--- wp-admin/bookmarklet.php
+++ wp-admin/bookmarklet.php
@@ -37,7 +37,7 @@
$content = wp_specialchars($_REQUEST['content']);
-$popupurl = attribute_escape(stripslashes($_REQUEST['popupurl']));
+$popupurl = clean_url(stripslashes($_REQUEST['popupurl']));
if ( !empty($content) ) {
$post->post_content = wp_specialchars( stripslashes($_REQUEST['content']) );
} else {
--- wp-admin/edit-comments.php
+++ wp-admin/edit-comments.php
@@ -44,7 +44,7 @@
$i = 0;
foreach ($_POST['delete_comments'] as $comment) : // Check the permissions on each
$comment = (int) $comment;
- $post_id = $wpdb->get_var("SELECT comment_post_ID FROM $wpdb->comments WHERE comment_ID = $comment");
+ $post_id = (int) $wpdb->get_var("SELECT comment_post_ID FROM $wpdb->comments WHERE comment_ID = $comment");
$authordata = get_userdata( $wpdb->get_var("SELECT post_author FROM $wpdb->posts WHERE ID = $post_id") );
if ( current_user_can('edit_post', $post_id) ) :
wp_set_comment_status($comment, "delete");
--- wp-admin/import/dotclear.php
+++ wp-admin/import/dotclear.php
@@ -430,8 +430,8 @@
extract($comment);
// WordPressify Data
- $comment_ID = ltrim($comment_id, '0');
- $comment_post_ID = $postarr[$post_id];
+ $comment_ID = (int) ltrim($comment_id, '0');
+ $comment_post_ID = (int) $postarr[$post_id];
$comment_approved = "$comment_pub";
$name = $wpdb->escape(csc ($comment_auteur));
$email = $wpdb->escape($comment_email);
--- wp-admin/import/livejournal.php
+++ wp-admin/import/livejournal.php
@@ -80,7 +80,7 @@
$comments = $comments[1];
if ( $comments ) {
- $comment_post_ID = $post_id;
+ $comment_post_ID = (int) $post_id;
$num_comments = 0;
foreach ($comments as $comment) {
preg_match('|
(.*?)|is', $comment, $comment_content);
--- wp-admin/import/mt.php
+++ wp-admin/import/mt.php
@@ -169,7 +169,7 @@
return;
}
$this->file = $file['file'];
- $this->id = $file['id'];
+ $this->id = (int) $file['id'];
$this->get_entries();
$this->mt_authors_form();
@@ -293,7 +293,7 @@
}
}
- $comment_post_ID = $post_id;
+ $comment_post_ID = (int) $post_id;
$comment_approved = 1;
// Now for comments
--- wp-admin/post.php
+++ wp-admin/post.php
@@ -81,7 +81,7 @@
?>
@@ -86,7 +86,7 @@
if ( empty( $_GET['backto'] ) )
$backto = __get_option('home');
else
- $backto = attribute_escape(stripslashes($_GET['backto']));
+ $backto = clean_url(stripslashes($_GET['backto']));
?>
Have fun!"), $backto); ?>
--- wp-comments-post.php
+++ wp-comments-post.php
@@ -25,14 +25,20 @@
// If the user is logged in
$user = wp_get_current_user();
-if ( $user->ID ) :
+if ( $user->ID ) {
$comment_author = $wpdb->escape($user->display_name);
$comment_author_email = $wpdb->escape($user->user_email);
$comment_author_url = $wpdb->escape($user->user_url);
-else :
+ if ( current_user_can('unfiltered_html') ) {
+ if ( wp_create_nonce('unfiltered-html-comment_' . $comment_post_ID) != $_POST['_wp_unfiltered_html_comment'] ) {
+ kses_remove_filters(); // start with a clean slate
+ kses_init_filters(); // set up the filters
+ }
+ }
+} else {
