[wp-cvs] wordpress/wp-admin admin-functions.php, 1.66, 1.67 bookmarklet.php, 1.16, 1.17 categories.php, 1.44, 1.45 edit-comments.php, 1.40, 1.41 edit-form-advanced.php, 1.44, 1.45 edit-page-form.php, 1.14, 1.15 edit.php, 1.37, 1.38 link-add.php, 1.19, 1.20 link-categories.php, 1.17, 1.18 link-manager.php, 1.41, 1.42 options.php, 1.37, 1.38 plugin-editor.php, 1.3, 1.4 post.php, 1.112, 1.113 profile.php, 1.33, 1.34 sidebar.php, 1.13, 1.14 templates.php, 1.30, 1.31 theme-editor.php, 1.8, 1.9 user-edit.php, 1.7, 1.8 users.php, 1.41, 1.42

Matthew Mullenweg saxmatt at users.sourceforge.net
Sun Dec 12 20:41:18 UTC 2004


Update of /cvsroot/cafelog/wordpress/wp-admin
In directory sc8-pr-cvs1.sourceforge.net:/tmp/cvs-serv7803/wp-admin

Modified Files:
	admin-functions.php bookmarklet.php categories.php 
	edit-comments.php edit-form-advanced.php edit-page-form.php 
	edit.php link-add.php link-categories.php link-manager.php 
	options.php plugin-editor.php post.php profile.php sidebar.php 
	templates.php theme-editor.php user-edit.php users.php 
Log Message:
Axing htmlspecialchars because it double-encodes-encodes. Better error handling around queries.

Index: link-add.php
===================================================================
RCS file: /cvsroot/cafelog/wordpress/wp-admin/link-add.php,v
retrieving revision 1.19
retrieving revision 1.20
diff -C2 -d -r1.19 -r1.20
*** link-add.php	19 Oct 2004 03:03:03 -0000	1.19
--- link-add.php	12 Dec 2004 20:41:14 -0000	1.20
***************
*** 2,24 ****
  require_once('admin.php');
  
! $title = 'Add Link';
  $this_file = 'link-manager.php';
  $parent_file = 'link-manager.php';
  
  function category_dropdown($fieldname, $selected = 0) {
!     global $wpdb;
! 
!     $results = $wpdb->get_results("SELECT cat_id, cat_name, auto_toggle FROM $wpdb->linkcategories ORDER BY cat_id");
!     echo '        <select name="'.$fieldname.'" size="1">'."\n";
!     foreach ($results as $row) {
!       echo "          <option value=\"".$row->cat_id."\"";
!       if ($row->cat_id == $selected)
!         echo " selected";
!         echo ">".$row->cat_id.": ".htmlspecialchars($row->cat_name);
!         if ($row->auto_toggle == 'Y')
!             echo ' (auto toggle)';
!         echo "</option>\n";
!     }
!     echo "        </select>\n";
  }
  
--- 2,24 ----
  require_once('admin.php');
  
! $title = __('Add Link');
  $this_file = 'link-manager.php';
  $parent_file = 'link-manager.php';
  
  function category_dropdown($fieldname, $selected = 0) {
! 	global $wpdb;
! 	
! 	$results = $wpdb->get_results("SELECT cat_id, cat_name, auto_toggle FROM $wpdb->linkcategories ORDER BY cat_id");
! 	echo "\n<select name='$fieldname' size='1'>\n";
! 	foreach ($results as $row) {
! 		echo "\n\t<option value='$row->cat_id'";
! 		if ($row->cat_id == $selected)
! 			echo " selected='selected'";
! 		echo ">$row->cat_id : " . wp_specialchars($row->cat_name);
! 		if ($row->auto_toggle == 'Y')
! 			echo ' (auto toggle)';
! 		echo "</option>";
! 	}
! 	echo "\n</select>\n";
  }
  
***************
*** 50,54 ****
  
  <?php if ($_GET['added']) : ?>
! <div class="updated"><p>Link added.</p></div>
  <?php endif; ?>
  <div class="wrap">
--- 50,54 ----
  
  <?php if ($_GET['added']) : ?>
! <div class="updated"><p><?php _e('Link added.'); ?></p></div>
  <?php endif; ?>
  <div class="wrap">
***************
*** 60,68 ****
           <tr>
             <th width="33%" scope="row"><?php _e('URI:') ?></th>
!            <td width="67%"><input type="text" name="linkurl" value="<?php echo $_GET['linkurl']; ?>" style="width: 95%;" /></td>
           </tr>
           <tr>
             <th scope="row"><?php _e('Link Name:') ?></th>
!            <td><input type="text" name="name" value="<?php echo urldecode($_GET['name']); ?>" style="width: 95%" /></td>
           </tr>
           <tr>
--- 60,68 ----
           <tr>
             <th width="33%" scope="row"><?php _e('URI:') ?></th>
!            <td width="67%"><input type="text" name="linkurl" value="<?php echo wp_specialchars($_GET['linkurl'], 1); ?>" style="width: 95%;" /></td>
           </tr>
           <tr>
             <th scope="row"><?php _e('Link Name:') ?></th>
!            <td><input type="text" name="name" value="<?php echo wp_specialchars( urldecode($_GET['name']), 1 ); ?>" style="width: 95%" /></td>
           </tr>
           <tr>

Index: link-manager.php
===================================================================
RCS file: /cvsroot/cafelog/wordpress/wp-admin/link-manager.php,v
retrieving revision 1.41
retrieving revision 1.42
diff -C2 -d -r1.41 -r1.42
*** link-manager.php	15 Nov 2004 20:52:34 -0000	1.41
--- link-manager.php	12 Dec 2004 20:41:14 -0000	1.42
***************
*** 33,37 ****
  		if ($row->cat_id == $selected)
  			echo " selected='selected'";
! 		echo ">$row->cat_id: ".htmlspecialchars($row->cat_name);
  		if ('Y' == $row->auto_toggle)
  			echo ' (auto toggle)';
--- 33,37 ----
  		if ($row->cat_id == $selected)
  			echo " selected='selected'";
! 		echo ">$row->cat_id: ".wp_specialchars($row->cat_name);
  		if ('Y' == $row->auto_toggle)
  			echo ' (auto toggle)';
***************
*** 161,168 ****
      check_admin_referer();
  
!     $link_url = $_POST['linkurl'];
      $link_url = preg_match('/^(https?|ftps?|mailto|news|gopher):/is', $link_url) ? $link_url : 'http://' . $link_url; 
!     $link_name = $_POST['name'];
!     $link_image = $_POST['image'];
      $link_target = $_POST['target'];
      $link_category = $_POST['category'];
--- 161,168 ----
      check_admin_referer();
  
