               }
+               else {
+                       if (this.popupWindow && !this.popupWindow.closed) {
+                               this.popupWindow.close();
+                               this.popupWindow = null;
+                       }
+               }
+               return false;
+       }
+       function colorSelect(t,p) {
+               if ( cp.p == p && document.getElementById(cp.divName).style.visibility != "hidden" )
+                       cp.hidePopup('prettyplease');
+               else {
+                       cp.p = p;
+                       cp.select(t,p);
+               }
+       }
+       function PopupWindow_setSize(width,height) {
+               this.width = 162;
+               this.height = 210;
+       }
+
+       var cp = new ColorPicker();
+       function advUpdate(val, obj) {
+               document.getElementById(obj).value = val;
+               kUpdate(obj);
+       }
+       function kUpdate(oid) {
+               if ( 'uppercolor' == oid || 'lowercolor' == oid ) {
+                       uc = document.getElementById('uppercolor').value.replace('#', '');
+                       lc = document.getElementById('lowercolor').value.replace('#', '');
+                       hi = document.getElementById('headerimage');
+                       hi.value = 'header-img.php?upper='+uc+'&lower='+lc;
+                       document.getElementById('header').style.background = 'url("<?php echo get_template_directory_uri(); ?>/images/'+hi.value+'") center no-repeat';
+                       document.getElementById('advuppercolor').value = '#'+uc;
+                       document.getElementById('advlowercolor').value = '#'+lc;
+               }
+               if ( 'fontcolor' == oid ) {
+                       document.getElementById('header').style.color = document.getElementById('fontcolor').value;
+                       document.getElementById('advfontcolor').value = document.getElementById('fontcolor').value;
+               }
+               if ( 'fontdisplay' == oid ) {
+                       document.getElementById('headerimg').style.display = document.getElementById('fontdisplay').value;
+               }
+       }
+       function toggleDisplay() {
+               td = document.getElementById('fontdisplay');
+               td.value = ( td.value == 'none' ) ? 'inline' : 'none';
+               kUpdate('fontdisplay');
+       }
+       function toggleAdvanced() {
+               a = document.getElementById('jsAdvanced');
+               if ( a.style.display == 'none' )
+                       a.style.display = 'block';
+               else
+                       a.style.display = 'none';
+       }
+       function kDefaults() {
+               document.getElementById('headerimage').value = '';
+               document.getElementById('advuppercolor').value = document.getElementById('uppercolor').value = '#69aee7';
+               document.getElementById('advlowercolor').value = document.getElementById('lowercolor').value = '#4180b6';
+               document.getElementById('header').style.background = 'url("<?php echo get_template_directory_uri(); ?>/images/kubrickheader.jpg") center no-repeat';
+               document.getElementById('header').style.color = '#FFFFFF';
+               document.getElementById('advfontcolor').value = document.getElementById('fontcolor').value = '';
+               document.getElementById('fontdisplay').value = 'inline';
+               document.getElementById('headerimg').style.display = document.getElementById('fontdisplay').value;
+       }
+       function kRevert() {
+               document.getElementById('headerimage').value = '<?php echo js_escape(kubrick_header_image()); ?>';
+               document.getElementById('advuppercolor').value = document.getElementById('uppercolor').value = '#<?php echo js_escape(kubrick_upper_color()); ?>';
+               document.getElementById('advlowercolor').value = document.getElementById('lowercolor').value = '#<?php echo js_escape(kubrick_lower_color()); ?>';
+               document.getElementById('header').style.background = 'url("<?php echo js_escape(kubrick_header_image_url()); ?>") center no-repeat';
+               document.getElementById('header').style.color = '';
+               document.getElementById('advfontcolor').value = document.getElementById('fontcolor').value = '<?php echo js_escape(kubrick_header_color_string()); ?>';
+               document.getElementById('fontdisplay').value = '<?php echo js_escape(kubrick_header_display_string()); ?>';
+               document.getElementById('headerimg').style.display = document.getElementById('fontdisplay').value;
+       }
+       function kInit() {
+               document.getElementById('jsForm').style.display = 'block';
+               document.getElementById('nonJsForm').style.display = 'none';
+       }
+       addLoadEvent(kInit);
+// ]]>
+</script>
+<style type='text/css'>
+       #headwrap {
+               text-align: center;
+       }
+       #kubrick-header {
+               font-size: 80%;
+       }
+       #kubrick-header .hibrowser {
+               width: 780px;
+               height: 260px;
+               overflow: scroll;
+       }
+       #kubrick-header #hitarget {
+               display: none;
+       }
+       #kubrick-header #header h1 {
+               font-family: 'Trebuchet MS', 'Lucida Grande', Verdana, Arial, Sans-Serif;
+               font-weight: bold;
+               font-size: 4em;
+               text-align: center;
+               padding-top: 70px;
+               margin: 0;
+       }
+
+       #kubrick-header #header .description {
+               font-family: 'Lucida Grande', Verdana, Arial, Sans-Serif;
+               font-size: 1.2em;
+               text-align: center;
+       }
+       #kubrick-header #header {
+               text-decoration: none;
+               color: <?php echo kubrick_header_color_string(); ?>;
+               padding: 0;
+               margin: 0;
+               height: 200px;
+               text-align: center;
+               background: url('<?php echo kubrick_header_image_url(); ?>') center no-repeat;
+       }
+       #kubrick-header #headerimg {
+               margin: 0;
+               height: 200px;
+               width: 100%;
+               display: <?php echo kubrick_header_display_string(); ?>;
+       }
+       #jsForm {
+               display: none;
+               text-align: center;
+       }
+       #jsForm input.submit, #jsForm input.button, #jsAdvanced input.button {
+               padding: 0px;
+               margin: 0px;
+       }
+       #advanced {
+               text-align: center;
+               width: 620px;
+       }
+       html>body #advanced {
+               text-align: center;
+               position: relative;
+               left: 50%;
+               margin-left: -380px;
+       }
+       #jsAdvanced {
+               text-align: right;
+       }
+       #nonJsForm {
+               position: relative;
+               text-align: left;
+               margin-left: -370px;
+               left: 50%;
+       }
+       #nonJsForm label {
+               padding-top: 6px;
+               padding-right: 5px;
+               float: left;
+               width: 100px;
+               text-align: right;
+       }
+       .defbutton {
+               font-weight: bold;
+       }
+       .zerosize {
+               width: 0px;
+               height: 0px;
+               overflow: hidden;
+       }
+       #colorPickerDiv a, #colorPickerDiv a:hover {
+               padding: 1px;
+               text-decoration: none;
+               border-bottom: 0px;
+       }
+</style>
+<?php
+}
+
+function kubrick_theme_page() {
+       if ( $_REQUEST['saved'] ) echo '<div id="message" class="updated fade"><p><strong>Options saved.</strong></p></div>';
+?>
+<div class='wrap'>
+       <div id="kubrick-header">
+               <h2>Header Image and Color</h2>
+               <div id="headwrap">
+                       <div id="header">
+                               <div id="headerimg">
+                                       <h1><?php bloginfo('name'); ?></h1>
+                                       <div class="description"><?php bloginfo('description'); ?></div>
+                               </div>
+                       </div>
+               </div>
+               <br />
+               <div id="nonJsForm">
+                       <form method="post" action="">
+                               <?php wp_nonce_field('kubrick-header'); ?>
+                               <div class="zerosize"><input type="submit" name="defaultsubmit" value="Save" /></div>
+                               <label for="njfontcolor">Font Color:</label><input type="text" name="njfontcolor" id="njfontcolor" value="<?php echo attribute_escape(kubrick_header_color()); ?>" /> Any CSS color (<code>red</code> or <code>#FF0000</code> or <code>rgb(255, 0, 0)</code>)<br />
+                               <label for="njuppercolor">Upper Color:</label><input type="text" name="njuppercolor" id="njuppercolor" value="#<?php echo attribute_escape(kubrick_upper_color()); ?>" /> HEX only (<code>#FF0000</code> or <code>#F00</code>)<br />
+                               <label for="njlowercolor">Lower Color:</label><input type="text" name="njlowercolor" id="njlowercolor" value="#<?php echo attribute_escape(kubrick_lower_color()); ?>" /> HEX only (<code>#FF0000</code> or <code>#F00</code>)<br />
+                               <input type="hidden" name="hi" id="hi" value="<?php echo attribute_escape(kubrick_header_image()); ?>" />
+                               <input type="submit" name="toggledisplay" id="toggledisplay" value="Toggle Text" />
+                               <input type="submit" name="defaults" value="Use Defaults" />
+                               <input type="submit" class="defbutton" name="submitform" value="&nbsp;&nbsp;Save&nbsp;&nbsp;" />
+                               <input type="hidden" name="action" value="save" />
+                               <input type="hidden" name="njform" value="true" />
+                       </form>
+               </div>
+               <div id="jsForm">
+                       <form style="display:inline;" method="post" name="hicolor" id="hicolor" action="<?php echo attribute_escape($_SERVER['REQUEST_URI']); ?>">
+                               <?php wp_nonce_field('kubrick-header'); ?>
+                               <input type="button" onclick="tgt=document.getElementById('fontcolor');colorSelect(tgt,'pick1');return false;" name="pick1" id="pick1" value="Font Color"></input>
+                               <input type="button" onclick="tgt=document.getElementById('uppercolor');colorSelect(tgt,'pick2');return false;" name="pick2" id="pick2" value="Upper Color"></input>
+                               <input type="button" onclick="tgt=document.getElementById('lowercolor');colorSelect(tgt,'pick3');return false;" name="pick3" id="pick3" value="Lower Color"></input>
+                               <input type="button" name="revert" value="Revert" onclick="kRevert()" />
+                               <input type="button" value="Advanced" onclick="toggleAdvanced()" />
+                               <input type="hidden" name="action" value="save" />
+                               <input type="hidden" name="fontdisplay" id="fontdisplay" value="<?php echo attribute_escape(kubrick_header_display()); ?>" />
+                               <input type="hidden" name="fontcolor" id="fontcolor" value="<?php echo attribute_escape(kubrick_header_color()); ?>" />
+                               <input type="hidden" name="uppercolor" id="uppercolor" value="<?php echo attribute_escape(kubrick_upper_color()); ?>" />
+                               <input type="hidden" name="lowercolor" id="lowercolor" value="<?php echo attribute_escape(kubrick_lower_color()); ?>" />
+                               <input type="hidden" name="headerimage" id="headerimage" value="<?php echo attribute_escape(kubrick_header_image()); ?>" />
+                               <p class="submit"><input type="submit" name="submitform" class="defbutton" value="<?php _e('Update Header &raquo;'); ?>" onclick="cp.hidePopup('prettyplease')" /></p>
+                       </form>
+                       <div id="colorPickerDiv" style="z-index: 100;background:#eee;border:1px solid #ccc;position:absolute;visibility:hidden;"> </div>
+                       <div id="advanced">
+                               <form id="jsAdvanced" style="display:none;" action="">
+                                       <?php wp_nonce_field('kubrick-header'); ?>
+                                       <label for="advfontcolor">Font Color (CSS): </label><input type="text" id="advfontcolor" onchange="advUpdate(this.value, 'fontcolor')" value="<?php echo attribute_escape(kubrick_header_color()); ?>" /><br />
+                                       <label for="advuppercolor">Upper Color (HEX): </label><input type="text" id="advuppercolor" onchange="advUpdate(this.value, 'uppercolor')" value="#<?php echo attribute_escape(kubrick_upper_color()); ?>" /><br />
+                                       <label for="advlowercolor">Lower Color (HEX): </label><input type="text" id="advlowercolor" onchange="advUpdate(this.value, 'lowercolor')" value="#<?php echo attribute_escape(kubrick_lower_color()); ?>" /><br />
+                                       <input type="button" name="default" value="Select Default Colors" onclick="kDefaults()" /><br />
+                                       <input type="button" onclick="toggleDisplay();return false;" name="pick" id="pick" value="Toggle Text Display"></input><br />
+                               </form>
+                       </div>
+               </div>
+       </div>
+</div>
+<?php } ?>
index c7c73f17374f60bfa278df5e728929cdc7e5ac19..44d567220dc8a6c6eafb3cac6e5a015cece84130 100644 (file)
@@ -1,5 +1,5 @@
 <form method="get" id="searchform" action="<?php bloginfo('home'); ?>/">
 <form method="get" id="searchform" action="<?php bloginfo('home'); ?>/">
-<div><input type="text" value="<?php echo wp_specialchars($s, 1); ?>" name="s" id="s" />
+<div><input type="text" value="<?php echo attribute_escape($s); ?>" name="s" id="s" />
 <input type="submit" id="searchsubmit" value="Search" />
 </div>
 </form>
 <input type="submit" id="searchsubmit" value="Search" />
 </div>
 </form>
index 79a0566bcc8fd6dfa5471704ea986793c3dc312e..334a9610187ff6f0946f0f0eee21e960382a724e 100644 (file)
@@ -8,6 +8,8 @@ function wp_cache_add($key, $data, $flag = '', $expire = 0) {
 function wp_cache_close() {
        global $wp_object_cache;
 
 function wp_cache_close() {
        global $wp_object_cache;
 
+       if ( ! isset($wp_object_cache) )
+               return;
        return $wp_object_cache->save();
 }
 
        return $wp_object_cache->save();
 }
 
@@ -30,9 +32,7 @@ function wp_cache_get($id, $flag = '') {
 }
 
 function wp_cache_init() {
 }
 
 function wp_cache_init() {
-       global $wp_object_cache;
-
-       $wp_object_cache = new WP_Object_Cache();
+       $GLOBALS['wp_object_cache'] =& new WP_Object_Cache();
 }
 
 function wp_cache_replace($key, $data, $flag = '', $expire = 0) {
 }
 
 function wp_cache_replace($key, $data, $flag = '', $expire = 0) {
@@ -404,8 +404,14 @@ class WP_Object_Cache {
        }
 
        function WP_Object_Cache() {
        }
 
        function WP_Object_Cache() {
+               return $this->__construct();
+       }
+       
+       function __construct() {
                global $blog_id;
 
                global $blog_id;
 
+               register_shutdown_function(array(&$this, "__destruct"));
+
                if (defined('DISABLE_CACHE'))
                        return;
 
                if (defined('DISABLE_CACHE'))
                        return;
 
@@ -440,5 +446,10 @@ class WP_Object_Cache {
 
                $this->blog_id = $this->hash($blog_id);
        }
 
                $this->blog_id = $this->hash($blog_id);
        }
+
+       function __destruct() {
+               $this->save();
+               return true;    
+       }
 }
 ?>
 }
 ?>
index 08baa19ec601d4bbf5710ea9a55a86019988003c..e1a9c23df8dd92ad163006ed8f8b61f3b5781396 100644 (file)
@@ -1239,7 +1239,7 @@ class Snoopy
 
                                                $fp = fopen($file_name, "r");
                                                while (!feof($fp)) {
 
                                                $fp = fopen($file_name, "r");
                                                while (!feof($fp)) {
-                                                       $file_content = fread($fp, filesize($file_name));
+                                                       $file_content .= fread($fp, filesize($file_name));
                                                }
                                                fclose($fp);
                                                $base_name = basename($file_name);
                                                }
                                                fclose($fp);
                                                $base_name = basename($file_name);
index 292e1c8ca7ee19f52c4cb2bfbe60daf3af9985e8..2af152fcde07948468d7977dd915bc7aff896fa0 100644 (file)
@@ -109,7 +109,7 @@ class WP_Query {
                        // If year, month, day, hour, minute, and second are set, a single 
                        // post is being queried.        
                        $this->is_single = true;
                        // If year, month, day, hour, minute, and second are set, a single 
                        // post is being queried.        
                        $this->is_single = true;
-               } elseif ('' != $qv['static'] || '' != $qv['pagename'] || '' != $qv['page_id']) {
+               } elseif ('' != $qv['static'] || '' != $qv['pagename'] || (int) $qv['page_id']) {
                        $this->is_page = true;
                        $this->is_single = false;
                } elseif (!empty($qv['s'])) {
                        $this->is_page = true;
                        $this->is_single = false;
                } elseif (!empty($qv['s'])) {
@@ -246,8 +246,12 @@ class WP_Query {
        }
 
        function set_404() {
        }
 
        function set_404() {
+               $is_feed = $this->is_feed;
+
                $this->init_query_flags();
                $this->init_query_flags();
-               $this->is_404 = true;   
+               $this->is_404 = true;
+
+               $this->is_feed = $is_feed;
        }
        
        function get($query_var) {
        }
        
        function get($query_var) {
@@ -594,13 +598,13 @@ class WP_Query {
                }
 
                if ( $this->is_attachment ) {
                }
 
                if ( $this->is_attachment ) {
-                       $where .= ' AND (post_status = "attachment")';
+                       $where .= " AND (post_status = 'attachment')";
                } elseif ($this->is_page) {
                } elseif ($this->is_page) {
-                       $where .= ' AND (post_status = "static")';
+                       $where .= " AND (post_status = 'static')";
                } elseif ($this->is_single) {
                } elseif ($this->is_single) {
-                       $where .= ' AND (post_status != "static")';
+                       $where .= " AND (post_status != 'static')";
                } else {
                } else {
-                       $where .= ' AND (post_status = "publish"';
+                       $where .= " AND (post_status = 'publish'";
 
                        if (isset($user_ID) && ('' != intval($user_ID)))
                                $where .= " OR post_author = $user_ID AND post_status != 'draft' AND post_status != 'static')";
 
                        if (isset($user_ID) && ('' != intval($user_ID)))
                                $where .= " OR post_author = $user_ID AND post_status != 'draft' AND post_status != 'static')";
@@ -609,7 +613,7 @@ class WP_Query {
                }
 
                if (! $this->is_attachment )
                }
 
                if (! $this->is_attachment )
-                       $where .= ' AND post_status != "attachment"';
+                       $where .= " AND post_status != 'attachment'";
 
                // Apply filters on where and join prior to paging so that any
                // manipulations to them are reflected in the paging by day queries.
 
                // Apply filters on where and join prior to paging so that any
                // manipulations to them are reflected in the paging by day queries.
@@ -805,7 +809,7 @@ class retrospam_mgr {
                $list = array_unique( $list );
                $this->spam_words = $list;
 
                $list = array_unique( $list );
                $this->spam_words = $list;
 
-               $this->comment_list = $wpdb->get_results("SELECT comment_ID AS ID, comment_content AS text, comment_approved AS approved, comment_author_url AS url, comment_author_ip AS ip, comment_author_email AS email FROM $wpdb->comments ORDER BY comment_ID ASC");
+               $this->comment_list = (array) $wpdb->get_results("SELECT comment_ID AS ID, comment_content AS text, comment_approved AS approved, comment_author_url AS url, comment_author_ip AS ip, comment_author_email AS email FROM $wpdb->comments ORDER BY comment_ID ASC");
        }       // End of class constructor
 
        function move_spam( $id_list ) {
        }       // End of class constructor
 
        function move_spam( $id_list ) {
@@ -818,9 +822,9 @@ class retrospam_mgr {
                                $cnt++;
                        }
                }
                                $cnt++;
                        }
                }
-               echo "<div class='updated'><p>$cnt comment";
-               if ($cnt != 1 ) echo "s";
-               echo " moved to the moderation queue.</p></div>\n";
+               echo "<div class='updated'><p> ";
+               printf(__('%d comment(s) moved to the moderation queue.'), $cnt);
+               echo "</p></div>\n";
        }       // End function move_spam
 
        function find_spam() {
        }       // End function move_spam
 
        function find_spam() {
@@ -849,7 +853,7 @@ class retrospam_mgr {
                $numfound = count($counters[found]);
                $numqueue = $counters[in_queue];
 
                $numfound = count($counters[found]);
                $numqueue = $counters[in_queue];
 
-               $body = '<p>' . sprintf(__('Suspected spam comments: <strong>%s</strong>'), $numfound) . '</p>';
+               $body = '<p>' . sprintf(__('Suspected spam comments: %s'), "<strong>$numfound</strong>") . '</p>';
 
                if ( count($counters[found]) > 0 ) {
                        $id_list = implode( ',', $counters[found] );
 
                if ( count($counters[found]) > 0 ) {
                        $id_list = implode( ',', $counters[found] );
@@ -1032,6 +1036,7 @@ class WP_Rewrite {
                                $front = $front . 'date/';
                                break;
                        }
                                $front = $front . 'date/';
                                break;
                        }
+                       $tok_index++;
                }
 
                $this->date_structure = $front . $date_endian;
                }
 
                $this->date_structure = $front . $date_endian;
@@ -1314,6 +1319,14 @@ class WP_Rewrite {
                if (empty($this->permalink_structure)) {
                        return $rewrite;
                }
                if (empty($this->permalink_structure)) {
                        return $rewrite;
                }
+               //Default Feed rules - These are require to allow for the direct access files to work with permalink structure starting with %category%
+               $default_feeds = array( 'wp-atom.php$'  =>      $this->index .'?feed=atom',
+                                                               'wp-rdf.php$'   =>      $this->index .'?feed=rdf',
+                                                               'wp-rss.php$'   =>      $this->index .'?feed=rss',
+                                                               'wp-rss2.php$'  =>      $this->index .'?feed=rss2',
+                                                               'wp-feed.php$'  =>      $this->index .'?feed=feed',
+                                                               'wp-commentsrss2.php$'  =>      $this->index . '?feed=rss2&withcomments=1');
+
 
