- +
WordPress database error: [$str]
- $this->last_query
$query
" . __('Are you sure you want to do this?') . "
\n\t\t\n"; - } - $html .= "\n"; - - die($html); + wp_nonce_ays($action); + die(); } - do_action('check_admin_referer'); -}endif; + do_action('check_admin_referer', $action); +} +endif; if ( !function_exists('check_ajax_referer') ) : function check_ajax_referer() { $cookie = explode('; ', urldecode(empty($_POST['cookie']) ? $_GET['cookie'] : $_POST['cookie'])); // AJAX scripts must pass cookie=document.cookie foreach ( $cookie as $tasty ) { if ( false !== strpos($tasty, USER_COOKIE) ) - $user = substr(strstr($tasty, '='), 1); + $user = urldecode(substr(strstr($tasty, '='), 1)); // Nasty double encoding if ( false !== strpos($tasty, PASS_COOKIE) ) - $pass = substr(strstr($tasty, '='), 1); + $pass = urldecode(substr(strstr($tasty, '='), 1)); } if ( wp_login( $user, $pass, true ) ) return true; @@ -280,8 +261,11 @@ function wp_redirect($location) { global $is_IIS; - $location = str_replace( array("\n", "\r"), '', $location); + $location = preg_replace('|[^a-z0-9-~+_.?#=&;,/:%]|i', '', $location); + $strip = array('%0d', '%0a'); + $location = str_replace($strip, '', $location); + if ($is_IIS) header("Refresh: 0;url=$location"); else Index: wp-includes/comment-functions.php =================================================================== --- wp-includes/comment-functions.php (.../2.0.3) (revision 4068) +++ wp-includes/comment-functions.php (.../2.0.4) (revision 4068) @@ -5,27 +5,14 @@ function comments_template( $file = '/comments.php' ) { global $wp_query, $withcomments, $post, $wpdb, $id, $comment, $user_login, $user_ID, $user_identity; - if ( is_single() || is_page() || $withcomments ) : - $req = get_settings('require_name_email'); - $comment_author = ''; - if ( isset($_COOKIE['comment_author_'.COOKIEHASH]) ) { - $comment_author = apply_filters('pre_comment_author_name', $_COOKIE['comment_author_'.COOKIEHASH]); - $comment_author = stripslashes($comment_author); - $comment_author = wp_specialchars($comment_author, true); - } - $comment_author_email = ''; - if ( isset($_COOKIE['comment_author_email_'.COOKIEHASH]) ) { - $comment_author_email = apply_filters('pre_comment_author_email', $_COOKIE['comment_author_email_'.COOKIEHASH]); - $comment_author_email = stripslashes($comment_author_email); - $comment_author_email = wp_specialchars($comment_author_email, true); - } - $comment_author_url = ''; - if ( isset($_COOKIE['comment_author_url_'.COOKIEHASH]) ) { - $comment_author_url = apply_filters('pre_comment_author_url', $_COOKIE['comment_author_url_'.COOKIEHASH]); - $comment_author_url = stripslashes($comment_author_url); - $comment_author_url = wp_specialchars($comment_author_url, true); - } + if ( ! (is_single() || is_page() || $withcomments) ) + return; + $req = get_settings('require_name_email'); + $commenter = wp_get_current_commenter(); + extract($commenter); + + // TODO: Use API instead of SELECTs. if ( empty($comment_author) ) { $comments = $wpdb->get_results("SELECT * FROM $wpdb->comments WHERE comment_post_ID = '$post->ID' AND comment_approved = '1' ORDER BY comment_date"); } else { @@ -40,8 +27,6 @@ require( $include ); else require( ABSPATH . 