!     $link_url = wp_specialchars($_POST['linkurl']);
      $link_url = preg_match('/^(https?|ftps?|mailto|news|gopher):/is', $link_url) ? $link_url : 'http://' . $link_url; 
!     $link_name = wp_specialchars($_POST['name']);
!     $link_image = wp_specialchars($_POST['image']);
      $link_target = $_POST['target'];
      $link_category = $_POST['category'];
***************
*** 172,176 ****
      $link_rel = $_POST['rel'];
      $link_notes = $_POST['notes'];
! 	$link_rss_uri =  $_POST['rss_uri'];
      $auto_toggle = get_autotoggle($link_category);
  
--- 172,176 ----
      $link_rel = $_POST['rel'];
      $link_notes = $_POST['notes'];
! 	$link_rss_uri =  wp_specialchars($_POST['rss_uri']);
      $auto_toggle = get_autotoggle($link_category);
  
***************
*** 208,217 ****
        check_admin_referer();
  
!       $link_id = $_POST['link_id'];
!       $link_url = $_POST['linkurl'];
        $link_url = preg_match('/^(https?|ftps?|mailto|news|gopher):/is', $link_url) ? $link_url : 'http://' . $link_url; 
!       $link_name = $_POST['name'];
!       $link_image = $_POST['image'];
!       $link_target = $_POST['target'];
        $link_category = $_POST['category'];
        $link_description = $_POST['description'];
--- 208,217 ----
        check_admin_referer();
  
!       $link_id = (int) $_POST['link_id'];
!       $link_url = wp_specialchars($_POST['linkurl']);
        $link_url = preg_match('/^(https?|ftps?|mailto|news|gopher):/is', $link_url) ? $link_url : 'http://' . $link_url; 
!       $link_name = wp_specialchars($_POST['name']);
!       $link_image = wp_specialchars($_POST['image']);
!       $link_target = wp_specialchars($_POST['target']);
        $link_category = $_POST['category'];
        $link_description = $_POST['description'];
***************
*** 271,299 ****
    } // end Delete
  
!   case 'linkedit':
!   {
  	$xfn = true;
      include_once ('admin-header.php');
!     if ($user_level < 5) {
        die(__('You do not have sufficient permissions to edit the links for this blog.'));
!     }
      $link_id = (int) $_GET['link_id'];
!     $row = $wpdb->get_row("SELECT * 
! 	FROM $wpdb->links 
! 	WHERE link_id = $link_id");
  
      if ($row) {
!       $link_url = htmlspecialchars($row->link_url);
!       $link_name = htmlspecialchars($row->link_name);
        $link_image = $row->link_image;
        $link_target = $row->link_target;
        $link_category = $row->link_category;
!       $link_description = htmlspecialchars($row->link_description);
        $link_visible = $row->link_visible;
        $link_rating = $row->link_rating;
        $link_rel = $row->link_rel;
!       $link_notes = htmlspecialchars($row->link_notes);
! 	  $link_rss_uri = htmlspecialchars($row->link_rss);
!     }
  
  ?>
--- 271,298 ----
    } // end Delete
  
!   case 'linkedit': {
  	$xfn = true;
      include_once ('admin-header.php');
!     if ($user_level < 5)
        die(__('You do not have sufficient permissions to edit the links for this blog.'));
! 
      $link_id = (int) $_GET['link_id'];
!     $row = $wpdb->get_row("SELECT * FROM $wpdb->links WHERE link_id = $link_id");
  
      if ($row) {
!       $link_url = wp_specialchars($row->link_url, 1);
!       $link_name = wp_specialchars($row->link_name, 1);
        $link_image = $row->link_image;
        $link_target = $row->link_target;
        $link_category = $row->link_category;
!       $link_description = wp_specialchars($row->link_description);
        $link_visible = $row->link_visible;
        $link_rating = $row->link_rating;
        $link_rel = $row->link_rel;
!       $link_notes = wp_specialchars($row->link_notes);
! 	  $link_rss_uri = wp_specialchars($row->link_rss);
!     } else {
! 		die( __('Link not found.') ); 
! 	}
  
  ?>
***************
*** 493,499 ****
  <p class="submit"><input type="submit" name="submit" value="<?php _e('Save Changes &raquo;') ?>" />
            <input type="hidden" name="action" value="editlink" />
!           <input type="hidden" name="link_id" value="<?php echo $link_id; ?>" />
!           <input type="hidden" name="order_by" value="<?php echo $order_by ?>" />
!           <input type="hidden" name="cat_id" value="<?php echo $cat_id ?>" /></p>
    </form> 
  </div>
--- 492,498 ----
  <p class="submit"><input type="submit" name="submit" value="<?php _e('Save Changes &raquo;') ?>" />
            <input type="hidden" name="action" value="editlink" />
!           <input type="hidden" name="link_id" value="<?php echo (int) $link_id; ?>" />
!           <input type="hidden" name="order_by" value="<?php echo wp_specialchars($order_by, 1); ?>" />
!           <input type="hidden" name="cat_id" value="<?php echo (int) $cat_id ?>" /></p>
    </form> 
  </div>
***************
*** 599,603 ****
        if ($row->cat_id == $cat_id)
          echo " selected='selected'";
!         echo ">".$row->cat_id.": ".htmlspecialchars($row->cat_name);
          if ($row->auto_toggle == 'Y')
              echo ' (auto toggle)';
--- 598,602 ----
        if ($row->cat_id == $cat_id)
          echo " selected='selected'";
!         echo ">".$row->cat_id.": ".wp_specialchars($row->cat_name);
          if ($row->auto_toggle == 'Y')
              echo ' (auto toggle)';
***************
*** 631,636 ****
      <input type="hidden" name="link_id" value="" />
      <input type="hidden" name="action" value="" />
!     <input type="hidden" name="order_by" value="<?php echo $order_by ?>" />
!     <input type="hidden" name="cat_id" value="<?php echo $cat_id ?>" />
    <table width="100%" cellpadding="3" cellspacing="3">
      <tr>
--- 630,635 ----
      <input type="hidden" name="link_id" value="" />
      <input type="hidden" name="action" value="" />
!     <input type="hidden" name="order_by" value="<?php echo wp_specialchars($order_by, 1); ?>" />
!     <input type="hidden" name="cat_id" value="<?php echo (int) $cat_id ?>" />
    <table width="100%" cellpadding="3" cellspacing="3">
      <tr>
***************
*** 661,668 ****
      if ($links) {
          foreach ($links as $link) {
!       	    $link->link_name = htmlspecialchars($link->link_name);
!       	    $link->link_category = htmlspecialchars($link->link_category);
!       	    $link->link_description = htmlspecialchars($link->link_description);
!             $link->link_url = htmlspecialchars($link->link_url);
              $short_url = str_replace('http://', '', $link->link_url);
              $short_url = str_replace('www.', '', $short_url);
--- 660,667 ----
      if ($links) {
          foreach ($links as $link) {
!       	    $link->link_name = wp_specialchars($link->link_name);
!       	    $link->link_category = wp_specialchars($link->link_category);
!       	    $link->link_description = wp_specialchars($link->link_description);
!             $link->link_url = wp_specialchars($link->link_url);
              $short_url = str_replace('http://', '', $link->link_url);
              $short_url = str_replace('www.', '', $short_url);
***************
*** 754,758 ****
  ?>
  