                // Post
                $post_rewrite = $this->generate_rewrite_rules($this->permalink_structure);
 
                // Post
                $post_rewrite = $this->generate_rewrite_rules($this->permalink_structure);
@@ -1349,7 +1362,7 @@ class WP_Rewrite {
                $page_rewrite = apply_filters('page_rewrite_rules', $page_rewrite);
 
                // Put them together.
                $page_rewrite = apply_filters('page_rewrite_rules', $page_rewrite);
 
                // Put them together.
-               $this->rules = array_merge($page_rewrite, $root_rewrite, $comments_rewrite, $search_rewrite, $category_rewrite, $author_rewrite, $date_rewrite, $post_rewrite);
+               $this->rules = array_merge($default_feeds, $page_rewrite, $root_rewrite, $comments_rewrite, $search_rewrite, $category_rewrite, $author_rewrite, $date_rewrite, $post_rewrite);
 
                do_action('generate_rewrite_rules', array(&$this));
                $this->rules = apply_filters('rewrite_rules_array', $this->rules);
 
                do_action('generate_rewrite_rules', array(&$this));
                $this->rules = apply_filters('rewrite_rules_array', $this->rules);
@@ -1499,7 +1512,7 @@ class WP {
 
                        $pathinfo = $_SERVER['PATH_INFO'];
                        $pathinfo_array = explode('?', $pathinfo);
 
                        $pathinfo = $_SERVER['PATH_INFO'];
                        $pathinfo_array = explode('?', $pathinfo);
-                       $pathinfo = $pathinfo_array[0];
+                       $pathinfo = str_replace("%", "%25", $pathinfo_array[0]);
                        $req_uri = $_SERVER['REQUEST_URI'];
                        $req_uri_array = explode('?', $req_uri);
                        $req_uri = $req_uri_array[0];
                        $req_uri = $_SERVER['REQUEST_URI'];
                        $req_uri_array = explode('?', $req_uri);
                        $req_uri = $req_uri_array[0];
@@ -1604,6 +1617,9 @@ class WP {
                                $this->query_vars[$wpvar] = $query_vars[$wpvar];
                        else
                                $this->query_vars[$wpvar] = '';
                                $this->query_vars[$wpvar] = $query_vars[$wpvar];
                        else
                                $this->query_vars[$wpvar] = '';
+
+                       if ( !empty( $this->query_vars[$wpvar] ) )
+                               $this->query_vars[$wpvar] = (string) $this->query_vars[$wpvar];
                }
 
                if ( isset($error) )
                }
 
                if ( isset($error) )
@@ -1616,6 +1632,8 @@ class WP {
                        nocache_headers();
                if ( !empty($this->query_vars['error']) && '404' == $this->query_vars['error'] ) {
                        status_header( 404 );
                        nocache_headers();
                if ( !empty($this->query_vars['error']) && '404' == $this->query_vars['error'] ) {
                        status_header( 404 );
+                       if ( !is_user_logged_in() )
+                               nocache_headers();
                        @header('Content-type: ' . get_option('html_type') . '; charset=' . get_option('blog_charset'));
                } else if ( empty($this->query_vars['feed']) ) {
                        @header('Content-type: ' . get_option('html_type') . '; charset=' . get_option('blog_charset'));
                        @header('Content-type: ' . get_option('html_type') . '; charset=' . get_option('blog_charset'));
                } else if ( empty($this->query_vars['feed']) ) {
                        @header('Content-type: ' . get_option('html_type') . '; charset=' . get_option('blog_charset'));
@@ -1630,7 +1648,8 @@ class WP {
                        @header("ETag: $wp_etag");
 
                        // Support for Conditional GET
                        @header("ETag: $wp_etag");
 
                        // Support for Conditional GET
-                       if (isset($_SERVER['HTTP_IF_NONE_MATCH'])) $client_etag = stripslashes($_SERVER['HTTP_IF_NONE_MATCH']);
+                       if (isset($_SERVER['HTTP_IF_NONE_MATCH']))
+                               $client_etag = stripslashes(stripslashes($_SERVER['HTTP_IF_NONE_MATCH']));
                        else $client_etag = false;
 
                        $client_last_modified = trim( $_SERVER['HTTP_IF_MODIFIED_SINCE']);
                        else $client_etag = false;
 
                        $client_last_modified = trim( $_SERVER['HTTP_IF_MODIFIED_SINCE']);
@@ -1655,6 +1674,8 @@ class WP {
                foreach ($this->public_query_vars as $wpvar) {
                        if (isset($this->query_vars[$wpvar]) && '' != $this->query_vars[$wpvar]) {
                                $this->query_string .= (strlen($this->query_string) < 1) ? '' : '&';
                foreach ($this->public_query_vars as $wpvar) {
                        if (isset($this->query_vars[$wpvar]) && '' != $this->query_vars[$wpvar]) {
                                $this->query_string .= (strlen($this->query_string) < 1) ? '' : '&';
+                               if ( !is_scalar($this->query_vars[$wpvar]) ) // Discard non-scalars.
+                                       continue;
                                $this->query_string .= $wpvar . '=' . rawurlencode($this->query_vars[$wpvar]);
                        }
                }
                                $this->query_string .= $wpvar . '=' . rawurlencode($this->query_vars[$wpvar]);
                        }
                }
@@ -1705,6 +1726,7 @@ class WP {
                if ( (0 == count($wp_query->posts)) && !is_404() && !is_search() && ( $this->did_permalink || (!empty($_SERVER['QUERY_STRING']) && (false === strpos($_SERVER['REQUEST_URI'], '?'))) ) ) {
                        $wp_query->set_404();
                        status_header( 404 );
                if ( (0 == count($wp_query->posts)) && !is_404() && !is_search() && ( $this->did_permalink || (!empty($_SERVER['QUERY_STRING']) && (false === strpos($_SERVER['REQUEST_URI'], '?'))) ) ) {
                        $wp_query->set_404();
                        status_header( 404 );
+                       nocache_headers();
                }       elseif( is_404() != true ) {
                        status_header( 200 );
                }
                }       elseif( is_404() != true ) {
                        status_header( 200 );
                }
index 53adcf20c42d26fc10ff231280c998830ca1834c..3f2ab8df08113b027e99636fff3d2a1ba842f1dc 100644 (file)
@@ -2,6 +2,12 @@
 
 // Template functions
 
 
 // Template functions
 
+function wp_comment_form_unfiltered_html_nonce() {
+       global $post;
+       if ( current_user_can('unfiltered_html') )
+               wp_nonce_field('unfiltered-html-comment_' . $post->ID, '_wp_unfiltered_html_comment', false);
+}
+
 function comments_template( $file = '/comments.php' ) {
        global $wp_query, $withcomments, $post, $wpdb, $id, $comment, $user_login, $user_ID, $user_identity;
 
 function comments_template( $file = '/comments.php' ) {
        global $wp_query, $withcomments, $post, $wpdb, $id, $comment, $user_login, $user_ID, $user_identity;
 
@@ -84,7 +90,7 @@ function wp_insert_comment($commentdata) {
        ('$comment_post_ID', '$comment_author', '$comment_author_email', '$comment_author_url', '$comment_author_IP', '$comment_date', '$comment_date_gmt', '$comment_content', '$comment_approved', '$comment_agent', '$comment_type', '$comment_parent', '$user_id')
        ");
 
        ('$comment_post_ID', '$comment_author', '$comment_author_email', '$comment_author_url', '$comment_author_IP', '$comment_date', '$comment_date_gmt', '$comment_content', '$comment_approved', '$comment_agent', '$comment_type', '$comment_parent', '$user_id')
        ");
 
-       $id = $wpdb->insert_id;
+       $id = (int) $wpdb->insert_id;
 
        if ( $comment_approved == 1) {
                $count = $wpdb->get_var("SELECT COUNT(*) FROM $wpdb->comments WHERE comment_post_ID = '$comment_post_ID' AND comment_approved = '1'");
 
        if ( $comment_approved == 1) {
                $count = $wpdb->get_var("SELECT COUNT(*) FROM $wpdb->comments WHERE comment_post_ID = '$comment_post_ID' AND comment_approved = '1'");
@@ -109,8 +115,6 @@ function wp_allow_comment($commentdata) {
        global $wpdb;
        extract($commentdata);
 
        global $wpdb;
        extract($commentdata);
 
-       $comment_user_domain = apply_filters('pre_comment_user_domain', gethostbyaddr($comment_author_IP) );
-
        // Simple duplicate check
        $dupe = "SELECT comment_ID FROM $wpdb->comments WHERE comment_post_ID = '$comment_post_ID' AND ( comment_author = '$comment_author' ";
        if ( $comment_author_email )
        // Simple duplicate check
        $dupe = "SELECT comment_ID FROM $wpdb->comments WHERE comment_post_ID = '$comment_post_ID' AND ( comment_author = '$comment_author' ";
        if ( $comment_author_email )
@@ -215,21 +219,12 @@ function wp_delete_comment($comment_id) {
        return true;
 }
 
        return true;
 }
 
-function clean_url( $url ) {
-       if ('' == $url) return $url;
-       $url = preg_replace('|[^a-z0-9-~+_.?#=&;,/:]|i', '', $url);
-       $url = str_replace(';//', '://', $url);
-       $url = (!strstr($url, '://')) ? 'http://'.$url : $url;
-       $url = preg_replace('/&([^#])(?![a-z]{2,8};)/', '&#038;$1', $url);
-       return $url;
-}
-
 function get_comments_number( $post_id = 0 ) {
        global $wpdb, $comment_count_cache, $id;
        $post_id = (int) $post_id;
 
        if ( !$post_id )
 function get_comments_number( $post_id = 0 ) {
        global $wpdb, $comment_count_cache, $id;
        $post_id = (int) $post_id;
 
        if ( !$post_id )
-               $post_id = $id;
+               $post_id = (int) $id;
 
        if ( !isset($comment_count_cache[$post_id]) )
                $comment_count_cache[$id] = $wpdb->get_var("SELECT comment_count FROM $wpdb->posts WHERE ID = '$post_id'");
 
        if ( !isset($comment_count_cache[$post_id]) )
                $comment_count_cache[$id] = $wpdb->get_var("SELECT comment_count FROM $wpdb->posts WHERE ID = '$post_id'");
@@ -315,7 +310,7 @@ function comments_popup_link($zero='No Comments', $one='1 Comment', $more='% Com
                if (!empty($CSSclass)) {
                        echo ' class="'.$CSSclass.'"';
                }
                if (!empty($CSSclass)) {
                        echo ' class="'.$CSSclass.'"';
                }
-               $title = wp_specialchars(apply_filters('the_title', get_the_title()), true);
+               $title = attribute_escape(apply_filters('the_title', get_the_title()));
                echo ' title="' . sprintf( __('Comment on %s'), $title ) .'">';
                comments_number($zero, $one, $more, $number);
                echo '</a>';
                echo ' title="' . sprintf( __('Comment on %s'), $title ) .'">';
                comments_number($zero, $one, $more, $number);
                echo '</a>';
@@ -833,7 +828,7 @@ function check_comment($author, $email, $url, $comment, $user_ip, $user_agent, $
 
        if (1 == get_settings('comment_moderation')) return false; // If moderation is set to manual
 
 
        if (1 == get_settings('comment_moderation')) return false; // If moderation is set to manual
 
-       if ( (count(explode('http:', $comment)) - 1) >= get_settings('comment_max_links') )
+       if ( preg_match_all("|(href\t*?=\t*?['\"]?)?(https?:)?//|i", $comment, $out) >= get_option('comment_max_links') )
                return false; // Check # of external links
 
        $mod_keys = trim( get_settings('moderation_keys') );
                return false; // Check # of external links
 
        $mod_keys = trim( get_settings('moderation_keys') );
@@ -897,21 +892,21 @@ function sanitize_comment_cookies() {
        if ( isset($_COOKIE['comment_author_'.COOKIEHASH]) ) {
                $comment_author = apply_filters('pre_comment_author_name', $_COOKIE['comment_author_'.COOKIEHASH]);
                $comment_author = stripslashes($comment_author);
        if ( isset($_COOKIE['comment_author_'.COOKIEHASH]) ) {
                $comment_author = apply_filters('pre_comment_author_name', $_COOKIE['comment_author_'.COOKIEHASH]);
                $comment_author = stripslashes($comment_author);
-               $comment_author = wp_specialchars($comment_author, true);
+               $comment_author = attribute_escape($comment_author);
                $_COOKIE['comment_author_'.COOKIEHASH] = $comment_author;
        }
 
        if ( isset($_COOKIE['comment_author_email_'.COOKIEHASH]) ) {
                $comment_author_email = apply_filters('pre_comment_author_email', $_COOKIE['comment_author_email_'.COOKIEHASH]);
                $comment_author_email = stripslashes($comment_author_email);
                $_COOKIE['comment_author_'.COOKIEHASH] = $comment_author;
        }
 
        if ( isset($_COOKIE['comment_author_email_'.COOKIEHASH]) ) {
                $comment_author_email = apply_filters('pre_comment_author_email', $_COOKIE['comment_author_email_'.COOKIEHASH]);
                $comment_author_email = stripslashes($comment_author_email);
-               $comment_author_email = wp_specialchars($comment_author_email, true);   
+               $comment_author_email = attribute_escape($comment_author_email);        
                $_COOKIE['comment_author_email_'.COOKIEHASH] = $comment_author_email;
        }
 
        if ( isset($_COOKIE['comment_author_url_'.COOKIEHASH]) ) {
                $comment_author_url = apply_filters('pre_comment_author_url', $_COOKIE['comment_author_url_'.COOKIEHASH]);
                $comment_author_url = stripslashes($comment_author_url);
                $_COOKIE['comment_author_email_'.COOKIEHASH] = $comment_author_email;
        }
 
        if ( isset($_COOKIE['comment_author_url_'.COOKIEHASH]) ) {
                $comment_author_url = apply_filters('pre_comment_author_url', $_COOKIE['comment_author_url_'.COOKIEHASH]);
                $comment_author_url = stripslashes($comment_author_url);
-               $comment_author_url = wp_specialchars($comment_author_url, true);
+               $comment_author_url = attribute_escape($comment_author_url);
                $_COOKIE['comment_author_url_'.COOKIEHASH] = $comment_author_url;
        }
 }
                $_COOKIE['comment_author_url_'.COOKIEHASH] = $comment_author_url;
        }
 }
index 22cf7167643184a174680c0cd581a55c837f7621..e6982a98cf152e87f0d5b613153e28d85c145a4a 100644 (file)
@@ -33,6 +33,8 @@ add_filter('pre_comment_author_name', 'wp_filter_kses');
 add_filter('pre_comment_author_email', 'wp_filter_kses');
 add_filter('pre_comment_author_url', 'wp_filter_kses');
 
 add_filter('pre_comment_author_email', 'wp_filter_kses');
 add_filter('pre_comment_author_url', 'wp_filter_kses');
 
+add_action('comment_form', 'wp_comment_form_unfiltered_html_nonce');
+
 // Default filters for these functions
 add_filter('comment_author', 'wptexturize');
 add_filter('comment_author', 'convert_chars');
 // Default filters for these functions
 add_filter('comment_author', 'wptexturize');
 add_filter('comment_author', 'convert_chars');
@@ -57,6 +59,31 @@ add_filter('pre_category_name', 'wp_filter_kses');
 add_filter('pre_category_name', 'wp_specialchars', 30);
 add_filter('pre_category_description', 'wp_filter_kses');
 
 add_filter('pre_category_name', 'wp_specialchars', 30);
 add_filter('pre_category_description', 'wp_filter_kses');
 
+//Links
+add_filter('pre_link_name', 'strip_tags');
+add_filter('pre_link_name', 'trim');
+add_filter('pre_link_name', 'wp_filter_kses');
+add_filter('pre_link_name', 'wp_specialchars', 30);
+add_filter('pre_link_description', 'wp_filter_kses');
+add_filter('pre_link_notes', 'wp_filter_kses');
+add_filter('pre_link_url', 'strip_tags');
+add_filter('pre_link_url', 'trim');
+add_filter('pre_link_url', 'clean_url');
+add_filter('pre_link_image', 'strip_tags');
+add_filter('pre_link_image', 'trim');
+add_filter('pre_link_image', 'clean_url');
+add_filter('pre_link_rss', 'strip_tags');
+add_filter('pre_link_rss', 'trim');
+add_filter('pre_link_rss', 'clean_url');
+add_filter('pre_link_target', 'strip_tags');
+add_filter('pre_link_target', 'trim');
+add_filter('pre_link_target', 'wp_filter_kses');
+add_filter('pre_link_target', 'wp_specialchars', 30);
+add_filter('pre_link_rel', 'strip_tags');
+add_filter('pre_link_rel', 'trim');
+add_filter('pre_link_rel', 'wp_filter_kses');
+add_filter('pre_link_rel', 'wp_specialchars', 30);
+
 // Users
 add_filter('pre_user_display_name', 'strip_tags');
 add_filter('pre_user_display_name', 'trim');
 // Users
 add_filter('pre_user_display_name', 'strip_tags');
 add_filter('pre_user_display_name', 'trim');
@@ -115,6 +142,9 @@ add_filter('comment_text_rss', 'ent2ncr', 8);
 add_filter('bloginfo_rss', 'ent2ncr', 8);
 add_filter('the_author', 'ent2ncr', 8);
 
 add_filter('bloginfo_rss', 'ent2ncr', 8);
 add_filter('the_author', 'ent2ncr', 8);
 
+// Misc filters
+add_filter('option_blog_charset', 'wp_specialchars');
+
 // Actions
 add_action('publish_post', 'generic_ping');
 add_action('wp_head', 'rsd_link');
 // Actions
 add_action('publish_post', 'generic_ping');
 add_action('wp_head', 'rsd_link');
index 0b377bc3017f2e30333a64f7802e8bae74186abb..6a4766986c82fbbbec4b6d0292b084c8edacdfd0 100644 (file)
@@ -134,9 +134,9 @@ function the_category_rss($type = 'rss') {
     foreach ($categories as $category) {
         $category->cat_name = convert_chars($category->cat_name);
         if ('rdf' == $type) {
     foreach ($categories as $category) {
         $category->cat_name = convert_chars($category->cat_name);
         if ('rdf' == $type) {
-            $the_list .= "\n\t<dc:subject>$category->cat_name</dc:subject>";
+            $the_list .= "\n\t\t<dc:subject>$category->cat_name</dc:subject>\n";
         } else {
         } else {
-            $the_list .= "\n\t<category>$category->cat_name</category>";
+            $the_list .= "\n\t\t<category>$category->cat_name</category>\n";
         }
     }
     echo apply_filters('the_category_rss', $the_list, $type);
         }
     }
     echo apply_filters('the_category_rss', $the_list, $type);
index 7db8ea02f1ffc1fc14f367730308353ea286ea29..217e953ea3f43ef44e8f9ba8c10a0a3c2861b1f2 100644 (file)
@@ -1,6 +1,7 @@
 <?php
 
 function wptexturize($text) {
 <?php
 
 function wptexturize($text) {
+       global $wp_cockneyreplace;
        $output = '';
        // Capture tags and everything inside them
        $textarr = preg_split("/(<.*>)/Us", $text, -1, PREG_SPLIT_DELIM_CAPTURE);
        $output = '';
        // Capture tags and everything inside them
        $textarr = preg_split("/(<.*>)/Us", $text, -1, PREG_SPLIT_DELIM_CAPTURE);
@@ -16,9 +17,15 @@ function wptexturize($text) {
                        $curl = str_replace('...', '&#8230;', $curl);
                        $curl = str_replace('``', '&#8220;', $curl);
 
                        $curl = str_replace('...', '&#8230;', $curl);
                        $curl = str_replace('``', '&#8220;', $curl);
 
-                       // This is a hack, look at this more later. It works pretty well though.
-                       $cockney = array("'tain't","'twere","'twas","'tis","'twill","'til","'bout","'nuff","'round","'cause");
-                       $cockneyreplace = array("&#8217;tain&#8217;t","&#8217;twere","&#8217;twas","&#8217;tis","&#8217;twill","&#8217;til","&#8217;bout","&#8217;nuff","&#8217;round","&#8217;cause");
+                       // if a plugin has provided an autocorrect array, use it
+                       if ( isset($wp_cockneyreplace) ) {
+                               $cockney = array_keys($wp_cockneyreplace);
+                               $cockney_replace = array_values($wp_cockneyreplace);
+                       } else {
+                               $cockney = array("'tain't","'twere","'twas","'tis","'twill","'til","'bout","'nuff","'round","'cause");
+                               $cockneyreplace = array("&#8217;tain&#8217;t","&#8217;twere","&#8217;twas","&#8217;tis","&#8217;twill","&#8217;til","&#8217;bout","&#8217;nuff","&#8217;round","&#8217;cause");
+                       }
+
                        $curl = str_replace($cockney, $cockneyreplace, $curl);
 
                        $curl = preg_replace("/'s/", '&#8217;s', $curl);
                        $curl = str_replace($cockney, $cockneyreplace, $curl);
 