'wp-content/themes/default/comments.php'); - - endif; } function wp_new_comment( $commentdata ) { @@ -221,8 +206,10 @@ return false; $post_id = $comment->comment_post_ID; - if ( $post_id && $comment->comment_approved == 1 ) - $wpdb->query( "UPDATE $wpdb->posts SET comment_count = comment_count - 1 WHERE ID = '$post_id'" ); + if ( $post_id && $comment->comment_approved == 1 ) { + $count = $wpdb->get_var("SELECT COUNT(*) FROM $wpdb->comments WHERE comment_post_ID = '$post_id' AND comment_approved = '1'"); + $wpdb->query( "UPDATE $wpdb->posts SET comment_count = $count WHERE ID = '$post_id'" ); + } do_action('wp_set_comment_status', $comment_id, 'delete'); return true; @@ -328,7 +315,8 @@ if (!empty($CSSclass)) { echo ' class="'.$CSSclass.'"'; } - echo ' title="' . sprintf( __('Comment on %s'), $post->post_title ) .'">'; + $title = wp_specialchars(apply_filters('the_title', get_the_title()), true); + echo ' title="' . sprintf( __('Comment on %s'), $title ) .'">'; comments_number($zero, $one, $more, $number); echo ''; } @@ -905,4 +893,45 @@ return $wpdb->get_results("SELECT * FROM $wpdb->comments WHERE comment_post_ID = $post_id AND comment_approved = '1' ORDER BY comment_date"); } +function sanitize_comment_cookies() { + if ( isset($_COOKIE['comment_author_'.COOKIEHASH]) ) { + $comment_author = apply_filters('pre_comment_author_name', $_COOKIE['comment_author_'.COOKIEHASH]); + $comment_author = stripslashes($comment_author); + $comment_author = wp_specialchars($comment_author, true); + $_COOKIE['comment_author_'.COOKIEHASH] = $comment_author; + } + + if ( isset($_COOKIE['comment_author_email_'.COOKIEHASH]) ) { + $comment_author_email = apply_filters('pre_comment_author_email', $_COOKIE['comment_author_email_'.COOKIEHASH]); + $comment_author_email = stripslashes($comment_author_email); + $comment_author_email = wp_specialchars($comment_author_email, true); + $_COOKIE['comment_author_email_'.COOKIEHASH] = $comment_author_email; + } + + if ( isset($_COOKIE['comment_author_url_'.COOKIEHASH]) ) { + $comment_author_url = apply_filters('pre_comment_author_url', $_COOKIE['comment_author_url_'.COOKIEHASH]); + $comment_author_url = stripslashes($comment_author_url); + $comment_author_url = wp_specialchars($comment_author_url, true); + $_COOKIE['comment_author_url_'.COOKIEHASH] = $comment_author_url; + } +} + +function wp_get_current_commenter() { + // Cookies should already be sanitized. + + $comment_author = ''; + if ( isset($_COOKIE['comment_author_'.COOKIEHASH]) ) + $comment_author = $_COOKIE['comment_author_'.COOKIEHASH]; + + $comment_author_email = ''; + if ( isset($_COOKIE['comment_author_email_'.COOKIEHASH]) ) + $comment_author_email = $_COOKIE['comment_author_email_'.COOKIEHASH]; + + $comment_author_url = ''; + if ( isset($_COOKIE['comment_author_url_'.COOKIEHASH]) ) + $comment_author_url = $_COOKIE['comment_author_url_'.COOKIEHASH]; + + return compact('comment_author', 'comment_author_email', 'comment_author_url'); +} + ?> Index: wp-includes/functions.php =================================================================== --- wp-includes/functions.php (.../2.0.3) (revision 4068) +++ wp-includes/functions.php (.../2.0.4) (revision 4068) @@ -32,10 +32,10 @@ $dateweekday = $weekday[date('w', $i)]; $dateweekday_abbrev = $weekday_abbrev[$dateweekday]; $dateformatstring = ' '.