if ( get_option('comment_registration') )
die( __('Sorry, you must be logged in to post a comment.') );
-endif;
+}
$comment_type = '';
--- wp-includes/classes.php
+++ wp-includes/classes.php
@@ -1617,6 +1617,9 @@
$this->query_vars[$wpvar] = $query_vars[$wpvar];
else
$this->query_vars[$wpvar] = '';
+
+ if ( !empty( $this->query_vars[$wpvar] ) )
+ $this->query_vars[$wpvar] = (string) $this->query_vars[$wpvar];
}
if ( isset($error) )
--- wp-includes/comment-functions.php
+++ wp-includes/comment-functions.php
@@ -2,6 +2,12 @@
// Template functions
+function wp_comment_form_unfiltered_html_nonce() {
+ global $post;
+ if ( current_user_can('unfiltered_html') )
+ wp_nonce_field('unfiltered-html-comment_' . $post->ID, '_wp_unfiltered_html_comment', false);
+}
+
function comments_template( $file = '/comments.php' ) {
global $wp_query, $withcomments, $post, $wpdb, $id, $comment, $user_login, $user_ID, $user_identity;
@@ -84,7 +90,7 @@
('$comment_post_ID', '$comment_author', '$comment_author_email', '$comment_author_url', '$comment_author_IP', '$comment_date', '$comment_date_gmt', '$comment_content', '$comment_approved', '$comment_agent', '$comment_type', '$comment_parent', '$user_id')
");
- $id = $wpdb->insert_id;
+ $id = (int) $wpdb->insert_id;
if ( $comment_approved == 1) {
$count = $wpdb->get_var("SELECT COUNT(*) FROM $wpdb->comments WHERE comment_post_ID = '$comment_post_ID' AND comment_approved = '1'");
@@ -218,7 +224,7 @@
$post_id = (int) $post_id;
if ( !$post_id )
- $post_id = $id;
+ $post_id = (int) $id;
if ( !isset($comment_count_cache[$post_id]) )
$comment_count_cache[$id] = $wpdb->get_var("SELECT comment_count FROM $wpdb->posts WHERE ID = '$post_id'");
--- wp-includes/default-filters.php
+++ wp-includes/default-filters.php
@@ -33,6 +33,8 @@
add_filter('pre_comment_author_email', 'wp_filter_kses');
add_filter('pre_comment_author_url', 'wp_filter_kses');
+add_action('comment_form', 'wp_comment_form_unfiltered_html_nonce');
+
// Default filters for these functions
add_filter('comment_author', 'wptexturize');
add_filter('comment_author', 'convert_chars');
--- wp-includes/functions-formatting.php
+++ wp-includes/functions-formatting.php
@@ -1051,7 +1051,11 @@
$strip = array('%0d', '%0a');
$url = str_replace($strip, '', $url);
$url = str_replace(';//', '://', $url);
- $url = (!strstr($url, '://')) ? 'http://'.$url : $url;
+ // Append http unless a relative link starting with / or a php file.
+ if ( strpos($url, '://') === false &&
+ substr( $url, 0, 1 ) != '/' && !preg_match('/^[a-z0-9]+?\.php/i', $url) )
+ $url = 'http://' . $url;
+
$url = preg_replace('/&([^#])(?![a-z]{2,8};)/', '&$1', $url);
if ( !is_array($protocols) )
$protocols = array('http', 'https', 'ftp', 'ftps', 'mailto', 'news', 'irc', 'gopher', 'nntp', 'feed', 'telnet');
--- wp-includes/functions-post.php
+++ wp-includes/functions-post.php
@@ -47,7 +47,7 @@
// Get the post ID.
if ( $update )
- $post_ID = $ID;
+ $post_ID = (int) $ID;
// Create a valid post name. Drafts are allowed to have an empty
// post name.