                        $curl = preg_replace("/'s/", '&#8217;s', $curl);
@@ -72,7 +79,7 @@ function wpautop($pee, $br = 1) {
        $pee = preg_replace('!(</?(?:table|thead|tfoot|caption|colgroup|tbody|tr|td|th|div|dl|dd|dt|ul|ol|li|pre|select|form|blockquote|address|math|p|h[1-6])[^>]*>)\s*</p>!', "$1", $pee); 
        if ($br) $pee = preg_replace('|(?<!<br />)\s*\n|', "<br />\n", $pee); // optionally make line breaks
        $pee = preg_replace('!(</?(?:table|thead|tfoot|caption|tbody|tr|td|th|div|dl|dd|dt|ul|ol|li|pre|select|form|blockquote|address|math|p|h[1-6])[^>]*>)\s*<br />!', "$1", $pee);
        $pee = preg_replace('!(</?(?:table|thead|tfoot|caption|colgroup|tbody|tr|td|th|div|dl|dd|dt|ul|ol|li|pre|select|form|blockquote|address|math|p|h[1-6])[^>]*>)\s*</p>!', "$1", $pee); 
        if ($br) $pee = preg_replace('|(?<!<br />)\s*\n|', "<br />\n", $pee); // optionally make line breaks
        $pee = preg_replace('!(</?(?:table|thead|tfoot|caption|tbody|tr|td|th|div|dl|dd|dt|ul|ol|li|pre|select|form|blockquote|address|math|p|h[1-6])[^>]*>)\s*<br />!', "$1", $pee);
-       $pee = preg_replace('!<br />(\s*</?(?:p|li|div|dl|dd|dt|th|pre|td|ul|ol)>)!', '$1', $pee);
+       $pee = preg_replace('!<br />(\s*</?(?:p|li|div|dl|dd|dt|th|pre|td|ul|ol)[^>]*>)!', '$1', $pee);
        $pee = preg_replace('!(<pre.*?>)(.*?)</pre>!ise', " stripslashes('$1') .  stripslashes(clean_pre('$2'))  . '</pre>' ", $pee);
        
        return $pee; 
        $pee = preg_replace('!(<pre.*?>)(.*?)</pre>!ise', " stripslashes('$1') .  stripslashes(clean_pre('$2'))  . '</pre>' ", $pee);
        
        return $pee; 
@@ -245,8 +252,10 @@ function remove_accents($string) {
                chr(197).chr(188) => 'z', chr(197).chr(189) => 'Z',
                chr(197).chr(190) => 'z', chr(197).chr(191) => 's',
                // Euro Sign
                chr(197).chr(188) => 'z', chr(197).chr(189) => 'Z',
                chr(197).chr(190) => 'z', chr(197).chr(191) => 's',
                // Euro Sign
-               chr(226).chr(130).chr(172) => 'E');
-               
+               chr(226).chr(130).chr(172) => 'E',
+               // GBP (Pound) Sign
+               chr(194).chr(163) => '');
+
                $string = strtr($string, $chars);
        } else {
                // Assume ISO-8859-1 if not UTF-8
                $string = strtr($string, $chars);
        } else {
                // Assume ISO-8859-1 if not UTF-8
@@ -390,26 +399,27 @@ function funky_javascript_fix($text) {
 
 /*
  balanceTags
 
 /*
  balanceTags
+
  Balances Tags of string using a modified stack.
  Balances Tags of string using a modified stack.
+
  @param text      Text to be balanced
  @param text      Text to be balanced
+ @param force     Forces balancing, ignoring the value of the option
  @return          Returns balanced text
  @author          Leonard Lin (leonard@acm.org)
  @version         v1.1
  @date            November 4, 2001
  @license         GPL v2.0
  @return          Returns balanced text
  @author          Leonard Lin (leonard@acm.org)
  @version         v1.1
  @date            November 4, 2001
  @license         GPL v2.0
- @notes           
- @changelog       
+ @notes
+ @changelog
  ---  Modified by Scott Reilly (coffee2code) 02 Aug 2004
  ---  Modified by Scott Reilly (coffee2code) 02 Aug 2004
-             1.2  ***TODO*** Make better - change loop condition to $text
-             1.1  Fixed handling of append/stack pop order of end text
-                  Added Cleaning Hooks
-             1.0  First Version
+       1.2  ***TODO*** Make better - change loop condition to $text
+       1.1  Fixed handling of append/stack pop order of end text
+            Added Cleaning Hooks
+       1.0  First Version
 */
 */
-function balanceTags($text, $is_comment = 0) {
-       
-       if ( get_option('use_balanceTags') == 0)
+function balanceTags($text, $force = false) {
+
+       if ( !$force && get_option('use_balanceTags') == 0 )
                return $text;
 
        $tagstack = array(); $stacksize = 0; $tagqueue = ''; $newtext = '';
                return $text;
 
        $tagstack = array(); $stacksize = 0; $tagqueue = ''; $newtext = '';
@@ -431,7 +441,7 @@ function balanceTags($text, $is_comment = 0) {
                if ($regex[1][0] == "/") { // End Tag
                        $tag = strtolower(substr($regex[1],1));
                        // if too many closing tags
                if ($regex[1][0] == "/") { // End Tag
                        $tag = strtolower(substr($regex[1],1));
                        // if too many closing tags
-                       if($stacksize <= 0) { 
+                       if($stacksize <= 0) {
                                $tag = '';
                                //or close to be safe $tag = '/' . $tag;
                        }
                                $tag = '';
                                //or close to be safe $tag = '/' . $tag;
                        }
@@ -488,7 +498,7 @@ function balanceTags($text, $is_comment = 0) {
                }
                $newtext .= substr($text,0,$i) . $tag;
                $text = substr($text,$i+$l);
                }
                $newtext .= substr($text,0,$i) . $tag;
                $text = substr($text,$i+$l);
-       }  
+       }
 
        // Clear Tag Queue
        $newtext .= $tagqueue;
 
        // Clear Tag Queue
        $newtext .= $tagqueue;
@@ -509,7 +519,7 @@ function balanceTags($text, $is_comment = 0) {
 }
 
 function force_balance_tags($text) {
 }
 
 function force_balance_tags($text) {
-       return balanceTags($text, 0, true);
+       return balanceTags($text, true);
 }
 
 function format_to_edit($content, $richedit = false) {
 }
 
 function format_to_edit($content, $richedit = false) {
@@ -582,16 +592,24 @@ function antispambot($emailaddy, $mailto=0) {
 
 function make_clickable($ret) {
        $ret = ' ' . $ret;
 
 function make_clickable($ret) {
        $ret = ' ' . $ret;
-       $ret = preg_replace("#(^|[\n ])([\w]+?://[\w\#$%&~/.\-;:=,?@\[\]+]*)#is", "$1<a href='$2' rel='nofollow'>$2</a>", $ret);
-       $ret = preg_replace("#(^|[\n ])((www|ftp)\.[\w\#$%&~/.\-;:=,?@\[\]+]*)#is", "$1<a href='http://$2' rel='nofollow'>$2</a>", $ret);
-       $ret = preg_replace("#(\s)([a-z0-9\-_.]+)@([^,< \n\r]+)#i", "$1<a href=\"mailto:$2@$3\">$2@$3</a>", $ret);
-       $ret = substr($ret, 1);
+       // in testing, using arrays here was found to be faster
+       $ret = preg_replace(
+               array(
+                       '#([\s>])([\w]+?://[\w\#$%&~/.\-;:=,?@\[\]+]*)#is',
+                       '#([\s>])((www|ftp)\.[\w\#$%&~/.\-;:=,?@\[\]+]*)#is',
+                       '#([\s>])([a-z0-9\-_.]+)@([^,< \n\r]+)#i'),
+               array(
+                       '$1<a href="$2" rel="nofollow">$2</a>',
+                       '$1<a href="http://$2" rel="nofollow">$2</a>',
+                       '$1<a href="mailto:$2@$3">$2@$3</a>'),$ret);
+       // this one is not in an array because we need it to run last, for cleanup of accidental links within links
+       $ret = preg_replace("#(<a( [^>]+?>|>))<a [^>]+?>([^>]+?)</a></a>#i", "$1$3</a>", $ret);
        $ret = trim($ret);
        return $ret;
 }
 
 function wp_rel_nofollow( $text ) {
        $ret = trim($ret);
        return $ret;
 }
 
 function wp_rel_nofollow( $text ) {
-       $text = preg_replace('|<a (.+?)>|i', '<a $1 rel="nofollow">', $text);
+       $text = preg_replace('|<a (.+?)>|ie', "'<a ' . str_replace(' rel=\"nofollow\"','',stripslashes('$1')) . ' rel=\"nofollow\">'", $text);
        return $text;
 }
 
        return $text;
 }
 
@@ -1027,10 +1045,37 @@ function wp_richedit_pre($text) {
        return apply_filters('richedit_pre', $output);
 }
 
        return apply_filters('richedit_pre', $output);
 }
 
+function clean_url( $url, $protocols = null ) {
+       if ('' == $url) return $url;
+       $url = preg_replace('|[^a-z0-9-~+_.?#=!&;,/:%]|i', '', $url);
+       $strip = array('%0d', '%0a');
+       $url = str_replace($strip, '', $url);
+       $url = str_replace(';//', '://', $url);
+       // Append http unless a relative link starting with / or a php file.
+       if ( strpos($url, '://') === false &&
+               substr( $url, 0, 1 ) != '/' && !preg_match('/^[a-z0-9]+?\.php/i', $url) )
+               $url = 'http://' . $url;
+       
+       $url = preg_replace('/&([^#])(?![a-z]{2,8};)/', '&#038;$1', $url);
+       if ( !is_array($protocols) )
+               $protocols = array('http', 'https', 'ftp', 'ftps', 'mailto', 'news', 'irc', 'gopher', 'nntp', 'feed', 'telnet'); 
+       if ( wp_kses_bad_protocol( $url, $protocols ) != $url )
+               return '';
+       return $url;
+}
+
 // Escape single quotes, specialchar double quotes, and fix line endings.
 function js_escape($text) {
 // Escape single quotes, specialchar double quotes, and fix line endings.
 function js_escape($text) {
-       $text = wp_specialchars($text, 'double');
-       $text = str_replace('&#039;', "'", $text);
-       return preg_replace("/\r?\n/", "\\n", addslashes($text));
+       $safe_text = wp_specialchars($text, 'double');
+       $safe_text = preg_replace('/&#(x)?0*(?(1)27|39);?/i', "'", stripslashes($safe_text));
+       $safe_text = preg_replace("/\r?\n/", "\\n", addslashes($safe_text));
+       return apply_filters('js_escape', $safe_text, $text);
 }
 }
+
+// Escaping for HTML attributes
+function attribute_escape($text) {
+       $safe_text = wp_specialchars($text, true);
+       return apply_filters('attribute_escape', $safe_text, $text);
+}
+
 ?>
 ?>
index 14e46695c8f61847af22ed5b91df97c5ed153d79..2176ef0e4d7a18d01b09ea90b6d35cb64588a686 100644 (file)
@@ -24,6 +24,7 @@ function wp_insert_post($postarr = array()) {
 
        // Get the basics.
        $post_content    = apply_filters('content_save_pre',   $post_content);
 
        // Get the basics.
        $post_content    = apply_filters('content_save_pre',   $post_content);
+       $post_content_filtered = apply_filters('content_filtered_save_pre',   $post_content_filtered);
        $post_excerpt    = apply_filters('excerpt_save_pre',   $post_excerpt);
        $post_title      = apply_filters('title_save_pre',     $post_title);
        $post_category   = apply_filters('category_save_pre',  $post_category);
        $post_excerpt    = apply_filters('excerpt_save_pre',   $post_excerpt);
        $post_title      = apply_filters('title_save_pre',     $post_title);
        $post_category   = apply_filters('category_save_pre',  $post_category);
@@ -46,7 +47,7 @@ function wp_insert_post($postarr = array()) {
        
        // Get the post ID.
        if ( $update )
        
        // Get the post ID.
        if ( $update )
-               $post_ID = $ID;
+               $post_ID = (int) $ID;
 
        // Create a valid post name.  Drafts are allowed to have an empty
        // post name.
 
        // Create a valid post name.  Drafts are allowed to have an empty
        // post name.
@@ -221,6 +222,7 @@ function wp_insert_attachment($object, $file = false, $post_parent = 0) {
 
        // Get the basics.
        $post_content    = apply_filters('content_save_pre',   $post_content);
 
        // Get the basics.
        $post_content    = apply_filters('content_save_pre',   $post_content);
+       $post_content_filtered = apply_filters('content_filtered_save_pre',   $post_content_filtered);
        $post_excerpt    = apply_filters('excerpt_save_pre',   $post_excerpt);
        $post_title      = apply_filters('title_save_pre',     $post_title);
        $post_category   = apply_filters('category_save_pre',  $post_category);
        $post_excerpt    = apply_filters('excerpt_save_pre',   $post_excerpt);
        $post_title      = apply_filters('title_save_pre',     $post_title);
        $post_category   = apply_filters('category_save_pre',  $post_category);
@@ -302,6 +304,7 @@ function wp_insert_attachment($object, $file = false, $post_parent = 0) {
                        post_date = '$post_date',
                        post_date_gmt = '$post_date_gmt',
                        post_content = '$post_content',
                        post_date = '$post_date',
                        post_date_gmt = '$post_date_gmt',
                        post_content = '$post_content',
+                       post_content_filtered = '$post_content_filtered',
                        post_title = '$post_title',
                        post_excerpt = '$post_excerpt',
                        post_status = '$post_status',
                        post_title = '$post_title',
                        post_excerpt = '$post_excerpt',
                        post_status = '$post_status',
@@ -321,9 +324,9 @@ function wp_insert_attachment($object, $file = false, $post_parent = 0) {
        } else {
                $wpdb->query(
                        "INSERT INTO $wpdb->posts
        } else {
                $wpdb->query(
                        "INSERT INTO $wpdb->posts
-                       (post_author, post_date, post_date_gmt, post_content, post_title, post_excerpt,  post_status, comment_status, ping_status, post_password, post_name, to_ping, pinged, post_modified, post_modified_gmt, post_parent, menu_order, post_mime_type, guid)
+                       (post_author, post_date, post_date_gmt, post_content, post_content_filtered, post_title, post_excerpt,  post_status, comment_status, ping_status, post_password, post_name, to_ping, pinged, post_modified, post_modified_gmt, post_parent, menu_order, post_mime_type, guid)
                        VALUES
                        VALUES
-                       ('$post_author', '$post_date', '$post_date_gmt', '$post_content', '$post_title', '$post_excerpt', '$post_status', '$comment_status', '$ping_status', '$post_password', '$post_name', '$to_ping', '$pinged', '$post_date', '$post_date_gmt', '$post_parent', '$menu_order', '$post_mime_type', '$guid')");
+                       ('$post_author', '$post_date', '$post_date_gmt', '$post_content', '$post_content_filtered', '$post_title', '$post_excerpt', '$post_status', '$comment_status', '$ping_status', '$post_password', '$post_name', '$to_ping', '$pinged', '$post_date', '$post_date_gmt', '$post_parent', '$menu_order', '$post_mime_type', '$guid')");
                        $post_ID = $wpdb->insert_id;                    
        }
        
                        $post_ID = $wpdb->insert_id;                    
        }
        
@@ -403,6 +406,7 @@ function wp_get_recent_posts($num = 10) {
        global $wpdb;
 
        // Set the limit clause, if we got a limit
        global $wpdb;
 
        // Set the limit clause, if we got a limit
+       $num = (int) $num;
        if ($num) {
                $limit = "LIMIT $num";
        }
        if ($num) {
                $limit = "LIMIT $num";
        }
@@ -473,6 +477,9 @@ function wp_get_post_cats($blogid = '1', $post_ID = 0) {
 
 function wp_set_post_cats($blogid = '1', $post_ID = 0, $post_categories = array()) {
        global $wpdb;
 
 function wp_set_post_cats($blogid = '1', $post_ID = 0, $post_categories = array()) {
        global $wpdb;
+       
+       $post_ID = (int) $post_ID;
+
        // If $post_categories isn't already an array, make it one:
        if (!is_array($post_categories) || 0 == count($post_categories))
                $post_categories = array(get_option('default_category'));
        // If $post_categories isn't already an array, make it one:
        if (!is_array($post_categories) || 0 == count($post_categories))
                $post_categories = array(get_option('default_category'));
@@ -483,7 +490,7 @@ function wp_set_post_cats($blogid = '1', $post_ID = 0, $post_categories = array(
        $old_categories = $wpdb->get_col("
                SELECT category_id 
                FROM $wpdb->post2cat 
        $old_categories = $wpdb->get_col("
                SELECT category_id 
                FROM $wpdb->post2cat 
-               WHERE post_id = $post_ID");
+               WHERE post_id = '$post_ID'");
        
        if (!$old_categories) {
                $old_categories = array();
        
        if (!$old_categories) {
                $old_categories = array();
@@ -498,8 +505,8 @@ function wp_set_post_cats($blogid = '1', $post_ID = 0, $post_categories = array(
                foreach ($delete_cats as $del) {
                        $wpdb->query("
                                DELETE FROM $wpdb->post2cat 
                foreach ($delete_cats as $del) {
                        $wpdb->query("
                                DELETE FROM $wpdb->post2cat 
-                               WHERE category_id = $del 
-                                       AND post_id = $post_ID 
+                               WHERE category_id = '$del' 
+                                       AND post_id = '$post_ID' 
                                ");
                }
        }
                                ");
                }
        }
@@ -509,12 +516,14 @@ function wp_set_post_cats($blogid = '1', $post_ID = 0, $post_categories = array(
 
        if ($add_cats) {
                foreach ($add_cats as $new_cat) {
 
        if ($add_cats) {
                foreach ($add_cats as $new_cat) {
-                       $wpdb->query("
-                               INSERT INTO $wpdb->post2cat (post_id, category_id) 
-                               VALUES ($post_ID, $new_cat)");
+                       $new_cat = (int) $new_cat;
+                       if ( !empty($new_cat) )
+                               $wpdb->query("
+                                       INSERT INTO $wpdb->post2cat (post_id, category_id) 
+                                       VALUES ('$post_ID', '$new_cat')");
                }
        }
                }
        }
-       
+
        // Update category counts.
        $all_affected_cats = array_unique(array_merge($post_categories, $old_categories));
        foreach ( $all_affected_cats as $cat_id ) {
        // Update category counts.
        $all_affected_cats = array_unique(array_merge($post_categories, $old_categories));
        foreach ( $all_affected_cats as $cat_id ) {
@@ -549,6 +558,8 @@ function wp_delete_post($postid = 0) {
        if ( 'static' == $post->post_status )
                $wpdb->query("UPDATE $wpdb->posts SET post_parent = $post->post_parent WHERE post_parent = $postid AND post_status = 'static'");
 
        if ( 'static' == $post->post_status )
                $wpdb->query("UPDATE $wpdb->posts SET post_parent = $post->post_parent WHERE post_parent = $postid AND post_status = 'static'");
 
+       $wpdb->query("UPDATE $wpdb->posts SET post_parent = $post->post_parent WHERE post_parent = $postid AND post_status = 'attachment'");
+
        $wpdb->query("DELETE FROM $wpdb->posts WHERE ID = $postid");
        
        $wpdb->query("DELETE FROM $wpdb->comments WHERE comment_post_ID = $postid");
        $wpdb->query("DELETE FROM $wpdb->posts WHERE ID = $postid");
        
        $wpdb->query("DELETE FROM $wpdb->comments WHERE comment_post_ID = $postid");
@@ -683,6 +694,7 @@ function wp_blacklist_check($author, $email, $url, $comment, $user_ip, $user_age
 
 function wp_proxy_check($ipnum) {
        if ( get_option('open_proxy_check') && isset($ipnum) ) {
 
 function wp_proxy_check($ipnum) {
        if ( get_option('open_proxy_check') && isset($ipnum) ) {
+               $ipnum = preg_replace( '/([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}).*/', '$1', $ipnum );
                $rev_ip = implode( '.', array_reverse( explode( '.', $ipnum ) ) );
                $lookup = $rev_ip . '.sbl-xbl.spamhaus.org.';
                if ( $lookup != gethostbyname( $lookup ) )
                $rev_ip = implode( '.', array_reverse( explode( '.', $ipnum ) ) );
                $lookup = $rev_ip . '.sbl-xbl.spamhaus.org.';
                if ( $lookup != gethostbyname( $lookup ) )
index 83a00ef027d0b34276ffb9dcb21a7e5533a29e0e..8968c6567bf45dc3925c47201221323bd12c4052 100644 (file)
@@ -171,6 +171,7 @@ function user_pass_ok($user_login,$user_pass) {
 
 function get_usernumposts($userid) {
        global $wpdb;
 
 function get_usernumposts($userid) {
        global $wpdb;
+       $userid = (int) $userid;
        return $wpdb->get_var("SELECT COUNT(*) FROM $wpdb->posts WHERE post_author = '$userid' AND post_status = 'publish'");
 }
 
        return $wpdb->get_var("SELECT COUNT(*) FROM $wpdb->posts WHERE post_author = '$userid' AND post_status = 'publish'");
 }
 