! 
! 
! <?php include('admin-footer.php'); ?>
--- 753,755 ----
  ?>
  
! <?php include('admin-footer.php'); ?>
\ No newline at end of file

Index: users.php
===================================================================
RCS file: /cvsroot/cafelog/wordpress/wp-admin/users.php,v
retrieving revision 1.41
retrieving revision 1.42
diff -C2 -d -r1.41 -r1.42
*** users.php	29 Nov 2004 19:46:20 -0000	1.41
--- users.php	12 Dec 2004 20:41:15 -0000	1.42
***************
*** 5,9 ****
  $parent_file = 'users.php';
  	
! $wpvarstoreset = array('action','standalone','redirect','profile');
  for ($i=0; $i<count($wpvarstoreset); $i += 1) {
  	$wpvar = $wpvarstoreset[$i];
--- 5,9 ----
  $parent_file = 'users.php';
  	
! $wpvarstoreset = array('action');
  for ($i=0; $i<count($wpvarstoreset); $i += 1) {
  	$wpvar = $wpvarstoreset[$i];
***************
*** 25,39 ****
  	check_admin_referer();
  
! 	function filter($value)	{
! 		return ereg('^[a-zA-Z0-9\_-\|]+$',$value);
! 	}
! 
! 	$user_login = $_POST['user_login'];
! 	$pass1 = $_POST['pass1'];
! 	$pass2 = $_POST['pass2'];
! 	$user_email = $_POST['email'];
! 	$user_firstname = $_POST['firstname'];
! 	$user_lastname = $_POST['lastname'];
! 	$user_uri = $_POST['uri'];
  		
  	/* checking login has been typed */
--- 25,35 ----
  	check_admin_referer();
  
! 	$user_login     = wp_specialchars($_POST['user_login']);
! 	$pass1          = $_POST['pass1'];
! 	$pass2          = $_POST['pass2'];
! 	$user_email     = wp_specialchars($_POST['email']);
! 	$user_firstname = wp_specialchars($_POST['firstname']);
! 	$user_lastname  = wp_specialchars($_POST['lastname']);
! 	$user_uri       = wp_specialchars($_POST['uri']);
  		
  	/* checking login has been typed */
***************
*** 131,135 ****
  	check_admin_referer();
  
! 	$id = intval($_GET['id']);
  
  	if (!$id) {
--- 127,131 ----
  	check_admin_referer();
  
! 	$id = (int) $_GET['id'];
  
  	if (!$id) {
***************
*** 229,234 ****
  
  <?php
! 	$users = $wpdb->get_results("SELECT * FROM $wpdb->users WHERE user_level = 0 ORDER BY ID");
! 	if ($users) {
  ?>
  <div class="wrap">
--- 225,230 ----
  
  <?php
! $users = $wpdb->get_results("SELECT * FROM $wpdb->users WHERE user_level = 0 ORDER BY ID");
! if ($users) {
  ?>
  <div class="wrap">
***************
*** 331,333 ****
  
  include('admin-footer.php');
! ?>
--- 327,329 ----
  
  include('admin-footer.php');
! ?>
\ No newline at end of file

Index: link-categories.php
===================================================================
RCS file: /cvsroot/cafelog/wordpress/wp-admin/link-categories.php,v
retrieving revision 1.17
retrieving revision 1.18
diff -C2 -d -r1.17 -r1.18
*** link-categories.php	19 Oct 2004 03:03:04 -0000	1.17
--- link-categories.php	12 Dec 2004 20:41:14 -0000	1.18
***************
*** 29,33 ****
            die (__("Cheatin' uh ?"));
  
!       $cat_name = addslashes($_POST['cat_name']);
        $auto_toggle = $_POST['auto_toggle'];
        if ($auto_toggle != 'Y') {
--- 29,33 ----
            die (__("Cheatin' uh ?"));
  
!       $cat_name = wp_specialchars($_POST['cat_name']);
        $auto_toggle = $_POST['auto_toggle'];
        if ($auto_toggle != 'Y') {
***************
*** 80,84 ****
    case 'Delete':
    {
!     $cat_id = $_GET['cat_id'];
      $cat_name=get_linkcatname($cat_id);
  
--- 80,84 ----
    case 'Delete':
    {
!     $cat_id = (int) $_GET['cat_id'];
      $cat_name=get_linkcatname($cat_id);
  
***************
*** 98,102 ****
    {
      include_once ('admin-header.php');
!     $cat_id = $_GET['cat_id'];
      $row = $wpdb->get_row("SELECT cat_id, cat_name, auto_toggle, show_images, show_description, "
           . " show_rating, show_updated, sort_order, sort_desc, text_before_link, text_after_link, "
--- 98,102 ----
    {
      include_once ('admin-header.php');
!     $cat_id = (int) $_GET['cat_id'];
      $row = $wpdb->get_row("SELECT cat_id, cat_name, auto_toggle, show_images, show_description, "
           . " show_rating, show_updated, sort_order, sort_desc, text_before_link, text_after_link, "
***************
*** 109,113 ****
  
  <div class="wrap">
!   <h2>Edit &#8220;<?php echo htmlspecialchars($row->cat_name)?>&#8221; Category </h2>
  
    <form name="editcat" method="post">
--- 109,113 ----
  
  <div class="wrap">
!   <h2>Edit &#8220;<?php echo wp_specialchars($row->cat_name)?>&#8221; Category </h2>
  
