From 7c1f56b9b78c461d4cf1b7f9f94cc35d767e8935 Mon Sep 17 00:00:00 2001
From: Ryan Boren
Date: Mon, 7 May 2007 02:16:28 +0000
Subject: [PATCH] attribute_escape for widgets. see #4169
git-svn-id: https://develop.svn.wordpress.org/trunk@5403 602fd350-edb4-49c9-b593-d223f7449a82
---
wp-includes/widgets.php | 52 ++++++++++++++++++++---------------------
1 file changed, 26 insertions(+), 26 deletions(-)
diff --git a/wp-includes/widgets.php b/wp-includes/widgets.php
index f76b8c696e..9c27428a0e 100644
--- a/wp-includes/widgets.php
+++ b/wp-includes/widgets.php
@@ -338,7 +338,7 @@ function wp_widget_pages_control() {
$options = $newoptions;
update_option('widget_pages', $options);
}
- $title = htmlspecialchars($options['title'], ENT_QUOTES);
+ $title = attribute_escape($options['title']);
?>
@@ -367,7 +367,7 @@ function wp_widget_search($args) {
@@ -386,7 +386,7 @@ function wp_widget_archives($args) {
if($d) {
?>
-
+
@@ -412,7 +412,7 @@ function wp_widget_archives_control() {
}
$count = $options['count'] ? 'checked="checked"' : '';
$dropdown = $options['dropdown'] ? 'checked="checked"' : '';
- $title = htmlspecialchars($options['title'], ENT_QUOTES);
+ $title = attribute_escape($options['title']);
?>
@@ -431,9 +431,9 @@ function wp_widget_meta($args) {
@@ -448,7 +448,7 @@ function wp_widget_meta_control() {
$options = $newoptions;
update_option('widget_meta', $options);
}
- $title = htmlspecialchars($options['title'], ENT_QUOTES);
+ $title = attribute_escape($options['title']);
?>
@@ -476,7 +476,7 @@ function wp_widget_calendar_control() {
$options = $newoptions;
update_option('widget_calendar', $options);
}
- $title = htmlspecialchars($options['title'], ENT_QUOTES);
+ $title = attribute_escape($options['title']);
?>
@@ -512,8 +512,8 @@ function wp_widget_text_control($number) {
$options = $newoptions;
update_option('widget_text', $options);
}
- $title = htmlspecialchars($options[$number]['title'], ENT_QUOTES);
- $text = htmlspecialchars($options[$number]['text'], ENT_QUOTES);
+ $title = attribute_escape($options[$number]['title']);
+ $text = attribute_escape($options[$number]['text']);
?>
" name="text-title-" type="text" value="" />
@@ -546,7 +546,7 @@ function wp_widget_text_page() {
-
+
@@ -682,7 +682,7 @@ function wp_widget_recent_entries_control() {
update_option('widget_recent_entries', $options);
wp_flush_widget_recent_entries();
}
- $title = htmlspecialchars($options['title'], ENT_QUOTES);
+ $title = attribute_escape($options['title']);
if ( !$number = (int) $options['number'] )
$number = 5;
?>
@@ -737,7 +737,7 @@ function wp_widget_recent_comments_control() {
update_option('widget_recent_comments', $options);
wp_delete_recent_comments_cache();
}
- $title = htmlspecialchars($options['title'], ENT_QUOTES);
+ $title = attribute_escape($options['title']);
if ( !$number = (int) $options['number'] )
$number = 5;
?>
@@ -778,10 +778,10 @@ function wp_widget_rss($args, $number = 1) {
if ( empty($url) )
return;
$rss = fetch_rss($url);
- $link = wp_specialchars(strip_tags($rss->channel['link']), 1);
+ $link = clean_url(strip_tags($rss->channel['link']));
while ( strstr($link, 'http') != $link )
$link = substr($link, 1);
- $desc = wp_specialchars(strip_tags(html_entity_decode($rss->channel['description'], ENT_QUOTES)), 1);
+ $desc = attribute_escape(strip_tags(html_entity_decode($rss->channel['description'], ENT_QUOTES)));
$title = $options[$number]['title'];
if ( empty($title) )
$title = htmlentities(strip_tags($rss->channel['title']));
@@ -789,12 +789,12 @@ function wp_widget_rss($args, $number = 1) {
$title = $desc;
if ( empty($title) )
$title = __('Unknown Feed');
- $url = wp_specialchars(strip_tags($url), 1);
+ $url = clean_url(strip_tags($url));
if ( file_exists(dirname(__FILE__) . '/rss.png') )
$icon = str_replace(ABSPATH, get_option('siteurl').'/', dirname(__FILE__)) . '/rss.png';
else
$icon = get_option('siteurl').'/wp-includes/images/rss.png';
- $title = " ";
+ $title = " ";
?>
@@ -805,8 +805,8 @@ function wp_widget_rss($args, $number = 1) {
foreach ($rss->items as $item ) {
while ( strstr($item['link'], 'http') != $item['link'] )
$item['link'] = substr($item['link'], 1);
- $link = wp_specialchars(strip_tags($item['link']), 1);
- $title = wp_specialchars(strip_tags($item['title']), 1);
+ $link = clean_url(strip_tags($item['link']));
+ $title = attribute_escape(strip_tags($item['title']));
if ( empty($title) )
$title = __('Untitled');
$desc = '';
@@ -814,7 +814,7 @@ function wp_widget_rss($args, $number = 1) {
$summary = '';
} else {
if ( isset( $item['description'] ) && is_string( $item['description'] ) )
- $desc = str_replace(array("\n", "\r"), ' ', wp_specialchars(strip_tags(html_entity_decode($item['description'], ENT_QUOTES)), 1));
+ $desc = str_replace(array("\n", "\r"), ' ', attribute_escape(strip_tags(html_entity_decode($item['description'], ENT_QUOTES))));
$summary = '';
}
echo "$summary";
@@ -832,7 +832,7 @@ function wp_widget_rss_control($number) {
$options = $newoptions = get_option('widget_rss');
if ( $_POST["rss-submit-$number"] ) {
$newoptions[$number]['items'] = (int) $_POST["rss-items-$number"];
- $url = strip_tags(stripslashes($_POST["rss-url-$number"]));
+ $url = clean_url(strip_tags(stripslashes($_POST["rss-url-$number"])));
$newoptions[$number]['title'] = trim(strip_tags(stripslashes($_POST["rss-title-$number"])));
if ( $url !== $options[$number]['url'] ) {
require_once(ABSPATH . WPINC . '/rss.php');
@@ -851,9 +851,9 @@ function wp_widget_rss_control($number) {
$options = $newoptions;
update_option('widget_rss', $options);
}
- $url = htmlspecialchars($options[$number]['url'], ENT_QUOTES);
+ $url = attribute_escape($options[$number]['url']);
$items = (int) $options[$number]['items'];
- $title = htmlspecialchars($options[$number]['title'], ENT_QUOTES);
+ $title = attribute_escape($options[$number]['title']);
if ( empty($items) || $items < 1 ) $items = 10;
?>
@@ -890,7 +890,7 @@ function wp_widget_rss_page() {
-
+