@@ -262,14 +263,43 @@ function url_to_postid($url) {
 
 
 function maybe_unserialize($original) {
 
 
 function maybe_unserialize($original) {
-       if ( false !== $gm = @ unserialize($original) )
-               return $gm;
-       else
-               return $original;
+       if ( is_serialized($original) ) // don't attempt to unserialize data that wasn't serialized going in
+               if ( false !== $gm = @ unserialize($original) )
+                       return $gm;
+       return $original;
+}
+
+function maybe_serialize($data) {
+       if ( is_string($data) )
+               $data = trim($data);
+       elseif ( is_array($data) || is_object($data) )
+               return serialize($data);
+       if ( is_serialized($data) )
+               return serialize($data);
+       return $data;
+}
+
+function is_serialized($data) {
+       if ( !is_string($data) ) // if it isn't a string, it isn't serialized
+               return false;
+       $data = trim($data);
+       if ( preg_match("/^[adobis]:[0-9]+:.*[;}]/si",$data) ) // this should fetch all legitimately serialized data
+               return true;
+       return false;
+}
+
+function is_serialized_string($data) {
+       if ( !is_string($data) ) // if it isn't a string, it isn't a serialized string
+               return false;
+       $data = trim($data);
+       if ( preg_match("/^s:[0-9]+:.*[;}]/si",$data) ) // this should fetch all serialized strings
+               return true;
+       return false;
 }
 
 /* Options functions */
 
 }
 
 /* Options functions */
 
+// expects $setting to already be SQL-escaped
 function get_settings($setting) {
        global $wpdb;
 
 function get_settings($setting) {
        global $wpdb;
 
@@ -321,7 +351,7 @@ function get_user_option( $option, $user = 0 ) {
 }
 
 function form_option($option) {
 }
 
 function form_option($option) {
-       echo htmlspecialchars( get_option($option), ENT_QUOTES );
+       echo attribute_escape( get_option($option));
 }
 
 function get_alloptions() {
 }
 
 function get_alloptions() {
@@ -347,14 +377,17 @@ function get_alloptions() {
        return apply_filters('all_options', $all_options);
 }
 
        return apply_filters('all_options', $all_options);
 }
 
+// expects $option_name to NOT be SQL-escaped
 function update_option($option_name, $newvalue) {
        global $wpdb;
 
 function update_option($option_name, $newvalue) {
        global $wpdb;
 
+       $safe_option_name = $wpdb->escape($option_name);
+
        if ( is_string($newvalue) )
                $newvalue = trim($newvalue);
 
        // If the new and old values are the same, no need to update.
        if ( is_string($newvalue) )
                $newvalue = trim($newvalue);
 
        // If the new and old values are the same, no need to update.
-       $oldvalue = get_option($option_name);
+       $oldvalue = get_option($safe_option_name);
        if ( $newvalue == $oldvalue ) {
                return false;
        }
        if ( $newvalue == $oldvalue ) {
                return false;
        }
@@ -365,8 +398,7 @@ function update_option($option_name, $newvalue) {
        }
 
        $_newvalue = $newvalue;
        }
 
        $_newvalue = $newvalue;
-       if ( is_array($newvalue) || is_object($newvalue) )
-               $newvalue = serialize($newvalue);
+       $newvalue = maybe_serialize($newvalue);
 
        wp_cache_set($option_name, $newvalue, 'options');
 
 
        wp_cache_set($option_name, $newvalue, 'options');
 
@@ -388,15 +420,17 @@ function update_user_option( $user_id, $option_name, $newvalue, $global = false
 }
 
 // thx Alex Stapleton, http://alex.vort-x.net/blog/
 }
 
 // thx Alex Stapleton, http://alex.vort-x.net/blog/
+// expects $name to NOT be SQL-escaped
 function add_option($name, $value = '', $description = '', $autoload = 'yes') {
        global $wpdb;
 
 function add_option($name, $value = '', $description = '', $autoload = 'yes') {
        global $wpdb;
 
+       $safe_name = $wpdb->escape($name);
+
        // Make sure the option doesn't already exist
        // Make sure the option doesn't already exist
-       if ( false !== get_option($name) )
+       if ( false !== get_option($safe_name) )
                return;
 
                return;
 
-       if ( is_array($value) || is_object($value) )
-               $value = serialize($value);
+       $value = maybe_serialize($value);
 
        wp_cache_set($name, $value, 'options');
 
 
        wp_cache_set($name, $value, 'options');
 
@@ -421,20 +455,20 @@ function delete_option($name) {
 function add_post_meta($post_id, $key, $value, $unique = false) {
        global $wpdb, $post_meta_cache;
 
 function add_post_meta($post_id, $key, $value, $unique = false) {
        global $wpdb, $post_meta_cache;
 
+       $post_id = (int) $post_id;
+
        if ( $unique ) {
        if ( $unique ) {
-               if ( $wpdb->get_var("SELECT meta_key FROM $wpdb->postmeta WHERE meta_key
-= '$key' AND post_id = '$post_id'") ) {
+               if ( $wpdb->get_var("SELECT meta_key FROM $wpdb->postmeta WHERE meta_key = '$key' AND post_id = '$post_id'") ) {
                        return false;
                }
        }
 
                        return false;
                }
        }
 
-       $original = $value;
-       if ( is_array($value) || is_object($value) )
-               $value = $wpdb->escape(serialize($value));
+       $post_meta_cache[$post_id][$key][] = $value;
 
 
-       $wpdb->query("INSERT INTO $wpdb->postmeta (post_id,meta_key,meta_value) VALUES ('$post_id','$key','$value')");
+       $value = maybe_serialize($value);
+       $value = $wpdb->escape($value);
 
 
-       $post_meta_cache['$post_id'][$key][] = $original;
+       $wpdb->query("INSERT INTO $wpdb->postmeta (post_id,meta_key,meta_value) VALUES ('$post_id','$key','$value')");
 
        return true;
 }
 
        return true;
 }
@@ -442,31 +476,29 @@ function add_post_meta($post_id, $key, $value, $unique = false) {
 function delete_post_meta($post_id, $key, $value = '') {
        global $wpdb, $post_meta_cache;
 
 function delete_post_meta($post_id, $key, $value = '') {
        global $wpdb, $post_meta_cache;
 
+       $post_id = (int) $post_id;
+
        if ( empty($value) ) {
        if ( empty($value) ) {
-               $meta_id = $wpdb->get_var("SELECT meta_id FROM $wpdb->postmeta WHERE
-post_id = '$post_id' AND meta_key = '$key'");
+               $meta_id = $wpdb->get_var("SELECT meta_id FROM $wpdb->postmeta WHERE post_id = '$post_id' AND meta_key = '$key'");
        } else {
        } else {
-               $meta_id = $wpdb->get_var("SELECT meta_id FROM $wpdb->postmeta WHERE
-post_id = '$post_id' AND meta_key = '$key' AND meta_value = '$value'");
+               $meta_id = $wpdb->get_var("SELECT meta_id FROM $wpdb->postmeta WHERE post_id = '$post_id' AND meta_key = '$key' AND meta_value = '$value'");
        }
 
        if ( !$meta_id )
                return false;
 
        if ( empty($value) ) {
        }
 
        if ( !$meta_id )
                return false;
 
        if ( empty($value) ) {
-               $wpdb->query("DELETE FROM $wpdb->postmeta WHERE post_id = '$post_id'
-AND meta_key = '$key'");
-               unset($post_meta_cache['$post_id'][$key]);
+               $wpdb->query("DELETE FROM $wpdb->postmeta WHERE post_id = '$post_id' AND meta_key = '$key'");
+               unset($post_meta_cache[$post_id][$key]);
        } else {
        } else {
-               $wpdb->query("DELETE FROM $wpdb->postmeta WHERE post_id = '$post_id'
-AND meta_key = '$key' AND meta_value = '$value'");
-               $cache_key = $post_meta_cache['$post_id'][$key];
+               $wpdb->query("DELETE FROM $wpdb->postmeta WHERE post_id = '$post_id' AND meta_key = '$key' AND meta_value = '$value'");
+               $cache_key = $post_meta_cache[$post_id][$key];
                if ($cache_key) foreach ( $cache_key as $index => $data )
                        if ( $data == $value )
                if ($cache_key) foreach ( $cache_key as $index => $data )
                        if ( $data == $value )
-                               unset($post_meta_cache['$post_id'][$key][$index]);
+                               unset($post_meta_cache[$post_id][$key][$index]);
        }
 
        }
 
-       unset($post_meta_cache['$post_id'][$key]);
+       unset($post_meta_cache[$post_id][$key]);
 
        return true;
 }
 
        return true;
 }
@@ -474,6 +506,8 @@ AND meta_key = '$key' AND meta_value = '$value'");
 function get_post_meta($post_id, $key, $single = false) {
        global $wpdb, $post_meta_cache;
 
 function get_post_meta($post_id, $key, $single = false) {
        global $wpdb, $post_meta_cache;
 
+       $post_id = (int) $post_id;
+
        if ( isset($post_meta_cache[$post_id][$key]) ) {
                if ( $single ) {
                        return maybe_unserialize( $post_meta_cache[$post_id][$key][0] );
        if ( isset($post_meta_cache[$post_id][$key]) ) {
                if ( $single ) {
                        return maybe_unserialize( $post_meta_cache[$post_id][$key][0] );
@@ -507,34 +541,33 @@ function get_post_meta($post_id, $key, $single = false) {
 function update_post_meta($post_id, $key, $value, $prev_value = '') {
        global $wpdb, $post_meta_cache;
 
 function update_post_meta($post_id, $key, $value, $prev_value = '') {
        global $wpdb, $post_meta_cache;
 
+       $post_id = (int) $post_id;
+
        $original_value = $value;
        $original_value = $value;
-       if ( is_array($value) || is_object($value) )
-               $value = $wpdb->escape(serialize($value));
+       $value = maybe_serialize($value);
+       $value = $wpdb->escape($value);
 
        $original_prev = $prev_value;
 
        $original_prev = $prev_value;
-       if ( is_array($prev_value) || is_object($prev_value) )
-               $prev_value = $wpdb->escape(serialize($prev_value));
+       $prev_value = maybe_serialize($prev_value);
+       $prev_value = $wpdb->escape($prev_value);
 
 
-       if (! $wpdb->get_var("SELECT meta_key FROM $wpdb->postmeta WHERE meta_key
-= '$key' AND post_id = '$post_id'") ) {
+       if (! $wpdb->get_var("SELECT meta_key FROM $wpdb->postmeta WHERE meta_key = '$key' AND post_id = '$post_id'") ) {
                return false;
        }
 
        if ( empty($prev_value) ) {
                return false;
        }
 
        if ( empty($prev_value) ) {
-               $wpdb->query("UPDATE $wpdb->postmeta SET meta_value = '$value' WHERE
-meta_key = '$key' AND post_id = '$post_id'");
-               $cache_key = $post_meta_cache['$post_id'][$key];
+               $wpdb->query("UPDATE $wpdb->postmeta SET meta_value = '$value' WHERE meta_key = '$key' AND post_id = '$post_id'");
+               $cache_key = $post_meta_cache[$post_id][$key];
                if ( !empty($cache_key) )
                        foreach ($cache_key as $index => $data)
                if ( !empty($cache_key) )
                        foreach ($cache_key as $index => $data)
-                               $post_meta_cache['$post_id'][$key][$index] = $original_value;
+                               $post_meta_cache[$post_id][$key][$index] = $original_value;
        } else {
        } else {
-               $wpdb->query("UPDATE $wpdb->postmeta SET meta_value = '$value' WHERE
-meta_key = '$key' AND post_id = '$post_id' AND meta_value = '$prev_value'");
-               $cache_key = $post_meta_cache['$post_id'][$key];
+               $wpdb->query("UPDATE $wpdb->postmeta SET meta_value = '$value' WHERE meta_key = '$key' AND post_id = '$post_id' AND meta_value = '$prev_value'");
+               $cache_key = $post_meta_cache[$post_id][$key];
                if ( !empty($cache_key) )
                        foreach ($cache_key as $index => $data)
                                if ( $data == $original_prev )
                if ( !empty($cache_key) )
                        foreach ($cache_key as $index => $data)
                                if ( $data == $original_prev )
-                                       $post_meta_cache['$post_id'][$key][$index] = $original_value;
+                                       $post_meta_cache[$post_id][$key][$index] = $original_value;
        }
 
        return true;
        }
 
        return true;
@@ -581,6 +614,7 @@ function &get_post(&$post, $output = OBJECT) {
                        $post_cache[$post->ID] = &$post;
                $_post = & $post_cache[$post->ID];
        } else {
                        $post_cache[$post->ID] = &$post;
                $_post = & $post_cache[$post->ID];
        } else {
+               $post = (int) $post;
                if ( $_post = wp_cache_get($post, 'pages') )
                        return get_page($_post, $output);
                elseif ( isset($post_cache[$post]) )
                if ( $_post = wp_cache_get($post, 'pages') )
                        return get_page($_post, $output);
                elseif ( isset($post_cache[$post]) )
@@ -684,6 +718,7 @@ function &get_page(&$page, $output = OBJECT) {
                wp_cache_add($page->ID, $page, 'pages');
                $_page = $page;
        } else {
                wp_cache_add($page->ID, $page, 'pages');
                $_page = $page;
        } else {
+               $page = (int) $page;
                if ( isset($GLOBALS['page']) && ($page == $GLOBALS['page']->ID) ) {
                        $_page = & $GLOBALS['page'];
                        wp_cache_add($_page->ID, $_page, 'pages');
                if ( isset($GLOBALS['page']) && ($page == $GLOBALS['page']->ID) ) {
                        $_page = & $GLOBALS['page'];
                        wp_cache_add($_page->ID, $_page, 'pages');
@@ -742,6 +777,7 @@ function &get_category(&$category, $output = OBJECT) {
                wp_cache_add($category->cat_ID, $category, 'category');
                $_category = $category;
        } else {
                wp_cache_add($category->cat_ID, $category, 'category');
                $_category = $category;
        } else {
+               $category = (int) $category;
                if ( ! $_category = wp_cache_get($category, 'category') ) {
                        $_category = $wpdb->get_row("SELECT * FROM $wpdb->categories WHERE cat_ID = '$category' LIMIT 1");
                        wp_cache_add($category, $_category, 'category');
                if ( ! $_category = wp_cache_get($category, 'category') ) {
                        $_category = $wpdb->get_row("SELECT * FROM $wpdb->categories WHERE cat_ID = '$category' LIMIT 1");
                        wp_cache_add($category, $_category, 'category');
@@ -779,6 +815,7 @@ function &get_comment(&$comment, $output = OBJECT) {
                        $comment_cache[$comment->comment_ID] = &$comment;
                $_comment = & $comment_cache[$comment->comment_ID];
        } else {
                        $comment_cache[$comment->comment_ID] = &$comment;
                $_comment = & $comment_cache[$comment->comment_ID];
        } else {
+               $comment = (int) $comment;
                if ( !isset($comment_cache[$comment]) ) {
                        $_comment = $wpdb->get_row("SELECT * FROM $wpdb->comments WHERE comment_ID = '$comment' LIMIT 1");
                        $comment_cache[$comment->comment_ID] = & $_comment;
                if ( !isset($comment_cache[$comment]) ) {
                        $_comment = $wpdb->get_row("SELECT * FROM $wpdb->comments WHERE comment_ID = '$comment' LIMIT 1");
                        $comment_cache[$comment->comment_ID] = & $_comment;
@@ -844,9 +881,10 @@ function timer_stop($display = 0, $precision = 3) { //if called like timer_stop(
        $mtime = $mtime[1] + $mtime[0];
        $timeend = $mtime;
        $timetotal = $timeend-$timestart;
        $mtime = $mtime[1] + $mtime[0];
        $timeend = $mtime;
        $timetotal = $timeend-$timestart;
+       $r = number_format($timetotal, $precision);
        if ( $display )
        if ( $display )
-               echo number_format($timetotal,$precision);
-       return $timetotal;
+               echo $r;
+       return $r;
 }
 
 function weblog_ping($server = '', $path = '') {
 }
 
 function weblog_ping($server = '', $path = '') {
@@ -1193,7 +1231,7 @@ function merge_filters($tag) {
        }
 
        if ( isset($wp_filter[$tag]) )
        }
 
        if ( isset($wp_filter[$tag]) )
-               ksort( $wp_filter[$tag] );
+               uksort( $wp_filter[$tag], "strnatcasecmp" );
 }
 
 function apply_filters($tag, $string) {
 }
 
 function apply_filters($tag, $string) {
@@ -1443,7 +1481,7 @@ function update_post_caches(&$posts) {
                // Change from flat structure to hierarchical:
                $post_meta_cache = array();
                foreach ($meta_list as $metarow) {
                // Change from flat structure to hierarchical:
                $post_meta_cache = array();
                foreach ($meta_list as $metarow) {
-                       $mpid = $metarow['post_id'];
+                       $mpid = (int) $metarow['post_id'];
                        $mkey = $metarow['meta_key'];
                        $mval = $metarow['meta_value'];
 
                        $mkey = $metarow['meta_key'];
                        $mval = $metarow['meta_value'];
 
@@ -1993,7 +2031,7 @@ function get_home_template() {
 function get_page_template() {
        global $wp_query;
 
 function get_page_template() {
        global $wp_query;
 
-       $id = $wp_query->post->ID;
+       $id = (int) $wp_query->post->ID;
        $template = get_post_meta($id, '_wp_page_template', true);
 
        if ( 'default' == $template )
        $template = get_post_meta($id, '_wp_page_template', true);
 
        if ( 'default' == $template )
@@ -2085,6 +2123,11 @@ function add_query_arg() {
                        $uri = @func_get_arg(2);
        }
 
                        $uri = @func_get_arg(2);
        }
 
+       if ( $frag = strstr($uri, '#') )
+               $uri = substr($uri, 0, -strlen($frag));
+       else
+               $frag = '';
+
        if ( preg_match('|^https?://|i', $uri, $matches) ) {
                $protocol = $matches[0];
                $uri = substr($uri, strlen($protocol));
        if ( preg_match('|^https?://|i', $uri, $matches) ) {
                $protocol = $matches[0];
                $uri = substr($uri, strlen($protocol));
@@ -2124,7 +2167,7 @@ function add_query_arg() {
                        $ret .= "$k=$v";
                }
        }
                        $ret .= "$k=$v";
                }
        }
-       $ret = $protocol . $base . $ret;
+       $ret = $protocol . $base . $ret . $frag;
        return trim($ret, '?');
 }
 
        return trim($ret, '?');
 }
 
@@ -2132,13 +2175,14 @@ function remove_query_arg($key, $query) {
        return add_query_arg($key, '', $query);
 }
 
        return add_query_arg($key, '', $query);
 }
 
-function load_template($file) {
+function load_template($_template_file) {
        global $posts, $post, $wp_did_header, $wp_did_template_redirect, $wp_query,
                $wp_rewrite, $wpdb;
 
        global $posts, $post, $wp_did_header, $wp_did_template_redirect, $wp_query,
                $wp_rewrite, $wpdb;
 
-       extract($wp_query->query_vars);
+       if ( is_array($wp_query->query_vars) )
+               extract($wp_query->query_vars, EXTR_SKIP);
 
 
-       require_once($file);
+       require_once($_template_file);
 }
 
 function add_magic_quotes($array) {
 }
 
 function add_magic_quotes($array) {
@@ -2155,10 +2199,21 @@ function add_magic_quotes($array) {
 }
 
 function wp_remote_fopen( $uri ) {
 }
 
 function wp_remote_fopen( $uri ) {
+       $timeout = 10;
+       $parsed_url = @parse_url($uri);
+
+       if ( !$parsed_url || !is_array($parsed_url) )
+               return false;
+
+       if ( !isset($parsed_url['scheme']) || !in_array($parsed_url['scheme'], array('http','https')) )
+               $uri = 'http://' . $uri;
+
        if ( ini_get('allow_url_fopen') ) {
        if ( ini_get('allow_url_fopen') ) {
-               $fp = fopen( $uri, 'r' );
+               $fp = @fopen( $uri, 'r' );
                if ( !$fp )
                        return false;
                if ( !$fp )
                        return false;
+
+               //stream_set_timeout($fp, $timeout); // Requires php 4.3
                $linea = '';
                while( $remote_read = fread($fp, 4096) )
                        $linea .= $remote_read;
                $linea = '';
                while( $remote_read = fread($fp, 4096) )
                        $linea .= $remote_read;
@@ -2169,6 +2224,7 @@ function wp_remote_fopen( $uri ) {
                curl_setopt ($handle, CURLOPT_URL, $uri);
                curl_setopt ($handle, CURLOPT_CONNECTTIMEOUT, 1);
                curl_setopt ($handle, CURLOPT_RETURNTRANSFER, 1);
                curl_setopt ($handle, CURLOPT_URL, $uri);
                curl_setopt ($handle, CURLOPT_CONNECTTIMEOUT, 1);
                curl_setopt ($handle, CURLOPT_RETURNTRANSFER, 1);
+               curl_setopt ($handle, CURLOPT_TIMEOUT, $timeout);
                $buffer = curl_exec($handle);
                curl_close($handle);
                return $buffer;
                $buffer = curl_exec($handle);
                curl_close($handle);
                return $buffer;
@@ -2197,8 +2253,10 @@ function status_header( $header ) {
        elseif ( 410 == $header )
                $text = 'Gone';
 
        elseif ( 410 == $header )
                $text = 'Gone';
 
