<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" /><style type="text/css"><!--
#msg dl { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; }
#msg dl a { font-weight: bold}
#msg dl a:link { color:#fc3; }
#msg dl a:active { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fc0 solid; padding: 6px; }
#msg ul, pre { overflow: auto; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<title>[12539] branches/2.8: Some hardening for 2.8</title>
</head>
<body>
<div id="msg">
<dl>
<dt>Revision</dt> <dd><a href="http://trac.wordpress.org/changeset/12539">12539</a></dd>
<dt>Author</dt> <dd>ryan</dd>
<dt>Date</dt> <dd>2009-12-24 16:08:15 +0000 (Thu, 24 Dec 2009)</dd>
</dl>
<h3>Log Message</h3>
<pre>Some hardening for 2.8</pre>
<h3>Modified Paths</h3>
<ul>
<li><a href="#branches28wpadminincludestemplatephp">branches/2.8/wp-admin/includes/template.php</a></li>
<li><a href="#branches28wpincludespluggablephp">branches/2.8/wp-includes/pluggable.php</a></li>
</ul>
</div>
<div id="patch">
<h3>Diff</h3>
<a id="branches28wpadminincludestemplatephp"></a>
<div class="modfile"><h4>Modified: branches/2.8/wp-admin/includes/template.php (12538 => 12539)</h4>
<pre class="diff"><span>
<span class="info">--- branches/2.8/wp-admin/includes/template.php 2009-12-24 11:24:32 UTC (rev 12538)
+++ branches/2.8/wp-admin/includes/template.php 2009-12-24 16:08:15 UTC (rev 12539)
</span><span class="lines">@@ -2095,6 +2095,7 @@
</span><span class="cx"> else
</span><span class="cx"> $ptime = mysql2date(__('Y/m/d \a\t g:i A'), $comment->comment_date );
</span><span class="cx">
</span><ins>+ $comment_url = esc_url(get_comment_link($comment->comment_ID));
</ins><span class="cx"> $delete_url = esc_url( wp_nonce_url( "comment.php?action=deletecomment&p=$post->ID&c=$comment->comment_ID", "delete-comment_$comment->comment_ID" ) );
</span><span class="cx"> $approve_url = esc_url( wp_nonce_url( "comment.php?action=approvecomment&p=$post->ID&c=$comment->comment_ID", "approve-comment_$comment->comment_ID" ) );
</span><span class="cx"> $unapprove_url = esc_url( wp_nonce_url( "comment.php?action=unapprovecomment&p=$post->ID&c=$comment->comment_ID", "unapprove-comment_$comment->comment_ID" ) );
</span><span class="lines">@@ -2122,7 +2123,7 @@
</span><span class="cx"> case 'comment':
</span><span class="cx"> echo "<td $attributes>";
</span><span class="cx"> echo '<div id="submitted-on">';
</span><del>- printf(__('Submitted on <a href="%1$s">%2$s at %3$s</a>'), get_comment_link($comment->comment_ID), get_comment_date(__('Y/m/d')), get_comment_date(__('g:ia')));
</del><ins>+ printf(__('Submitted on <a href="%1$s">%2$s at %3$s</a>'), $comment_url, get_comment_date(__('Y/m/d')), get_comment_date(__('g:ia')));
</ins><span class="cx"> echo '</div>';
</span><span class="cx"> comment_text(); ?>
</span><span class="cx"> <div id="inline-<?php echo $comment->comment_ID; ?>" class="hidden">
</span><span class="lines">@@ -2140,15 +2141,15 @@
</span><span class="cx"> $actions['unapprove'] = "<a href='$unapprove_url' class='dim:the-comment-list:comment-$comment->comment_ID:unapproved:e7e7d3:e7e7d3:new=unapproved vim-u' title='" . __( 'Unapprove this comment' ) . "'>" . __( 'Unapprove' ) . '</a>';
</span><span class="cx"> if ( $comment_status && 'all' != $comment_status ) { // not looking at all comments
</span><span class="cx"> if ( 'approved' == $the_comment_status ) {
</span><del>- $actions['unapprove'] = "<a href='$unapprove_url' class='delete:the-comment-list:comment-$comment->comment_ID:e7e7d3:action=dim-comment&amp;new=unapproved vim-u vim-destructive' title='" . __( 'Unapprove this comment' ) . "'>" . __( 'Unapprove' ) . '</a>';
</del><ins>+ $actions['unapprove'] = "<a href='$unapprove_url' class='delete:the-comment-list:comment-$comment->comment_ID:e7e7d3:action=dim-comment&amp;new=unapproved vim-u vim-destructive' title='" . esc_attr__( 'Unapprove this comment' ) . "'>" . __( 'Unapprove' ) . '</a>';
</ins><span class="cx"> unset($actions['approve']);
</span><span class="cx"> } else {