$dateformatstring; - $dateformatstring = preg_replace("/([^\\\])D/", "\${1}".backslashit($dateweekday_abbrev), $dateformatstring); - $dateformatstring = preg_replace("/([^\\\])F/", "\${1}".backslashit($datemonth), $dateformatstring); - $dateformatstring = preg_replace("/([^\\\])l/", "\${1}".backslashit($dateweekday), $dateformatstring); - $dateformatstring = preg_replace("/([^\\\])M/", "\${1}".backslashit($datemonth_abbrev), $dateformatstring); + $dateformatstring = preg_replace("/([^\\\])D/", "\\1".backslashit($dateweekday_abbrev), $dateformatstring); + $dateformatstring = preg_replace("/([^\\\])F/", "\\1".backslashit($datemonth), $dateformatstring); + $dateformatstring = preg_replace("/([^\\\])l/", "\\1".backslashit($dateweekday), $dateformatstring); + $dateformatstring = preg_replace("/([^\\\])M/", "\\1".backslashit($datemonth_abbrev), $dateformatstring); $dateformatstring = substr($dateformatstring, 1, strlen($dateformatstring)-1); } @@ -71,10 +71,10 @@ $dateweekday = $weekday[date('w', $i)]; $dateweekday_abbrev = $weekday_abbrev[$dateweekday]; $dateformatstring = ' '.$dateformatstring; - $dateformatstring = preg_replace("/([^\\\])D/", "\${1}".backslashit($dateweekday_abbrev), $dateformatstring); - $dateformatstring = preg_replace("/([^\\\])F/", "\${1}".backslashit($datemonth), $dateformatstring); - $dateformatstring = preg_replace("/([^\\\])l/", "\${1}".backslashit($dateweekday), $dateformatstring); - $dateformatstring = preg_replace("/([^\\\])M/", "\${1}".backslashit($datemonth_abbrev), $dateformatstring); + $dateformatstring = preg_replace("/([^\\\])D/", "\\1".backslashit($dateweekday_abbrev), $dateformatstring); + $dateformatstring = preg_replace("/([^\\\])F/", "\\1".backslashit($datemonth), $dateformatstring); + $dateformatstring = preg_replace("/([^\\\])l/", "\\1".backslashit($dateweekday), $dateformatstring); + $dateformatstring = preg_replace("/([^\\\])M/", "\\1".backslashit($datemonth_abbrev), $dateformatstring); $dateformatstring = substr($dateformatstring, 1, strlen($dateformatstring)-1); } $j = @date($dateformatstring, $i); @@ -748,6 +748,8 @@ } } + $_category = apply_filters('get_category', $_category); + if ( !isset($_category->fullpath) ) { $_category = set_category_path($_category); wp_cache_replace($_category->cat_ID, $_category, 'category'); @@ -994,7 +996,7 @@ } function spawn_pinger() { - global $wpdb; + global $wpdb, $wp_version; $doping = false; if ( $wpdb->get_var("SELECT ID FROM $wpdb->posts WHERE TRIM(to_ping) != '' LIMIT 1") ) $doping = true; @@ -1010,7 +1012,7 @@ $parts = parse_url($ping_url); $argyle = @ fsockopen($parts['host'], $_SERVER['SERVER_PORT'], $errno, $errstr, 0.01); if ( $argyle ) - fputs($argyle, "GET {$parts['path']}?time=".time()." HTTP/1.0\r\nHost: {$_SERVER['HTTP_HOST']}\r\n\r\n"); + fputs($argyle, "GET {$parts['path']}?time=".time()." HTTP/1.0\r\nHost: {$_SERVER['HTTP_HOST']}\r\nUser-Agent: WordPress/{$wp_version}\r\n\r\n"); } } @@ -1252,6 +1254,7 @@ // rebuild the list of filters if ( isset($wp_filter[$tag]["$priority"]) ) { + $new_function_list = array(); foreach($wp_filter[$tag]["$priority"] as $filter) { if ( $filter['function'] != $function_to_remove ) { $new_function_list[] = $filter; @@ -1738,24 +1741,24 @@ preg_match("|Author URI:(.*)|i", $theme_data, $author_uri); preg_match("|Template:(.*)|i", $theme_data, $template); if ( preg_match("|Version:(.*)|i", $theme_data, $version) ) - $version = $version[1]; + $version = trim($version[1]); else $version =''; if ( preg_match("|Status:(.