@@ -406,6 +406,7 @@
global $wpdb;
// Set the limit clause, if we got a limit
+ $num = (int) $num;
if ($num) {
$limit = "LIMIT $num";
}
@@ -476,6 +477,9 @@
function wp_set_post_cats($blogid = '1', $post_ID = 0, $post_categories = array()) {
global $wpdb;
+
+ $post_ID = (int) $post_ID;
+
// If $post_categories isn't already an array, make it one:
if (!is_array($post_categories) || 0 == count($post_categories))
$post_categories = array(get_option('default_category'));
@@ -486,7 +490,7 @@
$old_categories = $wpdb->get_col("
SELECT category_id
FROM $wpdb->post2cat
- WHERE post_id = $post_ID");
+ WHERE post_id = '$post_ID'");
if (!$old_categories) {
$old_categories = array();
@@ -501,8 +505,8 @@
foreach ($delete_cats as $del) {
$wpdb->query("
DELETE FROM $wpdb->post2cat
- WHERE category_id = $del
- AND post_id = $post_ID
+ WHERE category_id = '$del'
+ AND post_id = '$post_ID'
");
}
}
@@ -512,12 +516,14 @@
if ($add_cats) {
foreach ($add_cats as $new_cat) {
- $wpdb->query("
- INSERT INTO $wpdb->post2cat (post_id, category_id)
- VALUES ($post_ID, $new_cat)");
+ $new_cat = (int) $new_cat;
+ if ( !empty($new_cat) )
+ $wpdb->query("
+ INSERT INTO $wpdb->post2cat (post_id, category_id)
+ VALUES ('$post_ID', '$new_cat')");
}
}
-
+
// Update category counts.
$all_affected_cats = array_unique(array_merge($post_categories, $old_categories));
foreach ( $all_affected_cats as $cat_id ) {
--- wp-includes/functions.php
+++ wp-includes/functions.php
@@ -171,6 +171,7 @@
function get_usernumposts($userid) {
global $wpdb;
+ $userid = (int) $userid;
return $wpdb->get_var("SELECT COUNT(*) FROM $wpdb->posts WHERE post_author = '$userid' AND post_status = 'publish'");
}
@@ -606,6 +607,7 @@
$post_cache[$post->ID] = &$post;
$_post = & $post_cache[$post->ID];
} else {
+ $post = (int) $post;
if ( $_post = wp_cache_get($post, 'pages') )
return get_page($_post, $output);
elseif ( isset($post_cache[$post]) )
@@ -709,6 +711,7 @@
wp_cache_add($page->ID, $page, 'pages');
$_page = $page;
} else {
+ $page = (int) $page;
if ( isset($GLOBALS['page']) && ($page == $GLOBALS['page']->ID) ) {
$_page = & $GLOBALS['page'];
wp_cache_add($_page->ID, $_page, 'pages');
@@ -767,6 +770,7 @@
wp_cache_add($category->cat_ID, $category, 'category');
$_category = $category;
} else {
+ $category = (int) $category;
if ( ! $_category = wp_cache_get($category, 'category') ) {
$_category = $wpdb->get_row("SELECT * FROM $wpdb->categories WHERE cat_ID = '$category' LIMIT 1");
wp_cache_add($category, $_category, 'category');
@@ -804,6 +808,7 @@
$comment_cache[$comment->comment_ID] = &$comment;
$_comment = & $comment_cache[$comment->comment_ID];
} else {
+ $comment = (int) $comment;
if ( !isset($comment_cache[$comment]) ) {
$_comment = $wpdb->get_row("SELECT * FROM $wpdb->comments WHERE comment_ID = '$comment' LIMIT 1");
$comment_cache[$comment->comment_ID] = & $_comment;
@@ -2019,7 +2024,7 @@
function get_page_template() {
global $wp_query;
- $id = $wp_query->post->ID;
+ $id = (int) $wp_query->post->ID;
$template = get_post_meta($id, '_wp_page_template', true);
if ( 'default' == $template )
@@ -2369,9 +2374,11 @@
return wp_specialchars(add_query_arg('_wpnonce', wp_create_nonce($action), $actionurl));
}
-function wp_nonce_field($action = -1) {
- echo '
';
- wp_referer_field();
+function wp_nonce_field($action = -1, $name = "_wpnonce", $referer = true) {
+ $name = attribute_escape($name);
+ echo '
';
+ if ( $referer )
+ wp_referer_field();
}
function wp_referer_field() {
@@ -2486,7 +2493,7 @@
$html .= "\t\t
\n";
$html .= "\t\t
\n\t\t
" . wp_specialchars(wp_explain_nonce($action)) . "
\n\t\t
" . __('No') . "
\n\t\t
\n\t\n";
} else {
- $html .= "\t
\n";
+ $html .= "\t
\n";
}
$html .= "