    <form name="editcat" method="post">
***************
*** 119,123 ****
  <tr>
  	<th width="33%" scope="row"><?php _e('Name:') ?></th>
! 	<td width="67%"><input name="cat_name" type="text" value="<?php echo htmlspecialchars($row->cat_name)?>" size="30" /></td>
  </tr>
  <tr>
--- 119,123 ----
  <tr>
  	<th width="33%" scope="row"><?php _e('Name:') ?></th>
! 	<td width="67%"><input name="cat_name" type="text" value="<?php echo wp_specialchars($row->cat_name)?>" size="30" /></td>
  </tr>
  <tr>
***************
*** 177,189 ****
  <tr>
  	<th width="33%" scope="row"><?php _e('Before Link:') ?></th>
! 	<td width="67%"><input type="text" name="text_before_link" size="45" value="<?php echo htmlspecialchars($row->text_before_link)?>" /></td>
  </tr>
  <tr>
  <th scope="row"><?php _e('Between Link and Description:') ?></th>
! <td><input type="text" name="text_after_link" size="45" value="<?php echo htmlspecialchars($row->text_after_link)?>" /></td>
  </tr>
  <tr>
  <th scope="row"><?php _e('After Link:') ?></th>
! <td><input type="text" name="text_after_all" size="45" value="<?php echo htmlspecialchars($row->text_after_all)?>"/></td>
  </tr>
  </table>
--- 177,189 ----
  <tr>
  	<th width="33%" scope="row"><?php _e('Before Link:') ?></th>
! 	<td width="67%"><input type="text" name="text_before_link" size="45" value="<?php echo wp_specialchars($row->text_before_link)?>" /></td>
  </tr>
  <tr>
  <th scope="row"><?php _e('Between Link and Description:') ?></th>
! <td><input type="text" name="text_after_link" size="45" value="<?php echo wp_specialchars($row->text_after_link)?>" /></td>
  </tr>
  <tr>
  <th scope="row"><?php _e('After Link:') ?></th>
! <td><input type="text" name="text_after_all" size="45" value="<?php echo wp_specialchars($row->text_after_all)?>"/></td>
  </tr>
  </table>
***************
*** 205,211 ****
      if (isset($submit)) {
  
!     $cat_id=$_POST["cat_id"];
  
!     $cat_name= $_POST["cat_name"];
      $auto_toggle = $_POST["auto_toggle"];
      if ($auto_toggle != 'Y') {
--- 205,211 ----
      if (isset($submit)) {
  
!     $cat_id = (int)$_POST["cat_id"];
  
!     $cat_name= wp_specialchars($_POST["cat_name"]);
      $auto_toggle = $_POST["auto_toggle"];
      if ($auto_toggle != 'Y') {
***************
*** 311,315 ****
  ?>
                <tr valign="middle" align="center" <?php echo $style ?> style="border-bottom: 1px dotted #9C9A9C;">
!                 <td><?php echo htmlspecialchars($row->cat_name)?></td>
  				<td ><?php echo $row->cat_id?></td>
                  <td><?php echo $row->auto_toggle?></td>
--- 311,315 ----
  ?>
                <tr valign="middle" align="center" <?php echo $style ?> style="border-bottom: 1px dotted #9C9A9C;">
!                 <td><?php echo wp_specialchars($row->cat_name)?></td>
  				<td ><?php echo $row->cat_id?></td>
                  <td><?php echo $row->auto_toggle?></td>

Index: theme-editor.php
===================================================================
RCS file: /cvsroot/cafelog/wordpress/wp-admin/theme-editor.php,v
retrieving revision 1.8
retrieving revision 1.9
diff -C2 -d -r1.8 -r1.9
*** theme-editor.php	25 Nov 2004 16:15:27 -0000	1.8
--- theme-editor.php	12 Dec 2004 20:41:15 -0000	1.9
***************
*** 74,78 ****
  		$f = fopen($real_file, 'r');
  		$content = fread($f, filesize($real_file));
! 		$content = htmlspecialchars($content);
  	}
  
--- 74,78 ----
  		$f = fopen($real_file, 'r');
  		$content = fread($f, filesize($real_file));
! 		$content = wp_specialchars($content);
  	}
  

Index: plugin-editor.php
===================================================================
RCS file: /cvsroot/cafelog/wordpress/wp-admin/plugin-editor.php,v
retrieving revision 1.3
retrieving revision 1.4
diff -C2 -d -r1.3 -r1.4
*** plugin-editor.php	28 Nov 2004 05:38:54 -0000	1.3
--- plugin-editor.php	12 Dec 2004 20:41:15 -0000	1.4
***************
*** 68,72 ****
  		$f = fopen($real_file, 'r');
  		$content = fread($f, filesize($real_file));
! 		$content = htmlspecialchars($content);
  	}
  
--- 68,72 ----
  		$f = fopen($real_file, 'r');
  		$content = fread($f, filesize($real_file));
! 		$content = wp_specialchars($content);
  	}
  

Index: sidebar.php
===================================================================
RCS file: /cvsroot/cafelog/wordpress/wp-admin/sidebar.php,v
retrieving revision 1.13
retrieving revision 1.14
diff -C2 -d -r1.13 -r1.14
*** sidebar.php	15 Jun 2004 23:24:35 -0000	1.13
--- sidebar.php	12 Dec 2004 20:41:15 -0000	1.14
***************
*** 31,35 ****
  <head>
  <title>WordPress &#8250; Sidebar</title>
! <meta http-equiv="Content-Type" content="text/html; charset=<?php echo $blog_charset ?>" />
  <link rel="stylesheet" href="wp-admin.css" type="text/css" />
  <link rel="shortcut icon" href="../wp-images/wp-favicon.png" />
--- 31,35 ----
  <head>
  <title>WordPress &#8250; Sidebar</title>
! <meta http-equiv="Content-Type" content="text/html; charset=<?php bloginfo('blog_charset'); ?>" />
  <link rel="stylesheet" href="wp-admin.css" type="text/css" />
  <link rel="shortcut icon" href="../wp-images/wp-favicon.png" />

Index: categories.php
===================================================================
RCS file: /cvsroot/cafelog/wordpress/wp-admin/categories.php,v
retrieving revision 1.44
retrieving revision 1.45
diff -C2 -d -r1.44 -r1.45
*** categories.php	9 Dec 2004 01:02:25 -0000	1.44
--- categories.php	12 Dec 2004 20:41:13 -0000	1.45
***************
*** 27,31 ****
  		die (__('Cheatin&#8217; uh?'));
  	
! 	$cat_name= $_POST['cat_name'];
  	$id_result = $wpdb->get_row("SHOW TABLE STATUS LIKE '$wpdb->categories'");
  	$cat_ID = $id_result->Auto_increment;
--- 27,31 ----
  		die (__('Cheatin&#8217; uh?'));
  	
