From: Edward Z. Yang Date: Sun, 22 May 2011 09:56:12 +0000 (+0100) Subject: Wordpress 3.0.5 X-Git-Tag: wordpress-3.0.5 X-Git-Url: https://scripts.mit.edu/gitweb/autoinstalls/wordpress.git/commitdiff_plain/9b5673a7aae863ab45c3b73460060352c5b3810b Wordpress 3.0.5 Signed-off-by: Edward Z. Yang --- diff --git a/readme.html b/readme.html index 16433f0d..09747ce2 100644 --- a/readme.html +++ b/readme.html @@ -8,7 +8,7 @@

WordPress -
Version 3.0.4 +
Version 3.0.5

Semantic Personal Publishing Platform

@@ -102,7 +102,7 @@

WordPress is the official continuation of b2/cafélog, which came from Michel V. The work has been continued by the WordPress developers. If you would like to support WordPress, please consider donating.

Copyright

-

WordPress is released under the GPL (see license.txt).

+

WordPress is free software, and is released under the terms of the GPL version 2 or (at your option) any later version. See license.txt.

diff --git a/wp-admin/async-upload.php b/wp-admin/async-upload.php index 4210b0e0..6fa65181 100644 --- a/wp-admin/async-upload.php +++ b/wp-admin/async-upload.php @@ -30,6 +30,13 @@ if ( !current_user_can('upload_files') ) // just fetch the detail form for that attachment if ( isset($_REQUEST['attachment_id']) && ($id = intval($_REQUEST['attachment_id'])) && $_REQUEST['fetch'] ) { + $post = get_post( $id ); + if ( 'attachment' != $post->post_type ) + wp_die( __( 'Unknown post type.' ) ); + $post_type_object = get_post_type_object( 'attachment' ); + if ( ! current_user_can( $post_type_object->cap->edit_post, $id ) ) + wp_die( __( 'You are not allowed to edit this item.' ) ); + if ( 2 == $_REQUEST['fetch'] ) { add_filter('attachment_fields_to_edit', 'media_single_attachment_fields_to_edit', 10, 2); echo get_media_item($id, array( 'send' => false, 'delete' => true )); diff --git a/wp-admin/includes/post.php b/wp-admin/includes/post.php index 6448c9e9..040cd6ca 100644 --- a/wp-admin/includes/post.php +++ b/wp-admin/includes/post.php @@ -689,6 +689,8 @@ function get_post_meta_by_id( $mid ) { $mid = (int) $mid; $meta = $wpdb->get_row( $wpdb->prepare("SELECT * FROM $wpdb->postmeta WHERE meta_id = %d", $mid) ); + if ( empty($meta) ) + return false; if ( is_serialized_string( $meta->meta_value ) ) $meta->meta_value = maybe_unserialize( $meta->meta_value ); return $meta; diff --git a/wp-admin/includes/template.php b/wp-admin/includes/template.php index ea1c8056..fd7e76f9 100644 --- a/wp-admin/includes/template.php +++ b/wp-admin/includes/template.php @@ -1185,16 +1185,16 @@ function get_inline_data($post) { if ( ! current_user_can($post_type_object->cap->edit_post, $post->ID) ) return; - $title = esc_attr( get_the_title( $post->ID ) ); + $title = htmlspecialchars( trim( $post->post_title ), ENT_QUOTES ); echo '