<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.1//EN"
"http://www.w3.org/TR/xhtml11/DTD/xhtml11.dtd">
<html xmlns="http://www.w3.org/1999/xhtml">
<head><meta http-equiv="content-type" content="text/html; charset=utf-8" /><style type="text/css"><!--
#msg dl { border: 1px #006 solid; background: #369; padding: 6px; color: #fff; }
#msg dt { float: left; width: 6em; font-weight: bold; }
#msg dt:after { content:':';}
#msg dl, #msg dt, #msg ul, #msg li, #header, #footer { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; }
#msg dl a { font-weight: bold}
#msg dl a:link { color:#fc3; }
#msg dl a:active { color:#ff0; }
#msg dl a:visited { color:#cc6; }
h3 { font-family: verdana,arial,helvetica,sans-serif; font-size: 10pt; font-weight: bold; }
#msg pre { overflow: auto; background: #ffc; border: 1px #fc0 solid; padding: 6px; }
#msg ul, pre { overflow: auto; }
#header, #footer { color: #fff; background: #636; border: 1px #300 solid; padding: 6px; }
#patch { width: 100%; }
#patch h4 {font-family: verdana,arial,helvetica,sans-serif;font-size:10pt;padding:8px;background:#369;color:#fff;margin:0;}
#patch .propset h4, #patch .binary h4 {margin:0;}
#patch pre {padding:0;line-height:1.2em;margin:0;}
#patch .diff {width:100%;background:#eee;padding: 0 0 10px 0;overflow:auto;}
#patch .propset .diff, #patch .binary .diff {padding:10px 0;}
#patch span {display:block;padding:0 10px;}
#patch .modfile, #patch .addfile, #patch .delfile, #patch .propset, #patch .binary, #patch .copfile {border:1px solid #ccc;margin:10px 0;}
#patch ins {background:#dfd;text-decoration:none;display:block;padding:0 10px;}
#patch del {background:#fdd;text-decoration:none;display:block;padding:0 10px;}
#patch .lines, .info {color:#888;background:#fff;}
--></style>
<title>[13471] trunk/wp-admin/options.php: Make it more obvious we'
re escaping values in options.php.</title>
</head>
<body>
<div id="msg">
<dl>
<dt>Revision</dt> <dd><a href="http://trac.wordpress.org/changeset/13471">13471</a></dd>
<dt>Author</dt> <dd>nacin</dd>
<dt>Date</dt> <dd>2010-02-27 22:50:00 +0000 (Sat, 27 Feb 2010)</dd>
</dl>
<h3>Log Message</h3>
<pre>Make it more obvious we're escaping values in options.php. fixes <a href="http://trac.wordpress.org/ticket/12417">#12417</a></pre>
<h3>Modified Paths</h3>
<ul>
<li><a href="#trunkwpadminoptionsphp">trunk/wp-admin/options.php</a></li>
</ul>
</div>
<div id="patch">
<h3>Diff</h3>
<a id="trunkwpadminoptionsphp"></a>
<div class="modfile"><h4>Modified: trunk/wp-admin/options.php (13470 => 13471)</h4>
<pre class="diff"><span>
<span class="info">--- trunk/wp-admin/options.php 2010-02-27 22:01:22 UTC (rev 13470)
+++ trunk/wp-admin/options.php 2010-02-27 22:50:00 UTC (rev 13471)
</span><span class="lines">@@ -152,24 +152,23 @@
</span><span class="cx">
</span><span class="cx"> <div class="wrap">
</span><span class="cx"> <?php screen_icon(); ?>
</span><del>- <h2><?php _e('All Settings'); ?></h2>
</del><ins>+ <h2><?php esc_html_e('All Settings'); ?></h2>
</ins><span class="cx"> <form name="form" action="options.php" method="post" id="all-options">
</span><span class="cx"> <?php wp_nonce_field('options-options') ?>
</span><span class="cx"> <input type="hidden" name="action" value="update" />
</span><span class="cx"> <input type='hidden' name='option_page' value='options' />
</span><span class="cx"> <table class="form-table">
</span><span class="cx"> <?php
</span><del>-$options = $wpdb->get_results("SELECT * FROM $wpdb->options ORDER BY option_name");
</del><ins>+$options = $wpdb->get_results( "SELECT * FROM $wpdb->options ORDER BY option_name" );
</ins><span class="cx">
</span><del>-foreach ( (array) $options as $option) :
</del><ins>+foreach ( (array) $options as $option ) :
</ins><span class="cx"> $disabled = '';
</span><del>- $option->option_name = esc_attr($option->option_name);
</del><span class="cx"> if ( $option->option_name == '' )
</span><span class="cx"> continue;
</span><del>- if ( is_serialized($option->option_value) ) {
- if ( is_serialized_string($option->option_value) ) {
</del><ins>+ if ( is_serialized( $option->option_value ) ) {
+ if ( is_serialized_string( $option->option_value ) ) {
</ins><span class="cx"> // this is a serialized string, so we should display it
</span><del>- $value = maybe_unserialize($option->option_value);
</del><ins>+ $value = maybe_unserialize( $option->option_value );
</ins><span class="cx"> $options_to_update[] = $option->option_name;
</span><span class="cx"> $class = 'all-options';
</span><span class="cx"> } else {
</span><span class="lines">@@ -182,21 +181,21 @@
</span><span class="cx"> $options_to_update[] = $option->option_name;
</span><span class="cx"> $class = 'all-options';
</span><span class="cx"> }
</span><ins>+ $name = esc_attr( $option->option_name );
</ins><span class="cx"> echo "
</span><span class="cx"> <tr>
</span><del>- <th scope='row'><label for='$option->option_name'>$option->option_name</label></th>
</del><ins>+ <th scope='row'><label for='$'>" . esc_html( $option->option_name ) . "</label></th>
</ins><span class="cx"> <td>";
</span><del>-
- if (strpos($value, "\n") !== false) echo "<textarea class='$class' name='$option->option_name' id='$option->option_name' cols='30' rows='5'>" . esc_html($value) . "</textarea>";
- else echo "<input class='regular-text $class' type='text' name='$option->option_name' id='$option->option_name' value='" . esc_attr($value) . "'$disabled />";
-
</del><ins>+ if ( strpos( $value, "\n" ) !== false )
+ echo "<textarea class='$class' name='$name' id='$name' cols='30' rows='5'>" . wp_htmledit_pre( $value ) . "</textarea>";
+ else
+ echo "<input class='regular-text $class' type='text' name='$name' id='$name' value='" . esc_attr( $value ) . "'$disabled />";
</ins><span class="cx"> echo "</td>
</span><span class="cx"> </tr>";
</span><span class="cx"> endforeach;
</span><span class="cx"> ?>
</span><span class="cx"> </table>
</span><del>-<?php $options_to_update = implode(',', $options_to_update); ?>
-<p class="submit"><input type="hidden" name="page_options" value="<?php echo esc_attr($options_to_update); ?>" /><input type="submit" name="Update" value="<?php _e('Save Changes') ?>" class="button-primary" /></p>
</del><ins>+<p class="submit"><input type="hidden" name="page_options" value="<?php echo esc_attr( implode( ',', $options_to_update ) ); ?>" /><input type="submit" name="Update" value="<?php esc_attr_e( 'Save Changes' ); ?>" class="button-primary" /></p>
</ins><span class="cx"> </form>
</span><span class="cx"> </div>
</span><span class="cx">
</span></span></pre>
</div>
</div>
</body>
</html>