! 	$cat_name= wp_specialchars($_POST['cat_name']);
  	$id_result = $wpdb->get_row("SHOW TABLE STATUS LIKE '$wpdb->categories'");
  	$cat_ID = $id_result->Auto_increment;
***************
*** 65,69 ****
  
      require_once ('admin-header.php');
!     $cat_ID = intval($_GET['cat_ID']);
      $category = $wpdb->get_row("SELECT * FROM $wpdb->categories WHERE cat_ID = '$cat_ID'");
      $cat_name = $category->cat_name;
--- 65,69 ----
  
      require_once ('admin-header.php');
!     $cat_ID = (int) $_GET['cat_ID'];
      $category = $wpdb->get_row("SELECT * FROM $wpdb->categories WHERE cat_ID = '$cat_ID'");
      $cat_name = $category->cat_name;
***************
*** 76,85 ****
  		<tr>
  		  <th width="33%" scope="row"><?php _e('Category name:') ?></th>
! 		  <td width="67%"><input name="cat_name" type="text" value="<?php echo htmlspecialchars($cat_name); ?>" size="40" /> <input type="hidden" name="action" value="editedcat" />
  <input type="hidden" name="cat_ID" value="<?php echo $cat_ID ?>" /></td>
  		</tr>
  		<tr>
  			<th scope="row"><?php _e('Category slug:') ?></th>
! 			<td><input name="category_nicename" type="text" value="<?php echo htmlspecialchars($category->category_nicename); ?>" size="40" /></td>
  		</tr>
  		<tr>
--- 76,85 ----
  		<tr>
  		  <th width="33%" scope="row"><?php _e('Category name:') ?></th>
! 		  <td width="67%"><input name="cat_name" type="text" value="<?php echo wp_specialchars($cat_name); ?>" size="40" /> <input type="hidden" name="action" value="editedcat" />
  <input type="hidden" name="cat_ID" value="<?php echo $cat_ID ?>" /></td>
  		</tr>
  		<tr>
  			<th scope="row"><?php _e('Category slug:') ?></th>
! 			<td><input name="category_nicename" type="text" value="<?php echo wp_specialchars($category->category_nicename); ?>" size="40" /></td>
  		</tr>
  		<tr>
***************
*** 93,97 ****
  		<tr>
  			<th scope="row"><?php _e('Description:') ?></th>
! 			<td><textarea name="category_description" rows="5" cols="50" style="width: 97%;"><?php echo htmlspecialchars($category->category_description, ENT_NOQUOTES); ?></textarea></td>
  		</tr>
  		</table>
--- 93,97 ----
  		<tr>
  			<th scope="row"><?php _e('Description:') ?></th>
! 			<td><textarea name="category_description" rows="5" cols="50" style="width: 97%;"><?php echo wp_specialchars($category->category_description, 1); ?></textarea></td>
  		</tr>
  		</table>
***************
*** 108,112 ****
  		die (__('Cheatin&#8217; uh?'));
  	
! 	$cat_name = $_POST['cat_name'];
  	$cat_ID = (int) $_POST['cat_ID'];
  	$category_nicename = sanitize_title($_POST['category_nicename'], $cat_ID);
--- 108,112 ----
  		die (__('Cheatin&#8217; uh?'));
  	
! 	$cat_name = wp_specialchars($_POST['cat_name']);
  	$cat_ID = (int) $_POST['cat_ID'];
  	$category_nicename = sanitize_title($_POST['category_nicename'], $cat_ID);

Index: templates.php
===================================================================
RCS file: /cvsroot/cafelog/wordpress/wp-admin/templates.php,v
retrieving revision 1.30
retrieving revision 1.31
diff -C2 -d -r1.30 -r1.31
*** templates.php	12 Dec 2004 06:31:01 -0000	1.30
--- templates.php	12 Dec 2004 20:41:15 -0000	1.31
***************
*** 64,68 ****
  		$f = fopen($real_file, 'r');
  		$content = fread($f, filesize($real_file));
! 		$content = htmlspecialchars($content);
  	}
  
--- 64,68 ----
  		$f = fopen($real_file, 'r');
  		$content = fread($f, filesize($real_file));
! 		$content = wp_specialchars($content);
  	}
  
***************
*** 74,80 ****
  <?php
  if (is_writeable($real_file)) {
! 	echo '<h2>' . sprintf(__('Editing <strong>%s</strong>'), $file) . '</h2>';
  } else {
! 	echo '<h2>' . sprintf(__('Browsing <strong>%s</strong>'), $file) . '</h2>';
  }
  ?>
--- 74,80 ----
  <?php
  if (is_writeable($real_file)) {
! 	echo '<h2>' . sprintf(__('Editing <strong>%s</strong>'), wp_specialchars($file) ) . '</h2>';
  } else {
! 	echo '<h2>' . sprintf(__('Browsing <strong>%s</strong>'), wp_specialchars($file) ) . '</h2>';
  }
  ?>

Index: options.php
===================================================================
RCS file: /cvsroot/cafelog/wordpress/wp-admin/options.php,v
retrieving revision 1.37
retrieving revision 1.38
diff -C2 -d -r1.37 -r1.38
*** options.php	7 Dec 2004 20:12:34 -0000	1.37
--- options.php	12 Dec 2004 20:41:14 -0000	1.38
***************
*** 49,53 ****
              if ($user_level >= $option->option_admin_level) {
                  $old_val = $option->option_value;
!                 $new_val = $_POST[$option->option_name];
                  if (!$new_val) {
                      if (3 == $option->option_type)
--- 49,53 ----
              if ($user_level >= $option->option_admin_level) {
                  $old_val = $option->option_value;
!                 $new_val = wp_specialchars($_POST[$option->option_name]);
                  if (!$new_val) {
                      if (3 == $option->option_type)
***************
*** 89,93 ****
  
  foreach ($options as $option) :
! 	$value = htmlspecialchars($option->option_value);
  	echo "
  <tr>
--- 89,93 ----
  
  foreach ($options as $option) :
! 	$value = wp_specialchars($option->option_value);
  	echo "
  <tr>