</span><del>- $actions['approve'] = "<a href='$approve_url' class='delete:the-comment-list:comment-$comment->comment_ID:e7e7d3:action=dim-comment&amp;new=approved vim-a vim-destructive' title='" . __( 'Approve this comment' ) . "'>" . __( 'Approve' ) . '</a>';
</del><ins>+ $actions['approve'] = "<a href='$approve_url' class='delete:the-comment-list:comment-$comment->comment_ID:e7e7d3:action=dim-comment&amp;new=approved vim-a vim-destructive' title='" . esc_attr__( 'Approve this comment' ) . "'>" . __( 'Approve' ) . '</a>';
</ins><span class="cx"> unset($actions['unapprove']);
</span><span class="cx"> }
</span><span class="cx"> }
</span><span class="cx"> if ( 'spam' != $the_comment_status )
</span><del>- $actions['spam'] = "<a href='$spam_url' class='delete:the-comment-list:comment-$comment->comment_ID::spam=1 vim-s vim-destructive' title='" . __( 'Mark this comment as spam' ) . "'>" . /* translators: mark as spam link */ _x( 'Spam', 'verb' ) . '</a>';
</del><ins>+ $actions['spam'] = "<a href='$spam_url' class='delete:the-comment-list:comment-$comment->comment_ID::spam=1 vim-s vim-destructive' title='" . esc_attr__( 'Mark this comment as spam' ) . "'>" . /* translators: mark as spam link */ _x( 'Spam', 'verb' ) . '</a>';
</ins><span class="cx"> $actions['delete'] = "<a href='$delete_url' class='delete:the-comment-list:comment-$comment->comment_ID delete vim-d vim-destructive'>" . __('Delete') . '</a>';
</span><span class="cx"> $actions['edit'] = "<a href='comment.php?action=editcomment&amp;c={$comment->comment_ID}' title='" . __('Edit comment') . "'>". __('Edit') . '</a>';
</span><span class="cx"> $actions['quickedit'] = '<a onclick="commentReply.open(\''.$comment->comment_ID.'\',\''.$post->ID.'\',\'edit\');return false;" class="vim-q" title="'.__('Quick Edit').'" href="#">' . __('Quick&nbsp;Edit') . '</a>';
</span><span class="lines">@@ -2214,7 +2215,7 @@
</span><span class="cx"> echo "<td $attributes>\n";
</span><span class="cx"> echo '<div class="response-links"><span class="post-com-count-wrapper">';
</span><span class="cx"> echo $post_link . '<br />';
</span><del>- $pending_phrase = sprintf( __('%s pending'), number_format( $pending_comments ) );
</del><ins>+ $pending_phrase = esc_attr(sprintf( __('%s pending'), number_format( $pending_comments ) ));
</ins><span class="cx"> if ( $pending_comments )
</span><span class="cx"> echo '<strong>';
</span><span class="cx"> comments_number("<a href='edit-comments.php?p=$post->ID' title='$pending_phrase' class='post-com-count'><span class='comment-count'>" . /* translators: comment count link */ _x('0', 'comment count') . '</span></a>', "<a href='edit-comments.php?p=$post->ID' title='$pending_phrase' class='post-com-count'><span class='comment-count'>" . /* translators: comment count link */ _x('1', 'comment count') . '</span></a>', "<a href='edit-comments.php?p=$post->ID' title='$pending_phrase' class='post-com-count'><span class='comment-count'>" . /* translators: comment count link: % will be substituted by comment count */ _x('%', 'comment count') . '</span></a>');
</span></span></pre></div>
<a id="branches28wpincludespluggablephp"></a>
<div class="modfile"><h4>Modified: branches/2.8/wp-includes/pluggable.php (12538 => 12539)</h4>
<pre class="diff"><span>
<span class="info">--- branches/2.8/wp-includes/pluggable.php 2009-12-24 11:24:32 UTC (rev 12538)
+++ branches/2.8/wp-includes/pluggable.php 2009-12-24 16:08:15 UTC (rev 12539)
</span><span class="lines">@@ -99,7 +99,7 @@
</span><span class="cx"> return;
</span><span class="cx">
</span><span class="cx"> if ( ! $user = wp_validate_auth_cookie() ) {
</span><del>- if ( empty($_COOKIE[LOGGED_IN_COOKIE]) || !$user = wp_validate_auth_cookie($_COOKIE[LOGGED_IN_COOKIE], 'logged_in') ) {
</del><ins>+ if ( is_admin() || empty($_COOKIE[LOGGED_IN_COOKIE]) || !$user = wp_validate_auth_cookie($_COOKIE[LOGGED_IN_COOKIE], 'logged_in') ) {
</ins><span class="cx"> wp_set_current_user(0);
</span><span class="cx"> return false;
</span><span class="cx"> }
</span></span></pre>
</div>
</div>
</body>
</html>