-       @header("HTTP/1.1 $header $text");
-       @header("Status: $header $text");
+       if ( version_compare(phpversion(), '4.3.0', '>=') )
+               @header("HTTP/1.1 $header $text", true, $header);
+       else
+               @header("HTTP/1.1 $header $text");
 }
 
 function nocache_headers() {
 }
 
 function nocache_headers() {
@@ -2213,7 +2271,7 @@ function get_usermeta( $user_id, $meta_key = '') {
        $user_id = (int) $user_id;
 
        if ( !empty($meta_key) ) {
        $user_id = (int) $user_id;
 
        if ( !empty($meta_key) ) {
-               $meta_key = preg_replace('|a-z0-9_|i', '', $meta_key);
+               $meta_key = preg_replace('|[^a-z0-9_]|i', '', $meta_key);
                $metas = $wpdb->get_results("SELECT meta_key, meta_value FROM $wpdb->usermeta WHERE user_id = '$user_id' AND meta_key = '$meta_key'");
        } else {
                $metas = $wpdb->get_results("SELECT meta_key, meta_value FROM $wpdb->usermeta WHERE user_id = '$user_id'");
                $metas = $wpdb->get_results("SELECT meta_key, meta_value FROM $wpdb->usermeta WHERE user_id = '$user_id' AND meta_key = '$meta_key'");
        } else {
                $metas = $wpdb->get_results("SELECT meta_key, meta_value FROM $wpdb->usermeta WHERE user_id = '$user_id'");
@@ -2246,9 +2304,11 @@ function update_usermeta( $user_id, $meta_key, $meta_value ) {
                return false;
        $meta_key = preg_replace('|[^a-z0-9_]|i', '', $meta_key);
 
                return false;
        $meta_key = preg_replace('|[^a-z0-9_]|i', '', $meta_key);
 
-       if ( is_array($meta_value) || is_object($meta_value) )
-               $meta_value = serialize($meta_value);
-       $meta_value = trim( $meta_value );
+       // FIXME: usermeta data is assumed to be already escaped
+       if ( is_string($meta_value) )
+               $meta_value = stripslashes($meta_value);
+       $meta_value = maybe_serialize($meta_value);
+       $meta_value = $wpdb->escape($meta_value);
        
        if (empty($meta_value)) {
                delete_usermeta($user_id, $meta_key);
        
        if (empty($meta_value)) {
                delete_usermeta($user_id, $meta_key);
@@ -2321,22 +2381,24 @@ function wp_nonce_url($actionurl, $action = -1) {
        return wp_specialchars(add_query_arg('_wpnonce', wp_create_nonce($action), $actionurl));
 }
 
        return wp_specialchars(add_query_arg('_wpnonce', wp_create_nonce($action), $actionurl));
 }
 
-function wp_nonce_field($action = -1) {
-       echo '<input type="hidden" name="_wpnonce" value="' . wp_create_nonce($action) . '" />';
-       wp_referer_field();
+function wp_nonce_field($action = -1, $name = "_wpnonce", $referer = true) {
+       $name = attribute_escape($name);
+       echo '<input type="hidden" name="' . $name . '" value="' . wp_create_nonce($action) . '" />';
+       if ( $referer )
+               wp_referer_field();
 }
 
 function wp_referer_field() {
 }
 
 function wp_referer_field() {
-       $ref = wp_specialchars($_SERVER['REQUEST_URI']);
+       $ref = attribute_escape(stripslashes($_SERVER['REQUEST_URI']));
        echo '<input type="hidden" name="_wp_http_referer" value="'. $ref . '" />';
        if ( wp_get_original_referer() ) {
        echo '<input type="hidden" name="_wp_http_referer" value="'. $ref . '" />';
        if ( wp_get_original_referer() ) {
-               $original_ref = wp_specialchars(stripslashes(wp_get_original_referer()));
+               $original_ref = attribute_escape(stripslashes(wp_get_original_referer()));
                echo '<input type="hidden" name="_wp_original_http_referer" value="'. $original_ref . '" />';
        }
 }
 
 function wp_original_referer_field() {
                echo '<input type="hidden" name="_wp_original_http_referer" value="'. $original_ref . '" />';
        }
 }
 
 function wp_original_referer_field() {
-       echo '<input type="hidden" name="_wp_original_http_referer" value="' . wp_specialchars(stripslashes($_SERVER['REQUEST_URI'])) . '" />';
+       echo '<input type="hidden" name="_wp_original_http_referer" value="' . attribute_escape(stripslashes($_SERVER['REQUEST_URI'])) . '" />';
 }
 
 function wp_get_referer() {
 }
 
 function wp_get_referer() {
@@ -2413,7 +2475,7 @@ function wp_explain_nonce($action) {
                }
        }
 
                }
        }
 
-       return __('Are you sure you want to do this');
+       return __('Are you sure you want to do this?');
 }
 
 function wp_nonce_ays($action) {
 }
 
 function wp_nonce_ays($action) {
@@ -2421,7 +2483,7 @@ function wp_nonce_ays($action) {
 
        $adminurl = get_settings('siteurl') . '/wp-admin';
        if ( wp_get_referer() )
 
        $adminurl = get_settings('siteurl') . '/wp-admin';
        if ( wp_get_referer() )
-               $adminurl = wp_get_referer();
+               $adminurl = attribute_escape(stripslashes(wp_get_referer()));
 
        $title = __('WordPress Confirmation');
        // Remove extra layer of slashes.
 
        $title = __('WordPress Confirmation');
        // Remove extra layer of slashes.
@@ -2433,12 +2495,12 @@ function wp_nonce_ays($action) {
                foreach ( (array) $q as $a ) {
                        $v = substr(strstr($a, '='), 1);
                        $k = substr($a, 0, -(strlen($v)+1));
                foreach ( (array) $q as $a ) {
                        $v = substr(strstr($a, '='), 1);
                        $k = substr($a, 0, -(strlen($v)+1));
-                       $html .= "\t\t<input type='hidden' name='" . wp_specialchars( urldecode($k), 1 ) . "' value='" . wp_specialchars( urldecode($v), 1 ) . "' />\n";
+                       $html .= "\t\t<input type='hidden' name='" . attribute_escape( urldecode($k)) . "' value='" . attribute_escape( urldecode($v)) . "' />\n";
                }
                $html .= "\t\t<input type='hidden' name='_wpnonce' value='" . wp_create_nonce($action) . "' />\n";
                }
                $html .= "\t\t<input type='hidden' name='_wpnonce' value='" . wp_create_nonce($action) . "' />\n";
-               $html .= "\t\t<div id='message' class='confirm fade'>\n\t\t<p>" . wp_explain_nonce($action) . "</p>\n\t\t<p><a href='$adminurl'>" . __('No') . "</a> <input type='submit' value='" . __('Yes') . "' /></p>\n\t\t</div>\n\t</form>\n";
+               $html .= "\t\t<div id='message' class='confirm fade'>\n\t\t<p>" . wp_specialchars(wp_explain_nonce($action)) . "</p>\n\t\t<p><a href='$adminurl'>" . __('No') . "</a> <input type='submit' value='" . __('Yes') . "' /></p>\n\t\t</div>\n\t</form>\n";
        } else {
        } else {
-               $html .= "\t<div id='message' class='confirm fade'>\n\t<p>" . wp_explain_nonce($action) . "</p>\n\t<p><a href='$adminurl'>" . __('No') . "</a> <a href='" . add_query_arg( '_wpnonce', wp_create_nonce($action), $_SERVER['REQUEST_URI'] ) . "'>" . __('Yes') . "</a></p>\n\t</div>\n";
+               $html .= "\t<div id='message' class='confirm fade'>\n\t<p>" . wp_specialchars(wp_explain_nonce($action)) . "</p>\n\t<p><a href='$adminurl'>" . __('No') . "</a> <a href='" . clean_url(add_query_arg('_wpnonce', wp_create_nonce($action), $_SERVER['REQUEST_URI'])) . "'>" . __('Yes') . "</a></p>\n\t</div>\n";
        }
        $html .= "</body>\n</html>";
        wp_die($html, $title);
        }
        $html .= "</body>\n</html>";
        wp_die($html, $title);
@@ -2503,4 +2565,4 @@ function wp_die($message, $title = '') {
        die();
 }
 
        die();
 }
 
-?>
\ No newline at end of file
+?>
index cd080444ca0b782a1ec803145f165c815867400e..ed94ca9ee702969c87acde568144ef3cc73845ed 100644 (file)
@@ -63,10 +63,12 @@ class gettext_reader {
   function readint() {
       if ($this->BYTEORDER == 0) {
         // low endian
   function readint() {
       if ($this->BYTEORDER == 0) {
         // low endian
-        return array_shift(unpack('V', $this->STREAM->read(4)));
+        $low_end = unpack('V', $this->STREAM->read(4));
+        return array_shift($low_end);
       } else {
         // big endian
       } else {
         // big endian
-        return array_shift(unpack('N', $this->STREAM->read(4)));
+        $big_end = unpack('N', $this->STREAM->read(4));
+        return array_shift($big_end);
       }
     }
 
       }
     }
 
diff --git a/wp-includes/js/tinymce/plugins/inlinepopups/editor_plugin.js b/wp-includes/js/tinymce/plugins/inlinepopups/editor_plugin.js
deleted file mode 100644 (file)
index e69de29..0000000
diff --git a/wp-includes/js/tinymce/plugins/inlinepopups/editor_plugin_src.js b/wp-includes/js/tinymce/plugins/inlinepopups/editor_plugin_src.js
deleted file mode 100644 (file)
index e69de29..0000000
diff --git a/wp-includes/js/tinymce/plugins/inlinepopups/readme.txt b/wp-includes/js/tinymce/plugins/inlinepopups/readme.txt
deleted file mode 100644 (file)
index e69de29..0000000
index c3af23ddd10e4557570ba6c1000a4b14fa082f59..2c66bc38a54b3fbe0a8bafb74143904baea807fc 100644 (file)
@@ -59,7 +59,7 @@
        gzip_compression();
 
        // Output rest of headers
        gzip_compression();
 
        // Output rest of headers
-       header("Content-type: text/javascript; charset: UTF-8");
+       header("Content-Type: text/javascript; charset=".get_bloginfo('charset'));
        header("Vary: Accept-Encoding"); // Handle proxies
        header("Expires: " . gmdate("D, d M Y H:i:s", time() + $expiresOffset) . " GMT");
 
        header("Vary: Accept-Encoding"); // Handle proxies
        header("Expires: " . gmdate("D, d M Y H:i:s", time() + $expiresOffset) . " GMT");
 
index f347c927863d2cc0eca0093a0fc216c2e9f8e9cf..b53a8cede2d3887cbbf8f71c93f2cc9923c5f725 100644 (file)
@@ -1,6 +1,7 @@
 <?php
 
 require_once('../../../wp-config.php');
 <?php
 
 require_once('../../../wp-config.php');
+header('Content-Type: text/html; charset='.get_bloginfo('charset'));
 
 ?>
 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
 
 ?>
 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
index 03702ad8301d7e0d5944dfed0cae608b75687d01..072a96a723822d645c0b2af910b0541df27af033 100644 (file)
@@ -524,21 +524,34 @@ function wp_filter_post_kses($data) {
 }
 
 function kses_init_filters() {
 }
 
 function kses_init_filters() {
-               add_filter('pre_comment_author', 'wp_filter_kses');
-               add_filter('pre_comment_content', 'wp_filter_kses');
-               add_filter('content_save_pre', 'wp_filter_post_kses');
-               add_filter('title_save_pre', 'wp_filter_kses');
+       // Normal filtering.
+       add_filter('pre_comment_content', 'wp_filter_kses');
+       add_filter('title_save_pre', 'wp_filter_kses');
+
+       // Post filtering
+       add_filter('content_save_pre', 'wp_filter_post_kses');
+       add_filter('excerpt_save_pre', 'wp_filter_post_kses');
+       add_filter('content_filtered_save_pre', 'wp_filter_post_kses');
 }
 
 }
 
-function kses_init() {
-       remove_filter('pre_comment_author', 'wp_filter_kses');
+function kses_remove_filters() {
+       // Normal filtering.
        remove_filter('pre_comment_content', 'wp_filter_kses');
        remove_filter('pre_comment_content', 'wp_filter_kses');
-       remove_filter('content_save_pre', 'wp_filter_post_kses');
        remove_filter('title_save_pre', 'wp_filter_kses');
 
        remove_filter('title_save_pre', 'wp_filter_kses');
 
+       // Post filtering
+       remove_filter('content_save_pre', 'wp_filter_post_kses');
+       remove_filter('excerpt_save_pre', 'wp_filter_post_kses');
+       remove_filter('content_filtered_save_pre', 'wp_filter_post_kses');
+}
+
+function kses_init() {
+       kses_remove_filters();
+
        if (current_user_can('unfiltered_html') == false)
                kses_init_filters();
 }
        if (current_user_can('unfiltered_html') == false)
                kses_init_filters();
 }
+
 add_action('init', 'kses_init');
 add_action('set_current_user', 'kses_init');
 ?>
 add_action('init', 'kses_init');
 add_action('set_current_user', 'kses_init');
 ?>
index 71e2159cf6e0bb71b5615abc7325cf625b224670..d907933f7d84429e2a288698d2792689d33bd24c 100644 (file)
@@ -212,15 +212,15 @@ function get_links($category = -1,
 
                $the_link = '#';
                if (!empty($row->link_url))
 
                $the_link = '#';
                if (!empty($row->link_url))
-                       $the_link = wp_specialchars($row->link_url);
+                       $the_link = clean_url($row->link_url);
 
                $rel = $row->link_rel;
                if ($rel != '') {
                        $rel = ' rel="' . $rel . '"';
                }
 
 
                $rel = $row->link_rel;
                if ($rel != '') {
                        $rel = ' rel="' . $rel . '"';
                }
 
-               $desc = wp_specialchars($row->link_description, ENT_QUOTES);
-               $name = wp_specialchars($row->link_name, ENT_QUOTES);
+               $desc = attribute_escape($row->link_description);
+               $name = attribute_escape($row->link_name);
                $title = $desc;
 
                if ($show_updated) {
                $title = $desc;
 
                if ($show_updated) {
index 2c9dbc0cdec7ff90f3a9666e76ffc62c46cd5986..be457f0f8a22d4e029f07388ec76f6c9297ab405 100644 (file)
@@ -78,9 +78,7 @@ function get_userdata( $user_id ) {
 
        if ($metavalues) {
                foreach ( $metavalues as $meta ) {
 
        if ($metavalues) {
                foreach ( $metavalues as $meta ) {
-                       @ $value = unserialize($meta->meta_value);
-                       if ($value === FALSE)
-                               $value = $meta->meta_value;
+                       $value = maybe_unserialize($meta->meta_value);
                        $user->{$meta->meta_key} = $value;
 
                        // We need to set user_level from meta, not row
                        $user->{$meta->meta_key} = $value;
 
                        // We need to set user_level from meta, not row
@@ -122,6 +120,8 @@ function get_userdatabylogin($user_login) {
        if ( $userdata )
                return $userdata;
 
        if ( $userdata )
                return $userdata;
 
+       $user_login = $wpdb->escape($user_login);
+
        if ( !$user = $wpdb->get_row("SELECT * FROM $wpdb->users WHERE user_login = '$user_login'") )
                return false;
 
        if ( !$user = $wpdb->get_row("SELECT * FROM $wpdb->users WHERE user_login = '$user_login'") )
                return false;
 
@@ -131,9 +131,7 @@ function get_userdatabylogin($user_login) {
 
        if ($metavalues) {
                foreach ( $metavalues as $meta ) {
 
        if ($metavalues) {
                foreach ( $metavalues as $meta ) {
-                       @ $value = unserialize($meta->meta_value);
-                       if ($value === FALSE)
-                               $value = $meta->meta_value;
+                       $value = maybe_unserialize($meta->meta_value);
                        $user->{$meta->meta_key} = $value;
 
                        // We need to set user_level from meta, not row
                        $user->{$meta->meta_key} = $value;
 
                        // We need to set user_level from meta, not row
@@ -258,7 +256,7 @@ endif;
 // Cookie safe redirect.  Works around IIS Set-Cookie bug.
 // http://support.microsoft.com/kb/q176113/
 if ( !function_exists('wp_redirect') ) :
 // Cookie safe redirect.  Works around IIS Set-Cookie bug.
 // http://support.microsoft.com/kb/q176113/
 if ( !function_exists('wp_redirect') ) :
-function wp_redirect($location) {
+function wp_redirect($location, $status = 302) {
        global $is_IIS;
 
        $location = preg_replace('|[^a-z0-9-~+_.?#=&;,/:%]|i', '', $location);
        global $is_IIS;
 
        $location = preg_replace('|[^a-z0-9-~+_.?#=&;,/:%]|i', '', $location);
@@ -266,10 +264,13 @@ function wp_redirect($location) {
        $strip = array('%0d', '%0a');
        $location = str_replace($strip, '', $location);
 
        $strip = array('%0d', '%0a');
        $location = str_replace($strip, '', $location);
 
-       if ($is_IIS)
+       if ( $is_IIS ) {
                header("Refresh: 0;url=$location");
                header("Refresh: 0;url=$location");
-       else
+       } else {
+               if ( php_sapi_name() != 'cgi-fcgi' )
+                       status_header($status); // This causes problems on IIS and some FastCGI setups
                header("Location: $location");
                header("Location: $location");
+       }
 }
 endif;
 
 }
 endif;
 
@@ -335,7 +336,7 @@ function wp_notify_postauthor($comment_id, $comment_type='') {
 
        if ('' == $user->user_email) return false; // If there's no email to send the comment to
 
 
        if ('' == $user->user_email) return false; // If there's no email to send the comment to
 
-       $comment_author_domain = gethostbyaddr($comment->comment_author_IP);
+       $comment_author_domain = @gethostbyaddr($comment->comment_author_IP);
 
        $blogname = get_settings('blogname');
        
 
        $blogname = get_settings('blogname');
        
@@ -412,7 +413,7 @@ function wp_notify_moderator($comment_id) {
        $comment = $wpdb->get_row("SELECT * FROM $wpdb->comments WHERE comment_ID='$comment_id' LIMIT 1");
        $post = $wpdb->get_row("SELECT * FROM $wpdb->posts WHERE ID='$comment->comment_post_ID' LIMIT 1");
 
        $comment = $wpdb->get_row("SELECT * FROM $wpdb->comments WHERE comment_ID='$comment_id' LIMIT 1");
        $post = $wpdb->get_row("SELECT * FROM $wpdb->posts WHERE ID='$comment->comment_post_ID' LIMIT 1");
 
-       $comment_author_domain = gethostbyaddr($comment->comment_author_IP);
+       $comment_author_domain = @gethostbyaddr($comment->comment_author_IP);
        $comments_waiting = $wpdb->get_var("SELECT count(comment_ID) FROM $wpdb->comments WHERE comment_approved = '0'");
 
        $notify_message  = sprintf( __('A new comment on the post #%1$s "%2$s" is waiting for your approval'), $post->ID, $post->post_title ) . "\r\n";
        $comments_waiting = $wpdb->get_var("SELECT count(comment_ID) FROM $wpdb->comments WHERE comment_approved = '0'");
 
        $notify_message  = sprintf( __('A new comment on the post #%1$s "%2$s" is waiting for your approval'), $post->ID, $post->post_title ) . "\r\n";
@@ -467,7 +468,7 @@ endif;
 if ( !function_exists('wp_verify_nonce') ) :
 function wp_verify_nonce($nonce, $action = -1) {
        $user = wp_get_current_user();
 if ( !function_exists('wp_verify_nonce') ) :
 function wp_verify_nonce($nonce, $action = -1) {
        $user = wp_get_current_user();
-       $uid = $user->id;
+       $uid = (int) $user->id;
 
        $i = ceil(time() / 43200);
 
 
        $i = ceil(time() / 43200);
 
@@ -481,7 +482,7 @@ endif;
 if ( !function_exists('wp_create_nonce') ) :
 function wp_create_nonce($action = -1) {
        $user = wp_get_current_user();
 if ( !function_exists('wp_create_nonce') ) :
 function wp_create_nonce($action = -1) {
        $user = wp_get_current_user();
-       $uid = $user->id;
+       $uid = (int) $user->id;
 
        $i = ceil(time() / 43200);
        
 
        $i = ceil(time() / 43200);
        
@@ -511,4 +512,4 @@ function wp_hash($data) {
 }
 endif;
 
 }
 endif;
 