Index: admin-functions.php
===================================================================
RCS file: /cvsroot/cafelog/wordpress/wp-admin/admin-functions.php,v
retrieving revision 1.66
retrieving revision 1.67
diff -C2 -d -r1.66 -r1.67
*** admin-functions.php	12 Dec 2004 06:30:59 -0000	1.66
--- admin-functions.php	12 Dec 2004 20:41:13 -0000	1.67
***************
*** 91,95 ****
     echo '<label for="category-', $category['cat_ID'], '" class="selectit"><input value="', $category['cat_ID'],
       '" type="checkbox" name="post_category[]" id="category-', $category['cat_ID'], '"',
!      ($category['checked'] ? ' checked="checked"' : ""), '/> ', htmlspecialchars($category['cat_name']), "</label>\n";
  
     if(isset($category['children'])) {
--- 91,95 ----
     echo '<label for="category-', $category['cat_ID'], '" class="selectit"><input value="', $category['cat_ID'],
       '" type="checkbox" name="post_category[]" id="category-', $category['cat_ID'], '"',
!      ($category['checked'] ? ' checked="checked"' : ""), '/> ', wp_specialchars($category['cat_name']), "</label>\n";
  
     if(isset($category['children'])) {
***************
*** 114,118 ****
  		foreach ($categories as $category) {
  			if ($category->category_parent == $parent) {
! 				$category->cat_name = htmlspecialchars($category->cat_name);
  				$count = $wpdb->get_var("SELECT COUNT(post_id) FROM $wpdb->post2cat WHERE category_id = $category->cat_ID");
  				$pad = str_repeat('&#8212; ', $level);
--- 114,118 ----
  		foreach ($categories as $category) {
  			if ($category->category_parent == $parent) {
! 				$category->cat_name = wp_specialchars($category->cat_name);
  				$count = $wpdb->get_var("SELECT COUNT(post_id) FROM $wpdb->post2cat WHERE category_id = $category->cat_ID");
  				$pad = str_repeat('&#8212; ', $level);
***************
*** 145,149 ****
  			$count = $wpdb->get_var("SELECT COUNT(post_id) FROM $wpdb->post2cat WHERE category_id = $category->cat_ID");
  			$pad = str_repeat('&#8211; ', $level);
! 			$category->cat_name = htmlspecialchars($category->cat_name);
  			echo "\n\t<option value='$category->cat_ID'";
  			if ($currentparent == $category->cat_ID)
--- 145,149 ----
  			$count = $wpdb->get_var("SELECT COUNT(post_id) FROM $wpdb->post2cat WHERE category_id = $category->cat_ID");
  			$pad = str_repeat('&#8211; ', $level);
! 			$category->cat_name = wp_specialchars($category->cat_name);
  			echo "\n\t<option value='$category->cat_ID'";
  			if ($currentparent == $category->cat_ID)

Index: bookmarklet.php
===================================================================
RCS file: /cvsroot/cafelog/wordpress/wp-admin/bookmarklet.php,v
retrieving revision 1.16
retrieving revision 1.17
diff -C2 -d -r1.16 -r1.17
*** bookmarklet.php	29 Oct 2004 15:29:35 -0000	1.16
--- bookmarklet.php	12 Dec 2004 20:41:13 -0000	1.17
***************
*** 21,26 ****
  <?php
  } else {
!     $popuptitle = htmlspecialchars(stripslashes($popuptitle));
!     $text = htmlspecialchars(stripslashes(urldecode($text)));
      
      /* big funky fixes for browsers' javascript bugs */
--- 21,26 ----
  <?php
  } else {
!     $popuptitle = wp_specialchars(stripslashes($popuptitle));
!     $text = wp_specialchars(stripslashes(urldecode($text)));
      
      /* big funky fixes for browsers' javascript bugs */
***************
*** 41,45 ****
      }
      
!     $post_title = $_REQUEST['post_title'];
      if (!empty($post_title)) {
          $post_title =  stripslashes($post_title);
--- 41,45 ----
      }
      
!     $post_title = wp_specialchars($_REQUEST['post_title']);
      if (!empty($post_title)) {
          $post_title =  stripslashes($post_title);
***************
*** 47,62 ****
          $post_title = $popuptitle;
      }
! // I'm not sure why we're using $edited_post_title in the edit-form.php, but we are
! // and that is what is being included below. For this reason, I am just duplicating
! // the var instead of changing the assignment on the lines above. 
! // -- Alex King 2004-01-07
!     $edited_post_title = htmlspecialchars($post_title);
  
  // $post_pingback needs to be set in any file that includes edit-form.php
      $post_pingback = get_settings('default_pingback_flag');
      
!     $content = htmlspecialchars($_REQUEST['content']);
!     if (!empty($content)) {
!         $content =  stripslashes($content);
      } else {
          $content = '<a href="'.$popupurl.'">'.$popuptitle.'</a>'."\n$text";
--- 47,60 ----
          $post_title = $popuptitle;
      }
! 
!     $edited_post_title = wp_specialchars($post_title);
  
  // $post_pingback needs to be set in any file that includes edit-form.php
      $post_pingback = get_settings('default_pingback_flag');
      
!     $content  = wp_specialchars($_REQUEST['content']);
! 	$popupurl = wp_specialchars($_REQUEST['popupurl']);
!     if ( !empty($content) ) {
!         $content = wp_specialchars( stripslashes($_REQUEST['content']) );
      } else {
          $content = '<a href="'.$popupurl.'">'.$popuptitle.'</a>'."\n$text";
***************
*** 72,83 ****
  <link rel="stylesheet" href="wp-admin.css" type="text/css" />
  <link rel="shortcut icon" href="../wp-images/wp-favicon.png" />
- <script type="text/javascript">
- <!--
- function launchupload() {
- 	window.open ("upload.php", "wpupload", "width=380,height=360,location=0,menubar=0,resizable=1,scrollbars=yes,status=1,toolbar=0");
- }
  
- //-->
- </script>
  <style type="text/css">
  <!--
--- 70,74 ----

Index: edit-form-advanced.php
===================================================================
RCS file: /cvsroot/cafelog/wordpress/wp-admin/edit-form-advanced.php,v
retrieving revision 1.44
retrieving revision 1.45
diff -C2 -d -r1.44 -r1.45
*** edit-form-advanced.php	12 Dec 2004 06:01:45 -0000	1.44
--- edit-form-advanced.php	12 Dec 2004 20:41:14 -0000	1.45
***************
*** 129,133 ****
  }
  ?>
! 	<input name="referredby" type="hidden" id="referredby" value="<?php echo htmlspecialchars($_SERVER['HTTP_REFERER']); ?>" />
  </p>
  
--- 129,133 ----
  }
  ?>
! 	<input name="referredby" type="hidden" id="referredby" value="<?php echo wp_specialchars($_SERVER['HTTP_REFERER']); ?>" />
  </p>
  

Index: edit-comments.php
===================================================================
RCS file: /cvsroot/cafelog/wordpress/wp-admin/edit-comments.php,v
retrieving revision 1.40
retrieving revision 1.41
diff -C2 -d -r1.40 -r1.41
*** edit-comments.php	23 Nov 2004 15:09:24 -0000	1.40
--- edit-comments.php	12 Dec 2004 20:41:14 -0000	1.41
***************
*** 7,11 ****
  require_once('admin-header.php');
  if (empty($_GET['mode'])) $mode = 'view';
! else $mode = htmlspecialchars($_GET['mode']);
  ?>
  
--- 7,11 ----
  require_once('admin-header.php');
  if (empty($_GET['mode'])) $mode = 'view';
! else $mode = wp_specialchars($_GET['mode'], 1);
  ?>
  
***************
*** 30,34 ****
    <fieldset> 
    <legend><?php _e('Show Comments That Contain...') ?></legend> 
!   <input type="text" name="s" value="<?php if (isset($_GET['s'])) echo htmlspecialchars($_GET['s']); ?>" size="17" /> 
    <input type="submit" name="submit" value="<?php _e('Search') ?>"  />  
    <input type="hidden" name="mode" value="<?php echo $mode; ?>" />
--- 30,34 ----
    <fieldset> 
    <legend><?php _e('Show Comments That Contain...') ?></legend> 
!   <input type="text" name="s" value="<?php if (isset($_GET['s'])) echo wp_specialchars($_GET['s'], 1); ?>" size="17" /> 
    <input type="submit" name="submit" value="<?php _e('Search') ?>"  />  
    <input type="hidden" name="mode" value="<?php echo $mode; ?>" />

Index: profile.php
===================================================================
RCS file: /cvsroot/cafelog/wordpress/wp-admin/profile.php,v
retrieving revision 1.33
retrieving revision 1.34
diff -C2 -d -r1.33 -r1.34
*** profile.php	19 Nov 2004 07:23:37 -0000	1.33
--- profile.php	12 Dec 2004 20:41:15 -0000	1.34
***************
*** 2,9 ****
  require_once('admin.php');
  
! $title = "Profile";
  $parent_file = 'profile.php';
  
! $wpvarstoreset = array('action','redirect','profile','user');
  for ($i=0; $i<count($wpvarstoreset); $i += 1) {
  	$wpvar = $wpvarstoreset[$i];
--- 2,9 ----
  require_once('admin.php');
  
! $title = 'Profile';
  $parent_file = 'profile.php';
  
! $wpvarstoreset = array('action', 'profile', 'user');
  for ($i=0; $i<count($wpvarstoreset); $i += 1) {
  	$wpvar = $wpvarstoreset[$i];
***************
*** 67,82 ****
  	}
  
! 	$newuser_firstname = $_POST['newuser_firstname'];
! 	$newuser_lastname = $_POST['newuser_lastname'];
  	$newuser_nickname = $_POST['newuser_nickname'];
      $newuser_nicename = sanitize_title($newuser_nickname);
! 	$newuser_icq = $_POST['newuser_icq'];
! 	$newuser_aim = $_POST['newuser_aim'];
! 	$newuser_msn = $_POST['newuser_msn'];
! 	$newuser_yim = $_POST['newuser_yim'];
! 	$newuser_email = $_POST['newuser_email'];
! 	$newuser_url = $_POST['newuser_url'];
  	$newuser_url = preg_match('/^(https?|ftps?|mailto|news|gopher):/is', $newuser_url) ? $newuser_url : 'http://' . $newuser_url; 
! 	$newuser_idmode=$_POST['newuser_idmode'];
  	$user_description = $_POST['user_description'];
  
--- 67,82 ----
  	}
  
! 	$newuser_firstname = wp_specialchars($_POST['newuser_firstname']);
! 	$newuser_lastname = wp_specialchars($_POST['newuser_lastname']);
  	$newuser_nickname = $_POST['newuser_nickname'];
      $newuser_nicename = sanitize_title($newuser_nickname);
! 	$newuser_icq = wp_specialchars($_POST['newuser_icq']);
! 	$newuser_aim = wp_specialchars($_POST['newuser_aim']);
! 	$newuser_msn = wp_specialchars($_POST['newuser_msn']);
! 	$newuser_yim = wp_specialchars($_POST['newuser_yim']);
! 	$newuser_email = wp_specialchars($_POST['newuser_email']);
! 	$newuser_url = wp_specialchars($_POST['newuser_url')];
  	$newuser_url = preg_match('/^(https?|ftps?|mailto|news|gopher):/is', $newuser_url) ? $newuser_url : 'http://' . $newuser_url; 
! 	$newuser_idmode = wp_specialchars($_POST['newuser_idmode']);
  	$user_description = $_POST['user_description'];
  

Index: edit-page-form.php
===================================================================
RCS file: /cvsroot/cafelog/wordpress/wp-admin/edit-page-form.php,v
retrieving revision 1.14
retrieving revision 1.15
diff -C2 -d -r1.14 -r1.15
*** edit-page-form.php	9 Dec 2004 04:12:20 -0000	1.14
--- edit-page-form.php	12 Dec 2004 20:41:14 -0000	1.15
***************
*** 78,82 ****
  <p class="submit">
    <input name="savepage" type="submit" id="savepage" tabindex="6" value="<?php $post_ID ? _e('Edit Page') :_e('Create New Page') ?> &raquo;" /> 
!   <input name="referredby" type="hidden" id="referredby" value="<?php if (isset($_SERVER['HTTP_REFERER'])) echo htmlspecialchars($_SERVER['HTTP_REFERER']); ?>" />
  </p>
  
--- 78,82 ----
  <p class="submit">
    <input name="savepage" type="submit" id="savepage" tabindex="6" value="<?php $post_ID ? _e('Edit Page') :_e('Create New Page') ?> &raquo;" /> 
!   <input name="referredby" type="hidden" id="referredby" value="<?php if (isset($_SERVER['HTTP_REFERER'])) echo wp_specialchars($_SERVER['HTTP_REFERER']); ?>" />
  </p>
  

Index: post.php
===================================================================
RCS file: /cvsroot/cafelog/wordpress/wp-admin/post.php,v
retrieving revision 1.112
retrieving revision 1.113
diff -C2 -d -r1.112 -r1.113
*** post.php	8 Dec 2004 00:23:02 -0000	1.112
--- post.php	12 Dec 2004 20:41:15 -0000	1.113
***************
*** 657,661 ****
  		$default_post_cat = get_settings('default_category');
  
! 		$content = htmlspecialchars($content);
  		$content = apply_filters('default_content', $content);
  		$edited_post_title = apply_filters('default_title', $edited_post_title);
--- 657,661 ----
  		$default_post_cat = get_settings('default_category');
  