-?>
+?>
\ No newline at end of file
index dcf81f5093825e0bcc3d7a497953bb8d2cd20ecc..56a433fd46bcfe36b9af4c835622125603242a7b 100644 (file)
@@ -77,7 +77,7 @@ function wp_insert_user($userdata) {
                $query = "UPDATE $wpdb->users SET user_pass='$user_pass', user_email='$user_email', user_url='$user_url', user_nicename = '$user_nicename', display_name = '$display_name' WHERE ID = '$ID'";
                $query = apply_filters('update_user_query', $query);
                $wpdb->query( $query );
                $query = "UPDATE $wpdb->users SET user_pass='$user_pass', user_email='$user_email', user_url='$user_url', user_nicename = '$user_nicename', display_name = '$display_name' WHERE ID = '$ID'";
                $query = apply_filters('update_user_query', $query);
                $wpdb->query( $query );
-               $user_id = $ID;
+               $user_id = (int) $ID;
        } else {
                $query = "INSERT INTO $wpdb->users 
                (user_login, user_pass, user_email, user_url, user_registered, user_nicename, display_name)
        } else {
                $query = "INSERT INTO $wpdb->users 
                (user_login, user_pass, user_email, user_url, user_registered, user_nicename, display_name)
@@ -85,7 +85,7 @@ function wp_insert_user($userdata) {
                ('$user_login', '$user_pass', '$user_email', '$user_url', '$user_registered', '$user_nicename', '$display_name')";
                $query = apply_filters('create_user_query', $query);
                $wpdb->query( $query );
                ('$user_login', '$user_pass', '$user_email', '$user_url', '$user_registered', '$user_nicename', '$display_name')";
                $query = apply_filters('create_user_query', $query);
                $wpdb->query( $query );
-               $user_id = $wpdb->insert_id;
+               $user_id = (int) $wpdb->insert_id;
        }
        
        update_usermeta( $user_id, 'first_name', $first_name);
        }
        
        update_usermeta( $user_id, 'first_name', $first_name);
index df2526ec7ce842b2bf9c624d80f844aa95b6fd2e..6750cdd32c47a5c7774e56ee6192c206798ab02c 100644 (file)
@@ -816,9 +816,8 @@ function parse_w3cdtf ( $date_str ) {
                return -1;
        }
        }
                return -1;
        }
        }
-function wp_rss ($url, $num) {
+function wp_rss ($url, $num_items) {
        //ini_set("display_errors", false); uncomment to suppress php errors thrown if the feed is not returned.
        //ini_set("display_errors", false); uncomment to suppress php errors thrown if the feed is not returned.
-       $num_items = $num;
        $rss = fetch_rss($url);
                if ( $rss ) {
                        echo "<ul>";
        $rss = fetch_rss($url);
                if ( $rss ) {
                        echo "<ul>";
@@ -837,7 +836,7 @@ function wp_rss ($url, $num) {
        }
 }
 
        }
 }
 
-function get_rss ($uri, $num = 5) { // Like get posts, but for RSS
+function get_rss ($url, $num_items = 5) { // Like get posts, but for RSS
        $rss = fetch_rss($url);
        if ( $rss ) {
                $rss->items = array_slice($rss->items, 0, $num_items);
        $rss = fetch_rss($url);
        if ( $rss ) {
                $rss->items = array_slice($rss->items, 0, $num_items);
@@ -848,7 +847,6 @@ function get_rss ($uri, $num = 5) { // Like get posts, but for RSS
                        echo "</a><br />\n";
                        echo "</li>\n";
                }
                        echo "</a><br />\n";
                        echo "</li>\n";
                }
-               return $posts;
        } else {
                return false;
        }
        } else {
                return false;
        }
index 0838f5ff1c2a46a7832fc0c5a295b37f0b7f7917..1107e03444adf4c7914db995461ef8e71aecaf49 100644 (file)
@@ -1,14 +1,15 @@
 <?php
 
 <?php
 
-function get_the_author($idmode = '') {
+function get_the_author($deprecated = '') {
        global $authordata;
        return apply_filters('the_author', $authordata->display_name);
 }
 
        global $authordata;
        return apply_filters('the_author', $authordata->display_name);
 }
 
-function the_author($idmode = '', $echo = true) {
-       if ( $echo )
-               echo get_the_author($idmode);
-       return get_the_author($idmode);
+// Using echo = false is deprecated.  Use get_the_author instead.
+function the_author($deprecated = '', $deprecated_echo = true) {
+       if ( $deprecated_echo )
+               echo get_the_author();
+       return get_the_author();
 }
 
 function get_the_author_description() {
 }
 
 function get_the_author_description() {
@@ -127,15 +128,15 @@ function the_author_posts() {
 }
 
 /* the_author_posts_link() requires no get_, use get_author_link() */
 }
 
 /* the_author_posts_link() requires no get_, use get_author_link() */
-function the_author_posts_link($idmode='') {
+function the_author_posts_link($deprecated = '') {
        global $authordata;
 
        global $authordata;
 
-       echo '<a href="' . get_author_link(0, $authordata->ID, $authordata->user_nicename) . '" title="' . sprintf(__("Posts by %s"), wp_specialchars(the_author($idmode, false))) . '">' . the_author($idmode, false) . '</a>';
+       echo '<a href="' . get_author_link(0, $authordata->ID, $authordata->user_nicename) . '" title="' . sprintf(__("Posts by %s"), attribute_escape(get_the_author())) . '">' . get_the_author() . '</a>';
 }
 
 function get_author_link($echo = false, $author_id, $author_nicename = '') {
        global $wpdb, $wp_rewrite, $post, $cache_userdata;
 }
 
 function get_author_link($echo = false, $author_id, $author_nicename = '') {
        global $wpdb, $wp_rewrite, $post, $cache_userdata;
-       $auth_ID = $author_id;
+       $auth_ID = (int) $author_id;
        $link = $wp_rewrite->get_author_permastruct();
 
        if ( empty($link) ) {
        $link = $wp_rewrite->get_author_permastruct();
 
        if ( empty($link) ) {
@@ -182,7 +183,7 @@ function list_authors($optioncount = false, $exclude_admin = true, $show_fullnam
        $query = "SELECT ID, user_nicename from $wpdb->users " . ($exclude_admin ? "WHERE user_login <> 'admin' " : '') . "ORDER BY display_name";
        $authors = $wpdb->get_results($query);
 
        $query = "SELECT ID, user_nicename from $wpdb->users " . ($exclude_admin ? "WHERE user_login <> 'admin' " : '') . "ORDER BY display_name";
        $authors = $wpdb->get_results($query);
 
-       foreach ( $authors as $author ) {
+       foreach ( (array) $authors as $author ) {
                $author = get_userdata( $author->ID );
                $posts = get_usernumposts($author->ID);
                $name = $author->nickname;
                $author = get_userdata( $author->ID );
                $posts = get_usernumposts($author->ID);
                $name = $author->nickname;
@@ -196,7 +197,7 @@ function list_authors($optioncount = false, $exclude_admin = true, $show_fullnam
                        if ( !$hide_empty )
                                $link = $name;
                } else {
                        if ( !$hide_empty )
                                $link = $name;
                } else {
-                       $link = '<a href="' . get_author_link(0, $author->ID, $author->user_nicename) . '" title="' . sprintf(__("Posts by %s"), wp_specialchars($author->display_name)) . '">' . $name . '</a>';
+                       $link = '<a href="' . get_author_link(0, $author->ID, $author->user_nicename) . '" title="' . sprintf(__("Posts by %s"), attribute_escape($author->display_name)) . '">' . $name . '</a>';
 
                        if ( (! empty($feed_image)) || (! empty($feed)) ) {
                                $link .= ' ';
 
                        if ( (! empty($feed_image)) || (! empty($feed)) ) {
                                $link .= ' ';
@@ -234,4 +235,4 @@ function list_authors($optioncount = false, $exclude_admin = true, $show_fullnam
        }
 }
 
        }
 }
 
-?>
\ No newline at end of file
+?>
index 1858bec4f96f66b1fc324f09803090f6cd6c877f..00eadc0e65ef7325bb398dfdb722b5e08a4d368d 100644 (file)
@@ -3,8 +3,9 @@
 function get_the_category($id = false) {
 global $post, $category_cache;
 
 function get_the_category($id = false) {
 global $post, $category_cache;
 
+       $id = (int) $id;
        if ( !$id )
        if ( !$id )
-               $id = $post->ID;
+               $id = (int) $post->ID;
 
        if ( !isset($category_cache[$id]) )
                update_post_category_cache($id);
 
        if ( !isset($category_cache[$id]) )
                update_post_category_cache($id);
@@ -318,14 +319,14 @@ function list_cats($optionall = 1, $all = 'All', $sort_column = 'ID', $sort_orde
        $num_found=0;
        $thelist = "";
 
        $num_found=0;
        $thelist = "";
 
-       foreach ( $categories as $category ) {
+       foreach ( (array) $categories as $category ) {
                if ( ( intval($hide_empty) == 0 || $category->category_count) && (!$hierarchical || $category->category_parent == $child_of) ) {
                        $num_found++;
                        $link = '<a href="'.get_category_link($category->cat_ID).'" ';
                        if ( $use_desc_for_title == 0 || empty($category->category_description) )
                if ( ( intval($hide_empty) == 0 || $category->category_count) && (!$hierarchical || $category->category_parent == $child_of) ) {
                        $num_found++;
                        $link = '<a href="'.get_category_link($category->cat_ID).'" ';
                        if ( $use_desc_for_title == 0 || empty($category->category_description) )
-                               $link .= 'title="'. sprintf(__("View all posts filed under %s"), wp_specialchars($category->cat_name)) . '"';
+                               $link .= 'title="'. sprintf(__("View all posts filed under %s"), attribute_escape($category->cat_name)) . '"';
                        else
                        else
-                               $link .= 'title="' . wp_specialchars(apply_filters('category_description',$category->category_description,$category)) . '"';
+                               $link .= 'title="' . attribute_escape(apply_filters('category_description',$category->category_description,$category)) . '"';
                        $link .= '>';
                        $link .= apply_filters('list_cats', $category->cat_name, $category).'</a>';
 
                        $link .= '>';
                        $link .= apply_filters('list_cats', $category->cat_name, $category).'</a>';
 
index 84d83175aeb8e8d691b6a9317460b6aef452c52b..bc7ee04d2d06fb78dfd84f57eab255ea219ab6fe 100644 (file)
@@ -63,6 +63,8 @@ function bloginfo($show='') {
                !strstr($show, 'home')) {
                $info = apply_filters('bloginfo', $info, $show);
                $info = convert_chars($info);
                !strstr($show, 'home')) {
                $info = apply_filters('bloginfo', $info, $show);
                $info = convert_chars($info);
+       } else {
+               $info = apply_filters('bloginfo_url', $info, $show);
        }
 
        echo $info;
        }
 
        echo $info;
@@ -135,8 +137,7 @@ function get_bloginfo($show='') {
 
 
 function wp_title($sep = '&raquo;', $display = true) {
 
 
 function wp_title($sep = '&raquo;', $display = true) {
-       global $wpdb;
-       global $m, $year, $monthnum, $day, $category_name, $month, $posts;
+       global $wpdb, $posts, $month;
 
        $cat = get_query_var('cat');
        $p = get_query_var('p');
 
        $cat = get_query_var('cat');
        $p = get_query_var('p');
@@ -144,14 +145,18 @@ function wp_title($sep = '&raquo;', $display = true) {
        $category_name = get_query_var('category_name');
        $author = get_query_var('author');
        $author_name = get_query_var('author_name');
        $category_name = get_query_var('category_name');
        $author = get_query_var('author');
        $author_name = get_query_var('author_name');
+       $m = (int) get_query_var('m');
+       $year = (int) get_query_var('year');
+       $monthnum = (int) get_query_var('monthnum');
+       $day = (int) get_query_var('day');
+       $title = '';
 
        // If there's a category
        if ( !empty($cat) ) {
                        // category exclusion
                        if ( !stristr($cat,'-') )
 
        // If there's a category
        if ( !empty($cat) ) {
                        // category exclusion
                        if ( !stristr($cat,'-') )
-                               $title = get_the_category_by_ID($cat);
-       }
-       if ( !empty($category_name) ) {
+                               $title = apply_filters('single_cat_title', get_the_category_by_ID($cat));
+       } elseif ( !empty($category_name) ) {
                if ( stristr($category_name,'/') ) {
                                $category_name = explode('/',$category_name);
                                if ( $category_name[count($category_name)-1] )
                if ( stristr($category_name,'/') ) {
                                $category_name = explode('/',$category_name);
                                if ( $category_name[count($category_name)-1] )
@@ -160,6 +165,7 @@ function wp_title($sep = '&raquo;', $display = true) {
                                        $category_name = $category_name[count($category_name)-2]; // there was a trailling slash
                }
                $title = $wpdb->get_var("SELECT cat_name FROM $wpdb->categories WHERE category_nicename = '$category_name'");
                                        $category_name = $category_name[count($category_name)-2]; // there was a trailling slash
                }
                $title = $wpdb->get_var("SELECT cat_name FROM $wpdb->categories WHERE category_nicename = '$category_name'");
+               $title = apply_filters('single_cat_title', $title);
        }
 
        // If there's an author
        }
 
        // If there's an author
@@ -194,7 +200,7 @@ function wp_title($sep = '&raquo;', $display = true) {
        }
 
        $prefix = '';
        }
 
        $prefix = '';
-       if ( isset($title) )
+       if ( !empty($title) )
                $prefix = " $sep ";
 
        $title = $prefix . $title;
                $prefix = " $sep ";
 
        $title = $prefix . $title;
@@ -242,7 +248,12 @@ function single_cat_title($prefix = '', $display = true ) {
 
 
 function single_month_title($prefix = '', $display = true ) {
 
 
 function single_month_title($prefix = '', $display = true ) {
-       global $m, $monthnum, $month, $year;
+       global $month;
+
+       $m = (int) get_query_var('m');
+       $year = (int) get_query_var('year');
+       $monthnum = (int) get_query_var('monthnum');
+
        if ( !empty($monthnum) && !empty($year) ) {
                $my_year = $year;
                $my_month = $month[str_pad($monthnum, 2, '0', STR_PAD_LEFT)];
        if ( !empty($monthnum) && !empty($year) ) {
                $my_year = $year;
                $my_month = $month[str_pad($monthnum, 2, '0', STR_PAD_LEFT)];
@@ -261,7 +272,7 @@ function single_month_title($prefix = '', $display = true ) {
 /* link navigation hack by Orien http://icecode.com/ */
 function get_archives_link($url, $text, $format = 'html', $before = '', $after = '') {
        $text = wptexturize($text);
 /* link navigation hack by Orien http://icecode.com/ */
 function get_archives_link($url, $text, $format = 'html', $before = '', $after = '') {
        $text = wptexturize($text);
-       $title_text = wp_specialchars($text, 1);
+       $title_text = attribute_escape($text);
 
        if ('link' == $format)
                return "\t<link rel='archives' title='$title_text' href='$url' />\n";
 
        if ('link' == $format)
                return "\t<link rel='archives' title='$title_text' href='$url' />\n";
@@ -334,10 +345,10 @@ function get_archives($type='', $limit='', $format='html', $before = '', $after
                        foreach ( $arcresults as $arcresult ) {
                                $url    = get_month_link($arcresult->year,      $arcresult->month);
                                if ( $show_post_count ) {
                        foreach ( $arcresults as $arcresult ) {
                                $url    = get_month_link($arcresult->year,      $arcresult->month);
                                if ( $show_post_count ) {
-                                       $text = sprintf('%s %d', $month[zeroise($arcresult->month,2)], $arcresult->year);
+                                       $text = sprintf(__('%1$s %2$d'), $month[zeroise($arcresult->month,2)], $arcresult->year);
                                        $after = '&nbsp;('.$arcresult->posts.')' . $afterafter;
                                } else {
                                        $after = '&nbsp;('.$arcresult->posts.')' . $afterafter;
                                } else {
-                                       $text = sprintf('%s %d', $month[zeroise($arcresult->month,2)], $arcresult->year);
+                                       $text = sprintf(__('%1$s %2$d'), $month[zeroise($arcresult->month,2)], $arcresult->year);
                                }
                                echo get_archives_link($url, $text, $format, $before, $after);
                        }
                                }
                                echo get_archives_link($url, $text, $format, $before, $after);
                        }
@@ -347,7 +358,7 @@ function get_archives($type='', $limit='', $format='html', $before = '', $after
                if ( $arcresults ) {
                        foreach ( $arcresults as $arcresult ) {
                                $url    = get_day_link($arcresult->year, $arcresult->month, $arcresult->dayofmonth);
                if ( $arcresults ) {
                        foreach ( $arcresults as $arcresult ) {
                                $url    = get_day_link($arcresult->year, $arcresult->month, $arcresult->dayofmonth);
-                               $date = sprintf("%d-%02d-%02d 00:00:00", $arcresult->year, $arcresult->month, $arcresult->dayofmonth);
+                               $date = sprintf('%1$d-%2$02d-%3$02d 00:00:00', $arcresult->year, $arcresult->month, $arcresult->dayofmonth);
                                $text = mysql2date($archive_day_date_format, $date);
                                echo get_archives_link($url, $text, $format, $before, $after);
                        }
                                $text = mysql2date($archive_day_date_format, $date);
                                echo get_archives_link($url, $text, $format, $before, $after);
                        }
@@ -364,7 +375,7 @@ function get_archives($type='', $limit='', $format='html', $before = '', $after
                                                $arc_week = get_weekstartend($arcresult->yyyymmdd, get_settings('start_of_week'));
                                                $arc_week_start = date_i18n($archive_week_start_date_format, $arc_week['start']);
                                                $arc_week_end = date_i18n($archive_week_end_date_format, $arc_week['end']);
                                                $arc_week = get_weekstartend($arcresult->yyyymmdd, get_settings('start_of_week'));
                                                $arc_week_start = date_i18n($archive_week_start_date_format, $arc_week['start']);
                                                $arc_week_end = date_i18n($archive_week_end_date_format, $arc_week['end']);
-                                               $url  = sprintf('%s/%s%sm%s%s%sw%s%d', get_settings('home'), '', '?', '=', $arc_year, '&amp;', '=', $arcresult->week);
+                                               $url  = sprintf('%1$s/%2$s%3$sm%4$s%5$s%6$sw%7$s%8$d', get_settings('home'), '', '?', '=', $arc_year, '&amp;', '=', $arcresult->week);
                                                $text = $arc_week_start . $archive_week_separator . $arc_week_end;
                                                echo get_archives_link($url, $text, $format, $before, $after);
                                        }
                                                $text = $arc_week_start . $archive_week_separator . $arc_week_end;
                                                echo get_archives_link($url, $text, $format, $before, $after);
                                        }
@@ -433,8 +444,8 @@ function get_calendar($daylength = 1) {
                else
                                $thismonth = ''.zeroise(intval(substr($m, 4, 2)), 2);
        } else {
                else
                                $thismonth = ''.zeroise(intval(substr($m, 4, 2)), 2);
        } else {
-               $thisyear = gmdate('Y', current_time('timestamp') + get_settings('gmt_offset') * 3600);
-               $thismonth = gmdate('m', current_time('timestamp') + get_settings('gmt_offset') * 3600);
+               $thisyear = gmdate('Y', current_time('timestamp'));
+               $thismonth = gmdate('m', current_time('timestamp'));
        }
 
        $unixmonth = mktime(0, 0 , 0, $thismonth, 1, $thisyear);
        }
 
        $unixmonth = mktime(0, 0 , 0, $thismonth, 1, $thisyear);
index d14817bcef263700a63164fbf80318b1155b5f4a..cf9a29672b278e3c6e21cc9e366fe471cd3d3730 100644 (file)
@@ -87,8 +87,9 @@ function get_permalink($id = 0) {
 function get_page_link($id = false) {
        global $post, $wp_rewrite;
 
 function get_page_link($id = false) {
        global $post, $wp_rewrite;
 
+       $id = (int) $id;
        if ( !$id )
        if ( !$id )
-               $id = $post->ID;
+               $id = (int) $post->ID;
 
        $pagestruct = $wp_rewrite->get_page_permastruct();
 
 
        $pagestruct = $wp_rewrite->get_page_permastruct();
 
@@ -109,7 +110,7 @@ function get_attachment_link($id = false) {
        $link = false;
 
        if (! $id) {
        $link = false;
 
        if (! $id) {
-               $id = $post->ID;
+               $id = (int) $post->ID;
        }
 
        $object = get_post($id);
        }
 
        $object = get_post($id);
@@ -378,7 +379,7 @@ function next_post($format='%', $next='next post: ', $title='yes', $in_same_cat=
 function get_pagenum_link($pagenum = 1) {
        global $wp_rewrite;
 
 function get_pagenum_link($pagenum = 1) {
        global $wp_rewrite;
 
-       $qstr = wp_specialchars($_SERVER['REQUEST_URI']);
+       $qstr = $_SERVER['REQUEST_URI'];
 
        $page_querystring = "paged"; 
        $page_modstring = "page/";
 
        $page_querystring = "paged"; 
        $page_modstring = "page/";
@@ -445,7 +446,7 @@ function get_pagenum_link($pagenum = 1) {
        return $qstr;
 }
 
        return $qstr;
 }
 
-function next_posts($max_page = 0) { // original by cfactor at cooltux.org
+function get_next_posts_page_link($max_page = 0) {
        global $paged, $pagenow;
 
        if ( !is_single() ) {
        global $paged, $pagenow;
 
        if ( !is_single() ) {
@@ -453,10 +454,14 @@ function next_posts($max_page = 0) { // original by cfactor at cooltux.org
                        $paged = 1;
                $nextpage = intval($paged) + 1;
                if ( !$max_page || $max_page >= $nextpage )
                        $paged = 1;
                $nextpage = intval($paged) + 1;
                if ( !$max_page || $max_page >= $nextpage )
-                       echo get_pagenum_link($nextpage);
+                       return get_pagenum_link($nextpage);
        }
 }
 