! 		$content = wp_specialchars($content);
  		$content = apply_filters('default_content', $content);
  		$edited_post_title = apply_filters('default_title', $edited_post_title);
***************
*** 678,682 ****
  if ($is_NS4 || $is_gecko) {
  ?>
! <a href="javascript:if(navigator.userAgent.indexOf('Safari') >= 0){Q=getSelection();}else{Q=document.selection?document.selection.createRange().text:document.getSelection();}void(window.open('<?php echo get_settings('siteurl') ?>/wp-admin/bookmarklet.php?text='+encodeURIComponent(Q)+'&amp;popupurl='+encodeURIComponent(location.href)+'&amp;popuptitle='+encodeURIComponent(document.title),'<?php _e('WordPress bookmarklet') ?>','scrollbars=yes,width=600,height=460,left=100,top=150,status=yes'));"><?php printf(__('Press It - %s'), htmlspecialchars(get_settings('blogname'))); ?></a> 
  <?php
  } else if ($is_winIE) {
--- 678,682 ----
  if ($is_NS4 || $is_gecko) {
  ?>
! <a href="javascript:if(navigator.userAgent.indexOf('Safari') >= 0){Q=getSelection();}else{Q=document.selection?document.selection.createRange().text:document.getSelection();}void(window.open('<?php echo get_settings('siteurl') ?>/wp-admin/bookmarklet.php?text='+encodeURIComponent(Q)+'&amp;popupurl='+encodeURIComponent(location.href)+'&amp;popuptitle='+encodeURIComponent(document.title),'<?php _e('WordPress bookmarklet') ?>','scrollbars=yes,width=600,height=460,left=100,top=150,status=yes'));"><?php printf(__('Press It - %s'), wp_specialchars(get_settings('blogname'))); ?></a> 
  <?php
  } else if ($is_winIE) {

Index: user-edit.php
===================================================================
RCS file: /cvsroot/cafelog/wordpress/wp-admin/user-edit.php,v
retrieving revision 1.7
retrieving revision 1.8
diff -C2 -d -r1.7 -r1.8
*** user-edit.php	8 Dec 2004 22:32:49 -0000	1.7
--- user-edit.php	12 Dec 2004 20:41:15 -0000	1.8
***************
*** 46,62 ****
  }
  
! $new_user_login  = $_POST['new_user_login'];
! $new_firstname   = $_POST['new_firstname'];
! $new_lastname    = $_POST['new_lastname'];
  $new_nickname    = $_POST['new_nickname'];
  $new_nicename    = sanitize_title($new_nickname, $user_id);
! $new_icq         = $_POST['new_icq'];
! $new_aim         = $_POST['new_aim'];
! $new_msn         = $_POST['new_msn'];
! $new_yim         = $_POST['new_yim'];
! $new_email       = $_POST['new_email'];
! $new_url         = $_POST['new_url'];
  $new_url         = preg_match('/^(https?|ftps?|mailto|news|gopher):/is', $new_url) ? $new_url : 'http://' . $new_url; 
! $new_idmode      = $_POST['new_idmode'];
  $new_description = $_POST['new_description'];
  
--- 46,62 ----
  }
  
! $new_user_login  = wp_specialchars($_POST['new_user_login']);
! $new_firstname   = wp_specialchars($_POST['new_firstname']);
! $new_lastname    = wp_specialchars($_POST['new_lastname']);
  $new_nickname    = $_POST['new_nickname'];
  $new_nicename    = sanitize_title($new_nickname, $user_id);
! $new_icq         = wp_specialchars($_POST['new_icq']);
! $new_aim         = wp_specialchars($_POST['new_aim']);
! $new_msn         = wp_specialchars($_POST['new_msn']);
! $new_yim         = wp_specialchars($_POST['new_yim']);
! $new_email       = wp_specialchars($_POST['new_email']);
! $new_url         = wp_specialchars($_POST['new_url']);
  $new_url         = preg_match('/^(https?|ftps?|mailto|news|gopher):/is', $new_url) ? $new_url : 'http://' . $new_url; 
! $new_idmode      = wp_specialchars($_POST['new_idmode']);
  $new_description = $_POST['new_description'];
  
***************
*** 196,201 ****
  break;
  }
! 	
! /* </Team> */
  include('admin-footer.php');
! ?>
--- 196,200 ----
  break;
  }
! 
  include('admin-footer.php');
! ?>
\ No newline at end of file

Index: edit.php
===================================================================
RCS file: /cvsroot/cafelog/wordpress/wp-admin/edit.php,v
retrieving revision 1.37
retrieving revision 1.38
diff -C2 -d -r1.37 -r1.38
*** edit.php	27 Nov 2004 00:51:43 -0000	1.37
--- edit.php	12 Dec 2004 20:41:14 -0000	1.38
***************
*** 6,9 ****
--- 6,11 ----
  require_once('admin-header.php');
  
+ $_GET['m'] = (int) $_GET['m'];
+ 
  get_currentuserinfo();
  
***************
*** 66,70 ****
  	echo $month[substr( $_GET['m'], 4, 2 )] . ' ' . substr( $_GET['m'], 0, 4 );
  } elseif ( isset( $_GET['s'] ) ) {
! 	printf(__('Search for &#8220;%s&#8221;'), htmlspecialchars($_GET['s']) );
  } else {
  	_e('Last 15 Posts');
--- 68,72 ----
  	echo $month[substr( $_GET['m'], 4, 2 )] . ' ' . substr( $_GET['m'], 0, 4 );
  } elseif ( isset( $_GET['s'] ) ) {
! 	printf(__('Search for &#8220;%s&#8221;'), wp_specialchars($_GET['s']) );
  } else {
  	_e('Last 15 Posts');
***************
*** 91,95 ****
  			$arc_month = $arc_row->mmonth;
  			
! 			if( isset($_GET['m']) && $arc_year . zeroise($arc_month, 2) == $_GET['m'] )
  				$default = 'selected="selected"';
  			else
--- 93,97 ----
  			$arc_month = $arc_row->mmonth;
  			
! 			if( isset($_GET['m']) && $arc_year . zeroise($arc_month, 2) == (int) $_GET['m'] )
  				$default = 'selected="selected"';
  			else
***************
*** 122,126 ****
  <?php
  $what_to_show = 'posts';
! if ( empty($_GET['m']) && empty($_GET['s']) ) {
    $showposts = 15;
  } else {
--- 124,128 ----
  <?php
  $what_to_show = 'posts';
! if ( empty($_GET['m']) || 0 == $_GET['m'] && empty($_GET['s']) ) {
    $showposts = 15;
  } else {




More information about the cvs mailing list