        }
 }
 
+function next_posts($max_page = 0) {
+       echo clean_url(get_next_posts_page_link($max_page));
+}
+
 function next_posts_link($label='Next Page &raquo;', $max_page=0) {
        global $paged, $result, $request, $posts_per_page, $wpdb, $max_num_pages;
        if ( !$max_page ) {
 function next_posts_link($label='Next Page &raquo;', $max_page=0) {
        global $paged, $result, $request, $posts_per_page, $wpdb, $max_num_pages;
        if ( !$max_page ) {
@@ -479,18 +484,20 @@ function next_posts_link($label='Next Page &raquo;', $max_page=0) {
        }
 }
 
        }
 }
 
-
-function previous_posts() { // original by cfactor at cooltux.org
+function get_previous_posts_page_link() {
        global $paged, $pagenow;
 
        if ( !is_single() ) {
                $nextpage = intval($paged) - 1;
                if ( $nextpage < 1 )
                        $nextpage = 1;
        global $paged, $pagenow;
 
        if ( !is_single() ) {
                $nextpage = intval($paged) - 1;
                if ( $nextpage < 1 )
                        $nextpage = 1;
-               echo get_pagenum_link($nextpage);
+               return get_pagenum_link($nextpage);
        }
 }
 
        }
 }
 
+function previous_posts() {
+       echo clean_url(get_previous_posts_page_link());
+}
 
 function previous_posts_link($label='&laquo; Previous Page') {
        global $paged;
 
 function previous_posts_link($label='&laquo; Previous Page') {
        global $paged;
index 383acb379ee705b0020d411e7ecb7ad2ae9cec16..800cb7eba61085fbd97ce780c19795d9369f4f86 100644 (file)
@@ -77,6 +77,9 @@ function get_the_content($more_link_text = '(more...)', $stripteaser = 0, $more_
        else
                $file = $pagenow; //$_SERVER['PHP_SELF'];
 
        else
                $file = $pagenow; //$_SERVER['PHP_SELF'];
 
+       if ( $page > count($pages) ) // if the requested page doesn't exist
+               $page = count($pages); // give them the highest numbered page that DOES exist
+
        $content = $pages[$page-1];
        $content = explode('<!--more-->', $content, 2);
        if ( (preg_match('/<!--noteaser-->/', $post->post_content) && ((!$multipage) || ($page==1))) )
        $content = $pages[$page-1];
        $content = explode('<!--more-->', $content, 2);
        if ( (preg_match('/<!--noteaser-->/', $post->post_content) && ((!$multipage) || ($page==1))) )
@@ -155,7 +158,7 @@ function link_pages($before='<br />', $after='<br />', $next_or_number='number',
                                        if ( '' == get_settings('permalink_structure') )
                                                echo '<a href="' . get_permalink() . '&amp;page=' . $i . '">';
                                        else
                                        if ( '' == get_settings('permalink_structure') )
                                                echo '<a href="' . get_permalink() . '&amp;page=' . $i . '">';
                                        else
-                                               echo '<a href="' . trailingslashit( get_permalink() ) . $i . '/">';
+                                               echo '<a href="' . trailingslashit(get_permalink()) . $i . '/">';
                                }
                                echo $j;
                                if ( ($i != $page) || ((!$more) && ($page==1)) )
                                }
                                echo $j;
                                if ( ($i != $page) || ((!$more) && ($page==1)) )
@@ -170,14 +173,14 @@ function link_pages($before='<br />', $after='<br />', $next_or_number='number',
                                        if ( '' == get_settings('permalink_structure') )
                                                echo '<a href="' . get_permalink() . '&amp;page=' . $i . '">'.$previouspagelink.'</a>';
                                        else
                                        if ( '' == get_settings('permalink_structure') )
                                                echo '<a href="' . get_permalink() . '&amp;page=' . $i . '">'.$previouspagelink.'</a>';
                                        else
-                                               echo '<a href="' . get_permalink() . $i . '/">'.$previouspagelink.'</a>';
+                                               echo '<a href="' . get_permalink() . $i . '/">' . $previouspagelink . '</a>';
                                }
                                $i = $page + 1;
                                if ( $i <= $numpages && $more ) {
                                        if ( '' == get_settings('permalink_structure') )
                                }
                                $i = $page + 1;
                                if ( $i <= $numpages && $more ) {
                                        if ( '' == get_settings('permalink_structure') )
-                                               echo '<a href="'.get_permalink() . '&amp;page=' . $i . '">'.$nextpagelink.'</a>';
+                                               echo '<a href="' . get_permalink() . '&amp;page=' . $i . '">' . $nextpagelink . '</a>';
                                        else
                                        else
-                                               echo '<a href="'.get_permalink().$i.'/">'.$nextpagelink.'</a>';
+                                               echo '<a href="' . trailingslashit(get_permalink()) . $i . '/">' . $nextpagelink . '</a>';
                                }
                                echo $after;
                        }
                                }
                                echo $after;
                        }
@@ -197,6 +200,8 @@ function get_post_custom( $post_id = 0 ) {
        if ( ! $post_id )
                $post_id = $id;
 
        if ( ! $post_id )
                $post_id = $id;
 
+       $post_id = (int) $post_id;
+
        if ( isset($post_meta_cache[$post_id]) )
                return $post_meta_cache[$post_id];
 
        if ( isset($post_meta_cache[$post_id]) )
                return $post_meta_cache[$post_id];
 
@@ -204,7 +209,7 @@ function get_post_custom( $post_id = 0 ) {
                // Change from flat structure to hierarchical:
                $post_meta_cache = array();
                foreach ( $meta_list as $metarow ) {
                // Change from flat structure to hierarchical:
                $post_meta_cache = array();
                foreach ( $meta_list as $metarow ) {
-                       $mpid = $metarow['post_id'];
+                       $mpid = (int) $metarow['post_id'];
                        $mkey = $metarow['meta_key'];
                        $mval = $metarow['meta_value'];
 
                        $mkey = $metarow['meta_key'];
                        $mval = $metarow['meta_value'];
 
@@ -253,11 +258,14 @@ function post_custom( $key = '' ) {
 
 // this will probably change at some point...
 function the_meta() {
 
 // this will probably change at some point...
 function the_meta() {
-       global $id, $post_meta_cache;
+       global $id;
 
        if ( $keys = get_post_custom_keys() ) {
                echo "<ul class='post-meta'>\n";
                foreach ( $keys as $key ) {
 
        if ( $keys = get_post_custom_keys() ) {
                echo "<ul class='post-meta'>\n";
                foreach ( $keys as $key ) {
+                       $keyt = trim($key);
+                       if ( '_' == $keyt{0} )
+                               continue;
                        $values = array_map('trim', get_post_custom_values($key));
                        $value = implode($values,', ');
                        echo "<li><span class='post-meta-key'>$key:</span> $value</li>\n";
                        $values = array_map('trim', get_post_custom_values($key));
                        $value = implode($values,', ');
                        echo "<li><span class='post-meta-key'>$key:</span> $value</li>\n";
@@ -410,13 +418,13 @@ function _page_level_out($parent, $page_tree, $args, $depth = 0, $echo = true) {
 
        foreach ( $page_tree[$parent]['children'] as $page_id ) {
                $cur_page = $page_tree[$page_id];
 
        foreach ( $page_tree[$parent]['children'] as $page_id ) {
                $cur_page = $page_tree[$page_id];
-               $title = $cur_page['title'];
+               $title = attribute_escape($cur_page['title']);
 
                $css_class = 'page_item';
                if ( $page_id == $queried_obj->ID )
                        $css_class .= ' current_page_item';
 
 
                $css_class = 'page_item';
                if ( $page_id == $queried_obj->ID )
                        $css_class .= ' current_page_item';
 
-               $output .= $indent . '<li class="' . $css_class . '"><a href="' . get_page_link($page_id) . '" title="' . wp_specialchars($title) . '">' . $title . '</a>';
+               $output .= $indent . '<li class="' . $css_class . '"><a href="' . get_page_link($page_id) . '" title="' . $title . '">' . $title . '</a>';
 
                if ( isset($cur_page['ts']) ) {
                        $format = get_settings('date_format');
 
                if ( isset($cur_page['ts']) ) {
                        $format = get_settings('date_format');
index cab8bbed6b6f5b72c692d9ffa9a42ec65af318c0..985bf536e4cf3d7e3110a8afed98c464f9365138 100644 (file)
@@ -2,7 +2,7 @@
 
 // This just holds the version number, in a separate file so we can bump it without cluttering the SVN
 
 
 // This just holds the version number, in a separate file so we can bump it without cluttering the SVN
 
-$wp_version = '2.0.4';
-$wp_db_version = 3440;
+$wp_version = '2.0.11';
+$wp_db_version = 3441;
 
 ?>
 
 ?>
index 8a4ebaa64e18bd8ca3b2dc9940a282ad1d8b1370..790ddcfdee26c13734b01c655e7cd2b05860d424 100644 (file)
@@ -40,6 +40,12 @@ class wpdb {
        //      DB Constructor - connects to the server and selects a database
 
        function wpdb($dbuser, $dbpassword, $dbname, $dbhost) {
        //      DB Constructor - connects to the server and selects a database
 
        function wpdb($dbuser, $dbpassword, $dbname, $dbhost) {
+               return $this->__construct($dbuser, $dbpassword, $dbname, $dbhost);
+       }
+       
+       function __construct($dbuser, $dbpassword, $dbname, $dbhost) {
+               register_shutdown_function(array(&$this, "__destruct"));
+
                $this->dbh = @mysql_connect($dbhost, $dbuser, $dbpassword);
                if (!$this->dbh) {
                        $this->bail("
                $this->dbh = @mysql_connect($dbhost, $dbuser, $dbpassword);
                if (!$this->dbh) {
                        $this->bail("
@@ -57,6 +63,10 @@ class wpdb {
                $this->select($dbname);
        }
 
                $this->select($dbname);
        }
 
+       function __destruct() {
+               return true;            
+       }
+
        // ==================================================================
        //      Select a DB (if another one needs to be selected)
 
        // ==================================================================
        //      Select a DB (if another one needs to be selected)
 
@@ -122,7 +132,7 @@ class wpdb {
        //      Kill cached query results
 
        function flush() {
        //      Kill cached query results
 
        function flush() {
-               $this->last_result = null;
+               $this->last_result = array();
                $this->col_info = null;
                $this->last_query = null;
        }
                $this->col_info = null;
                $this->last_query = null;
        }
@@ -131,6 +141,11 @@ class wpdb {
        //      Basic Query     - see docs for more detail
 
        function query($query) {
        //      Basic Query     - see docs for more detail
 
        function query($query) {
+               // filter the query, if filters are available
+               // NOTE: some queries are made before the plugins have been loaded, and thus cannot be filtered with this method
+               if ( function_exists('apply_filters') )
+                       $query = apply_filters('query', $query);
+
                // initialise return
                $return_val = 0;
                $this->flush();
                // initialise return
                $return_val = 0;
                $this->flush();
index 848a9986e2b6cef775fba8122a892b3e8a16e239..3c2cbf554e54015850656a4dcb2ac6171f4ca4ae 100644 (file)
@@ -28,7 +28,7 @@ if ((empty($link_cat)) || ($link_cat == 'all') || ($link_cat == '0')) {
     <body>
 <?php $sql = "SELECT $wpdb->links.link_url, link_rss, $wpdb->links.link_name, $wpdb->links.link_category, $wpdb->linkcategories.cat_name, link_updated 
 FROM $wpdb->links 
     <body>
 <?php $sql = "SELECT $wpdb->links.link_url, link_rss, $wpdb->links.link_name, $wpdb->links.link_category, $wpdb->linkcategories.cat_name, link_updated 
 FROM $wpdb->links 
- JOIN $wpdb->linkcategories on $wpdb->links.link_category = $wpdb->linkcategories.cat_id
INNER JOIN $wpdb->linkcategories on $wpdb->links.link_category = $wpdb->linkcategories.cat_id
  AND $wpdb->links.link_visible = 'Y'
  $sql_cat
  ORDER BY $wpdb->linkcategories.cat_name, $wpdb->links.link_name \n";
  AND $wpdb->links.link_visible = 'Y'
  $sql_cat
  ORDER BY $wpdb->linkcategories.cat_name, $wpdb->links.link_name \n";
@@ -44,12 +44,12 @@ FROM $wpdb->links
 <?php
              } // end if not first time
 ?>
 <?php
              } // end if not first time
 ?>
-        <outline type="category" title="<?php echo wp_specialchars($result->cat_name); ?>">
+        <outline type="category" title="<?php echo attribute_escape($result->cat_name); ?>">
 <?php
              $prev_cat_id = $result->link_category;
         } // end if new category
 ?>
 <?php
              $prev_cat_id = $result->link_category;
         } // end if new category
 ?>
-            <outline text="<?php echo wp_specialchars($result->link_name); ?>" type="link" xmlUrl="<?php echo wp_specialchars($result->link_rss); ?>" htmlUrl="<?php echo wp_specialchars($result->link_url); ?>" updated="<?php if ('0000-00-00 00:00:00' != $result->link_updated) echo $result->link_updated; ?>" />
+            <outline text="<?php echo attribute_escape($result->link_name); ?>" type="link" xmlUrl="<?php echo attribute_escape($result->link_rss); ?>" htmlUrl="<?php echo attribute_escape($result->link_url); ?>" updated="<?php if ('0000-00-00 00:00:00' != $result->link_updated) echo $result->link_updated; ?>" />
 <?php
         } // end foreach
 ?>
 <?php
         } // end foreach
 ?>
index 3a45bc9ea02b94c24ce5da6bd2e86e1374d808e5..4e2a129f3689669cb43d36fe34cb4be4de45a263 100644 (file)
@@ -127,7 +127,7 @@ break;
 case 'resetpass' :
 
        // Generate something random for a password... md5'ing current time with a rand salt
 case 'resetpass' :
 
        // Generate something random for a password... md5'ing current time with a rand salt
-       $key = preg_replace('/a-z0-9/i', '', $_GET['key']);
+       $key = preg_replace('/[^a-z0-9]/i', '', $_GET['key']);
        if ( empty($key) )
                die( __('Sorry, that key does not appear to be valid.') );
        $user = $wpdb->get_row("SELECT * FROM $wpdb->users WHERE user_activation_key = '$key'");
        if ( empty($key) )
                die( __('Sorry, that key does not appear to be valid.') );
        $user = $wpdb->get_row("SELECT * FROM $wpdb->users WHERE user_activation_key = '$key'");
@@ -166,7 +166,7 @@ default:
        $user_login = '';
        $user_pass = '';
        $using_cookie = false;
        $user_login = '';
        $user_pass = '';
        $using_cookie = false;
-       if ( !isset( $_REQUEST['redirect_to'] ) )
+       if ( !isset( $_REQUEST['redirect_to'] ) || is_user_logged_in() )
                $redirect_to = 'wp-admin/';
        else
                $redirect_to = $_REQUEST['redirect_to'];
                $redirect_to = 'wp-admin/';
        else
                $redirect_to = $_REQUEST['redirect_to'];
@@ -231,14 +231,14 @@ if ( $error )
 ?>
 
 <form name="loginform" id="loginform" action="wp-login.php" method="post">
 ?>
 
 <form name="loginform" id="loginform" action="wp-login.php" method="post">
-<p><label><?php _e('Username:') ?><br /><input type="text" name="log" id="log" value="<?php echo wp_specialchars(stripslashes($user_login), 1); ?>" size="20" tabindex="1" /></label></p>
+<p><label><?php _e('Username:') ?><br /><input type="text" name="log" id="log" value="<?php echo attribute_escape(stripslashes($user_login)); ?>" size="20" tabindex="1" /></label></p>
 <p><label><?php _e('Password:') ?><br /> <input type="password" name="pwd" id="pwd" value="" size="20" tabindex="2" /></label></p>
 <p>
   <label><input name="rememberme" type="checkbox" id="rememberme" value="forever" tabindex="3" /> 
   <?php _e('Remember me'); ?></label></p>
 <p class="submit">
        <input type="submit" name="submit" id="submit" value="<?php _e('Login'); ?> &raquo;" tabindex="4" />
 <p><label><?php _e('Password:') ?><br /> <input type="password" name="pwd" id="pwd" value="" size="20" tabindex="2" /></label></p>
 <p>
   <label><input name="rememberme" type="checkbox" id="rememberme" value="forever" tabindex="3" /> 
   <?php _e('Remember me'); ?></label></p>
 <p class="submit">
        <input type="submit" name="submit" id="submit" value="<?php _e('Login'); ?> &raquo;" tabindex="4" />
-       <input type="hidden" name="redirect_to" value="<?php echo wp_specialchars($redirect_to); ?>" />
+       <input type="hidden" name="redirect_to" value="<?php echo attribute_escape($redirect_to); ?>" />
 </p>
 </form>
 <ul>
 </p>
 </form>
 <ul>
index 6c62fbad6beaaa9b836fbc6050862a9321f6d388..5fb178fa1c2bb605e5b72ebb08375bb219ac0582 100644 (file)
@@ -58,7 +58,7 @@ for ($i=1; $i <= $count; $i++) :
 
                        // Set the author using the email address (To or Reply-To, the last used)
                        // otherwise use the site admin
 
                        // Set the author using the email address (To or Reply-To, the last used)
                        // otherwise use the site admin
-                       if (preg_match('/From: /', $line) | preg_match('Reply-To: /', $line))  {
+                       if (preg_match('/From: /', $line) | preg_match('/Reply-To: /', $line))  {
                                $author=trim($line);
                        if ( ereg("([a-zA-Z0-9\_\-\.]+@[\a-zA-z0-9\_\-\.]+)", $author , $regs) ) {
                                $author = $regs[1];
                                $author=trim($line);
                        if ( ereg("([a-zA-Z0-9\_\-\.]+@[\a-zA-z0-9\_\-\.]+)", $author , $regs) ) {
                                $author = $regs[1];
index 49798c33149a224bcc240d1bfb543a29f1d8d181..ebf8e0c686e4cf50ff6e7d0e83f9c97e8cc2e0fb 100644 (file)
@@ -113,8 +113,8 @@ default:
 <?php endif; ?>
 <form method="post" action="wp-register.php" id="registerform">
        <p><input type="hidden" name="action" value="register" />
 <?php endif; ?>
 <form method="post" action="wp-register.php" id="registerform">
        <p><input type="hidden" name="action" value="register" />
-       <label for="user_login"><?php _e('Username:') ?></label><br /> <input type="text" name="user_login" id="user_login" size="20" maxlength="20" value="<?php echo wp_specialchars($user_login); ?>" /><br /></p>
-       <p><label for="user_email"><?php _e('E-mail:') ?></label><br /> <input type="text" name="user_email" id="user_email" size="25" maxlength="100" value="<?php echo wp_specialchars($user_email); ?>" /></p>
+       <label for="user_login"><?php _e('Username:') ?></label><br /> <input type="text" name="user_login" id="user_login" size="20" maxlength="20" value="<?php echo attribute_escape($user_login); ?>" /><br /></p>
+       <p><label for="user_email"><?php _e('E-mail:') ?></label><br /> <input type="text" name="user_email" id="user_email" size="25" maxlength="100" value="<?php echo attribute_escape($user_email); ?>" /></p>
        <p><?php _e('A password will be emailed to you.') ?></p>
        <p class="submit"><input type="submit" value="<?php _e('Register') ?> &raquo;" id="submit" name="submit" /></p>
 </form>
        <p><?php _e('A password will be emailed to you.') ?></p>
        <p class="submit"><input type="submit" value="<?php _e('Register') ?> &raquo;" id="submit" name="submit" /></p>
 </form>
index 8f42acaac5a0fd5123355acb6b8b06203c41d98a..afb4804a23b6483b9d2ec9bfaa279acf72afd7a7 100644 (file)
@@ -47,7 +47,7 @@ $more = 1;
                <content:encoded><![CDATA[<?php the_excerpt_rss() ?>]]></content:encoded>
        <?php endif; ?>
 <?php endif; ?>
                <content:encoded><![CDATA[<?php the_excerpt_rss() ?>]]></content:encoded>
        <?php endif; ?>
 <?php endif; ?>
-               <wfw:commentRSS><?php echo comments_rss(); ?></wfw:commentRSS>
+               <wfw:commentRss><?php echo comments_rss(); ?></wfw:commentRss>
 <?php rss_enclosure(); ?>
        <?php do_action('rss2_item'); ?>
        </item>
 <?php rss_enclosure(); ?>
        <?php do_action('rss2_item'); ?>
        </item>
index f01ccb7e32f1338bc6d5a4a6d68f527e5b6dd76b..a76988c3e4d11ec0bab224e5fb8ea9cfe982cb4d 100644 (file)
@@ -12,8 +12,10 @@ function unregister_GLOBALS() {
        
        $input = array_merge($_GET, $_POST, $_COOKIE, $_SERVER, $_ENV, $_FILES, isset($_SESSION) && is_array($_SESSION) ? $_SESSION : array());
        foreach ( $input as $k => $v ) 
        
        $input = array_merge($_GET, $_POST, $_COOKIE, $_SERVER, $_ENV, $_FILES, isset($_SESSION) && is_array($_SESSION) ? $_SESSION : array());
        foreach ( $input as $k => $v ) 
-               if ( !in_array($k, $noUnset) && isset($GLOBALS[$k]) )
+               if ( !in_array($k, $noUnset) && isset($GLOBALS[$k]) ) {
+                       $GLOBALS[$k] = NULL;
                        unset($GLOBALS[$k]);
                        unset($GLOBALS[$k]);
+               }
 }
 
 unregister_GLOBALS(); 
 }
 
 unregister_GLOBALS(); 
@@ -199,9 +201,10 @@ $_SERVER = add_magic_quotes($_SERVER);
 
 do_action('sanitize_comment_cookies');
 
 
 do_action('sanitize_comment_cookies');
 
-$wp_query   = new WP_Query();
-$wp_rewrite = new WP_Rewrite();
-$wp         = new WP();
+$wp_the_query =& new WP_Query();
+$wp_query     =& $wp_the_query;
+$wp_rewrite   =& new WP_Rewrite();
+$wp           =& new WP();
 
 define('TEMPLATEPATH', get_template_directory());
 
 
 define('TEMPLATEPATH', get_template_directory());
 
@@ -224,4 +227,4 @@ register_shutdown_function('shutdown_action_hook');
 // Everything is loaded and initialized.
 do_action('init');
 
 // Everything is loaded and initialized.
 do_action('init');
 
-?>
\ No newline at end of file
+?>
index 1779c17ae7ff4f79e92d559709db5d5c68c90f43..ae6ed41192c486242d9fbac7277824ff029367eb 100644 (file)
@@ -30,11 +30,13 @@ if ( !$_GET['tb_id'] ) {
        $tb_id = intval( $tb_id[ count($tb_id) - 1 ] );
 }
 
        $tb_id = intval( $tb_id[ count($tb_id) - 1 ] );
 }
 
-$tb_url    = $_POST['url'];
-$title     = $_POST['title'];
-$excerpt   = $_POST['excerpt'];
-$blog_name = $_POST['blog_name'];
-$charset   = $_POST['charset'];
+$tb_url  = $_POST['url'];
+$charset = $_POST['charset'];
+
+// These three are stripslashed here so that they can be properly escaped after mb_convert_encoding()
+$title     = stripslashes($_POST['title']);
+$excerpt   = stripslashes($_POST['excerpt']);
+$blog_name = stripslashes($_POST['blog_name']);
 
 if ($charset)
        $charset = strtoupper( trim($charset) );
 
 if ($charset)
        $charset = strtoupper( trim($charset) );
@@ -42,11 +44,16 @@ else
        $charset = 'ASCII, UTF-8, ISO-8859-1, JIS, EUC-JP, SJIS';
 
 if ( function_exists('mb_convert_encoding') ) { // For international trackbacks
        $charset = 'ASCII, UTF-8, ISO-8859-1, JIS, EUC-JP, SJIS';
 
 if ( function_exists('mb_convert_encoding') ) { // For international trackbacks
-       $title     = mb_convert_encoding($title, get_settings('blog_charset'), $charset);
-       $excerpt   = mb_convert_encoding($excerpt, get_settings('blog_charset'), $charset);
-       $blog_name = mb_convert_encoding($blog_name, get_settings('blog_charset'), $charset);
+       $title     = mb_convert_encoding($title, get_option('blog_charset'), $charset);
+       $excerpt   = mb_convert_encoding($excerpt, get_option('blog_charset'), $charset);
+       $blog_name = mb_convert_encoding($blog_name, get_option('blog_charset'), $charset);
 }
 
 }
 
+// Now that mb_convert_encoding() has been given a swing, we need to escape these three
+$title     = $wpdb->escape($title);
+$excerpt   = $wpdb->escape($excerpt);
+$blog_name = $wpdb->escape($blog_name);
+
 if ( is_single() || is_page() ) 
     $tb_id = $posts[0]->ID;
 
 if ( is_single() || is_page() ) 
     $tb_id = $posts[0]->ID;
 
@@ -77,7 +84,7 @@ if ( !empty($tb_url) && !empty($title) && !empty($tb_url) ) {
                $title = (strlen($title) > 250) ? substr($title, 0, 250) . '...' : $title;
        }
 
                $title = (strlen($title) > 250) ? substr($title, 0, 250) . '...' : $title;
        }
 
-       $comment_post_ID = $tb_id;
+       $comment_post_ID = (int) $tb_id;
        $comment_author = $blog_name;
        $comment_author_email = '';
        $comment_author_url = $tb_url;
        $comment_author = $blog_name;
        $comment_author_email = '';
        $comment_author_url = $tb_url;
index c5b361778fd98c2634ef6da62471dd256d44d423..2664138baaef6502c192d59114aa19a9b68af679 100644 (file)
@@ -58,31 +58,8 @@ function starify($string) {
        return str_repeat('*', $i);
 }
 
        return str_repeat('*', $i);
 }
 
-logIO("I", $HTTP_RAW_POST_DATA);
-
-
-function mkdir_p($target) {
-       // from php.net/mkdir user contributed notes 
-       if (file_exists($target)) {
-         if (!is_dir($target)) {
-           return false;
-         } else {
-           return true;
-         }
-       }
-
-       // Attempting to create the directory may clutter up our display.
-       if (@mkdir($target)) {
-         return true;
-       }
-
-       // If the above failed, attempt to create the parent node, then try again.
-       if (mkdir_p(dirname($target))) {
-         return mkdir_p($target);
-       }
-
-       return false;
-}
+if ( isset($HTTP_RAW_POST_DATA) )
+  logIO("I", $HTTP_RAW_POST_DATA);
 
 
 class wp_xmlrpc_server extends IXR_Server {
 
 
 class wp_xmlrpc_server extends IXR_Server {
@@ -157,7 +134,7 @@ class wp_xmlrpc_server extends IXR_Server {
        function escape(&$array) {
                global $wpdb;
 
        function escape(&$array) {
                global $wpdb;
 
-               foreach ($array as $k => $v) {
+               foreach ( (array) $array as $k => $v ) {
                        if (is_array($v)) {
                                $this->escape($array[$k]);
                        } else if (is_object($v)) {
                        if (is_array($v)) {
                                $this->escape($array[$k]);
                        } else if (is_object($v)) {
@@ -231,9 +208,9 @@ class wp_xmlrpc_server extends IXR_Server {
 
                $this->escape($args);
 
 
                $this->escape($args);
 
-         $post_ID    = $args[1];
-         $user_login = $args[2];
-         $user_pass  = $args[3];
+               $post_ID    = (int) $args[1];
+               $user_login = $args[2];
+               $user_pass  = $args[3];
 
          if (!$this->login_pass_ok($user_login, $user_pass)) {
            return $this->error;
 
          if (!$this->login_pass_ok($user_login, $user_pass)) {
            return $this->error;
@@ -266,10 +243,10 @@ class wp_xmlrpc_server extends IXR_Server {
 
                $this->escape($args);
 
 
                $this->escape($args);
 
-         $blog_ID    = $args[1]; /* though we don't use it yet */
-         $user_login = $args[2];
-         $user_pass  = $args[3];
-         $num_posts  = $args[4];
+               $blog_ID    = (int) $args[1]; /* though we don't use it yet */
+               $user_login = $args[2];
+               $user_pass  = $args[3];
+               $num_posts  = $args[4];
 
          if (!$this->login_pass_ok($user_login, $user_pass)) {
            return $this->error;
 
          if (!$this->login_pass_ok($user_login, $user_pass)) {
            return $this->error;
@@ -314,7 +291,7 @@ class wp_xmlrpc_server extends IXR_Server {
 
                $this->escape($args);
 
 
                $this->escape($args);
 
-         $blog_ID    = $args[1];
+         $blog_ID    = (int) $args[1];
          $user_login = $args[2];
          $user_pass  = $args[3];
          $template   = $args[4]; /* could be 'main' or 'archiveIndex', but we don't use it */
          $user_login = $args[2];
          $user_pass  = $args[3];
          $template   = $args[4]; /* could be 'main' or 'archiveIndex', but we don't use it */
@@ -348,7 +325,7 @@ class wp_xmlrpc_server extends IXR_Server {
 
                $this->escape($args);
 
 
                $this->escape($args);
 
-         $blog_ID    = $args[1];
+         $blog_ID    = (int) $args[1];
          $user_login = $args[2];
          $user_pass  = $args[3];
          $content    = $args[4];
          $user_login = $args[2];
          $user_pass  = $args[3];
          $content    = $args[4];
@@ -385,7 +362,7 @@ class wp_xmlrpc_server extends IXR_Server {
 
                $this->escape($args);
 
 
                $this->escape($args);
 
-         $blog_ID    = $args[1]; /* though we don't use it yet */
+         $blog_ID    = (int) $args[1]; /* though we don't use it yet */
          $user_login = $args[2];
          $user_pass  = $args[3];
          $content    = $args[4];
          $user_login = $args[2];
          $user_pass  = $args[3];
          $content    = $args[4];
@@ -432,7 +409,7 @@ class wp_xmlrpc_server extends IXR_Server {
 
                $this->escape($args);
 
 
                $this->escape($args);
 
-         $post_ID     = $args[1];
+         $post_ID     = (int) $args[1];
          $user_login  = $args[2];
          $user_pass   = $args[3];
          $content     = $args[4];
          $user_login  = $args[2];
          $user_pass   = $args[3];
          $content     = $args[4];
@@ -454,7 +431,10 @@ class wp_xmlrpc_server extends IXR_Server {
          if ( !current_user_can('edit_post', $post_ID) )
            return new IXR_Error(401, 'Sorry, you do not have the right to edit this post.');
 
          if ( !current_user_can('edit_post', $post_ID) )
            return new IXR_Error(401, 'Sorry, you do not have the right to edit this post.');
 
-         extract($actual_post);
+         extract($actual_post, EXTR_SKIP);
+
+         if ( ('publish' == $post_status) && !current_user_can('publish_posts') )
+               return new IXR_Error(401, 'Sorry, you do not have the right to publish this post.');
 
          $post_title = xmlrpc_getposttitle($content);
          $post_category = xmlrpc_getpostcategory($content);
 
          $post_title = xmlrpc_getposttitle($content);
          $post_category = xmlrpc_getpostcategory($content);
@@ -479,7 +459,7 @@ class wp_xmlrpc_server extends IXR_Server {
 
                $this->escape($args);
 
 
                $this->escape($args);
 
-         $post_ID     = $args[1];
+         $post_ID     = (int) $args[1];
          $user_login  = $args[2];
          $user_pass   = $args[3];
          $publish     = $args[4];
          $user_login  = $args[2];
          $user_pass   = $args[3];
          $publish     = $args[4];
@@ -520,7 +500,7 @@ class wp_xmlrpc_server extends IXR_Server {
 
                $this->escape($args);
 
 
                $this->escape($args);
 
-         $blog_ID     = $args[0]; // we will support this in the near future
+         $blog_ID     = (int) $args[0]; // we will support this in the near future
          $user_login  = $args[1];
          $user_pass   = $args[2];
          $content_struct = $args[3];
          $user_login  = $args[1];
          $user_pass   = $args[2];
          $content_struct = $args[3];
@@ -555,7 +535,9 @@ class wp_xmlrpc_server extends IXR_Server {
            $post_content = $post_content . "\n<!--more-->\n" . $post_more;
          }
 
            $post_content = $post_content . "\n<!--more-->\n" . $post_more;
          }
 
-               $to_ping = $content_struct['mt_tb_ping_urls'];
+         $to_ping = $content_struct['mt_tb_ping_urls'];
+         if ( is_array($to_ping) )
+               $to_ping = implode(' ', $to_ping);
 
          // Do some timestamp voodoo
          $dateCreatedd = $content_struct['dateCreated'];
 
          // Do some timestamp voodoo
          $dateCreatedd = $content_struct['dateCreated'];
@@ -600,7 +582,7 @@ class wp_xmlrpc_server extends IXR_Server {
 
                $this->escape($args);
 
 
                $this->escape($args);
 
-         $post_ID     = $args[0];
+         $post_ID     = (int) $args[0];
          $user_login  = $args[1];
          $user_pass   = $args[2];
          $content_struct = $args[3];
          $user_login  = $args[1];
          $user_pass   = $args[2];
          $content_struct = $args[3];
@@ -615,8 +597,8 @@ class wp_xmlrpc_server extends IXR_Server {
            return new IXR_Error(401, 'Sorry, you can not edit this post.');
 
          $postdata = wp_get_single_post($post_ID, ARRAY_A);
            return new IXR_Error(401, 'Sorry, you can not edit this post.');
 
          $postdata = wp_get_single_post($post_ID, ARRAY_A);
-         extract($postdata);
                $this->escape($postdata);
                $this->escape($postdata);
+               extract($postdata, EXTR_SKIP);
 
          $post_title = $content_struct['title'];
          $post_content = apply_filters( 'content_save_pre', $content_struct['description'] );
 
          $post_title = $content_struct['title'];
          $post_content = apply_filters( 'content_save_pre', $content_struct['description'] );
@@ -634,12 +616,18 @@ class wp_xmlrpc_server extends IXR_Server {
          $post_more = $content_struct['mt_text_more'];
          $post_status = $publish ? 'publish' : 'draft';
 
          $post_more = $content_struct['mt_text_more'];
          $post_status = $publish ? 'publish' : 'draft';
 
+
+         if ( ('publish' == $post_status) && !current_user_can('publish_posts') )
+               return new IXR_Error(401, 'Sorry, you do not have the right to publish this post.');
+
          if ($post_more) {
            $post_content = $post_content . "\n<!--more-->\n" . $post_more;
          }
 
          if ($post_more) {
            $post_content = $post_content . "\n<!--more-->\n" . $post_more;
          }
 
-               $to_ping = $content_struct['mt_tb_ping_urls'];
-
+         $to_ping = $content_struct['mt_tb_ping_urls'];
+         if ( is_array($to_ping) )
+               $to_ping = implode(' ', $to_ping);
+         
          $comment_status = (empty($content_struct['mt_allow_comments'])) ?
            get_settings('default_comment_status')
            : $content_struct['mt_allow_comments'];
          $comment_status = (empty($content_struct['mt_allow_comments'])) ?
            get_settings('default_comment_status')
            : $content_struct['mt_allow_comments'];
@@ -680,7 +668,7 @@ class wp_xmlrpc_server extends IXR_Server {
 
                $this->escape($args);
 
 
                $this->escape($args);
 
-         $post_ID     = $args[0];
+         $post_ID     = (int) $args[0];
          $user_login  = $args[1];
          $user_pass   = $args[2];
 
          $user_login  = $args[1];
          $user_pass   = $args[2];
 
@@ -735,10 +723,10 @@ class wp_xmlrpc_server extends IXR_Server {
 
                $this->escape($args);
 
 
                $this->escape($args);
 
-         $blog_ID     = $args[0];
-         $user_login  = $args[1];
-         $user_pass   = $args[2];
-         $num_posts   = $args[3];
+               $blog_ID     = (int) $args[0];
+               $user_login  = $args[1];
+               $user_pass   = $args[2];
+               $num_posts   = (int) $args[3];
 
          if (!$this->login_pass_ok($user_login, $user_pass)) {
            return $this->error;
 
          if (!$this->login_pass_ok($user_login, $user_pass)) {
            return $this->error;
@@ -801,9 +789,9 @@ class wp_xmlrpc_server extends IXR_Server {
 
                $this->escape($args);
 
 
                $this->escape($args);
 
-         $blog_ID     = $args[0];
-         $user_login  = $args[1];
-         $user_pass   = $args[2];
+               $blog_ID     = (int) $args[0];
+               $user_login  = $args[1];
+               $user_pass   = $args[2];
 
          if (!$this->login_pass_ok($user_login, $user_pass)) {
            return $this->error;
 
          if (!$this->login_pass_ok($user_login, $user_pass)) {
            return $this->error;
@@ -835,7 +823,7 @@ class wp_xmlrpc_server extends IXR_Server {
 
                global $wpdb;
 
 
                global $wpdb;
 
-               $blog_ID     = $wpdb->escape($args[0]);
+               $blog_ID     = (int) $args[0];
                $user_login  = $wpdb->escape($args[1]);
                $user_pass   = $wpdb->escape($args[2]);
                $data        = $args[3];
                $user_login  = $wpdb->escape($args[1]);
                $user_pass   = $wpdb->escape($args[2]);
                $data        = $args[3];
@@ -875,10 +863,10 @@ class wp_xmlrpc_server extends IXR_Server {
 
                $this->escape($args);
 
 
                $this->escape($args);
 
-         $blog_ID     = $args[0];
-         $user_login  = $args[1];
-         $user_pass   = $args[2];
-         $num_posts   = $args[3];
+               $blog_ID     = (int) $args[0];
+               $user_login  = $args[1];
+               $user_pass   = $args[2];
+               $num_posts   = (int) $args[3];
 
          if (!$this->login_pass_ok($user_login, $user_pass)) {
            return $this->error;
 
          if (!$this->login_pass_ok($user_login, $user_pass)) {
            return $this->error;
@@ -920,9 +908,9 @@ class wp_xmlrpc_server extends IXR_Server {
 
                $this->escape($args);
 
 
                $this->escape($args);
 
-         $blog_ID     = $args[0];
-         $user_login  = $args[1];
-         $user_pass   = $args[2];
+               $blog_ID     = (int) $args[0];
+               $user_login  = $args[1];
+               $user_pass   = $args[2];
 
          if (!$this->login_pass_ok($user_login, $user_pass)) {
            return $this->error;
 
          if (!$this->login_pass_ok($user_login, $user_pass)) {
            return $this->error;
@@ -949,9 +937,9 @@ class wp_xmlrpc_server extends IXR_Server {
 
                $this->escape($args);
 
 
                $this->escape($args);
 
-         $post_ID     = $args[0];
-         $user_login  = $args[1];
-         $user_pass   = $args[2];
+               $post_ID     = (int) $args[0];
+               $user_login  = $args[1];
+               $user_pass   = $args[2];
 
          if (!$this->login_pass_ok($user_login, $user_pass)) {
            return $this->error;
 
          if (!$this->login_pass_ok($user_login, $user_pass)) {
            return $this->error;
@@ -979,10 +967,10 @@ class wp_xmlrpc_server extends IXR_Server {
 
                $this->escape($args);
 
 
                $this->escape($args);
 
-         $post_ID     = $args[0];
-         $user_login  = $args[1];
-         $user_pass   = $args[2];
-         $categories  = $args[3];
+               $post_ID     = (int) $args[0];
+               $user_login  = $args[1];
+               $user_pass   = $args[2];
+               $categories  = $args[3];
 
          if (!$this->login_pass_ok($user_login, $user_pass)) {
            return $this->error;
 
          if (!$this->login_pass_ok($user_login, $user_pass)) {
            return $this->error;
@@ -1062,9 +1050,9 @@ class wp_xmlrpc_server extends IXR_Server {
 
                $this->escape($args);
 
 
                $this->escape($args);
 
-         $post_ID     = $args[0];
-         $user_login  = $args[1];
-         $user_pass   = $args[2];
+               $post_ID     = (int) $args[0];
+               $user_login  = $args[1];
+               $user_pass   = $args[2];
 
          if (!$this->login_pass_ok($user_login, $user_pass)) {
            return $this->error;
 
          if (!$this->login_pass_ok($user_login, $user_pass)) {
            return $this->error;
@@ -1124,18 +1112,18 @@ class wp_xmlrpc_server extends IXR_Server {
                } elseif (preg_match('#p/[0-9]{1,}#', $urltest['path'], $match)) {
                        // the path defines the post_ID (archives/p/XXXX)
                        $blah = explode('/', $match[0]);
                } elseif (preg_match('#p/[0-9]{1,}#', $urltest['path'], $match)) {
                        // the path defines the post_ID (archives/p/XXXX)
                        $blah = explode('/', $match[0]);
-                       $post_ID = $blah[1];
+                       $post_ID = (int) $blah[1];
                        $way = 'from the path';
                } elseif (preg_match('#p=[0-9]{1,}#', $urltest['query'], $match)) {
                        // the querystring defines the post_ID (?p=XXXX)
                        $blah = explode('=', $match[0]);
                        $way = 'from the path';
                } elseif (preg_match('#p=[0-9]{1,}#', $urltest['query'], $match)) {
                        // the querystring defines the post_ID (?p=XXXX)
                        $blah = explode('=', $match[0]);
-                       $post_ID = $blah[1];
+                       $post_ID = (int) $blah[1];
                        $way = 'from the querystring';
                } elseif (isset($urltest['fragment'])) {
                        // an #anchor is there, it's either...
                        if (intval($urltest['fragment'])) {
                                // ...an integer #XXXX (simpliest case)
                        $way = 'from the querystring';
                } elseif (isset($urltest['fragment'])) {
                        // an #anchor is there, it's either...
                        if (intval($urltest['fragment'])) {
                                // ...an integer #XXXX (simpliest case)
-                               $post_ID = $urltest['fragment'];
+                               $post_ID = (int) $urltest['fragment'];
                                $way = 'from the fragment (numeric)';
                        } elseif (preg_match('/post-[0-9]+/',$urltest['fragment'])) {
                                // ...a post id in the form 'post-###'
                                $way = 'from the fragment (numeric)';
                        } elseif (preg_match('/post-[0-9]+/',$urltest['fragment'])) {
                                // ...a post id in the form 'post-###'