*)|i", $theme_data, $status) ) - $status = $status[1]; + $status = trim($status[1]); else - $status ='publish'; + $status = 'publish'; - $description = wptexturize($description[1]); + $description = wptexturize(trim($description[1])); $name = $theme_name[1]; $name = trim($name); $theme = $name; if ( '' == $author_uri[1] ) { - $author = $author_name[1]; + $author = trim($author_name[1]); } else { - $author = '' . $author_name[1] . ''; + $author = '' . trim($author_name[1]) . ''; } return array('Name' => $name, 'Title' => $theme, 'Description' => $description, 'Author' => $author, 'Version' => $version, 'Template' => $template[1], 'Status' => $status); @@ -2082,6 +2085,13 @@ $uri = @func_get_arg(2); } + if ( preg_match('|^https?://|i', $uri, $matches) ) { + $protocol = $matches[0]; + $uri = substr($uri, strlen($protocol)); + } else { + $protocol = ''; + } + if ( strstr($uri, '?') ) { $parts = explode('?', $uri, 2); if ( 1 == count($parts) ) { @@ -2091,8 +2101,7 @@ $base = $parts[0] . '?'; $query = $parts[1]; } - } - else if ( strstr($uri, '/') ) { + } else if ( !empty($protocol) || strstr($uri, '/') ) { $base = $uri . '?'; $query = ''; } else { @@ -2115,7 +2124,7 @@ $ret .= "$k=$v"; } } - $ret = $base . $ret; + $ret = $protocol . $base . $ret; return trim($ret, '?'); } @@ -2309,11 +2318,189 @@ } function wp_nonce_url($actionurl, $action = -1) { - return add_query_arg('_wpnonce', wp_create_nonce($action), $actionurl); + return wp_specialchars(add_query_arg('_wpnonce', wp_create_nonce($action), $actionurl)); } function wp_nonce_field($action = -1) { echo ''; + wp_referer_field(); } +function wp_referer_field() { + $ref = wp_specialchars($_SERVER['REQUEST_URI']); + echo ''; + if ( wp_get_original_referer() ) { + $original_ref = wp_specialchars(stripslashes(wp_get_original_referer())); + echo ''; + } +} + +function wp_original_referer_field() { + echo ''; +} + +function wp_get_referer() { + foreach ( array($_REQUEST['_wp_http_referer'], $_SERVER['HTTP_REFERER']) as $ref ) + if ( !empty($ref) ) + return $ref; + return false; +} + +function wp_get_original_referer() { + if ( !empty($_REQUEST['_wp_original_http_referer']) ) + return $_REQUEST['_wp_original_http_referer']; + return false; +} + +function wp_explain_nonce($action) { + if ( $action !== -1 && preg_match('/([a-z]+)-([a-z]+)(_(.+))?/', $action, $matches) ) { + $verb = $matches[1]; + $noun = $matches[2]; + + $trans = array(); + $trans['update']['attachment'] = array(__('Are you sure you want to edit this attachment: "%s"?'), 'get_the_title'); + + $trans['add']['category'] = array(__('Are you sure you want to add this category?'), false); + $trans['delete']['category'] = array(__('Are you sure you want to delete this category: "%s"?'), 'get_catname'); + $trans['update']['category'] = array(__('Are you sure you want to edit this category: "%s"?'), 'get_catname'); + + $trans['delete']['comment'] = array(__('Are you sure you want to delete this comment: "%s"?'), 'use_id'); + $trans['unapprove']['comment'] = array(__('Are you sure you want to unapprove this comment: "%s"?'), 'use_id'); + $trans['approve']['comment'] = array(__('Are you sure you want to approve this comment: "%s"?'), 'use_id'); + $trans['update']['comment'] = array(__('Are you sure you want to edit this comment: "%s"?'), 'use_id'); + $trans['bulk']['comments'] = array(__('Are you sure you want to bulk modify comments?'), false); + $trans['moderate']['comments'] = array(__('Are you sure you want to moderate comments?'), false); + + $trans['add']['bookmark'] = array(__('Are you sure you want to add this bookmark?'), false); + $trans['delete']['bookmark'] = array(__('Are you sure you want to delete this bookmark: "%s"?'), 'use_id'); + $trans['update']['bookmark'] = array(__('Are you sure you want to edit this bookmark: "%s"?'), 'use_id'); + $trans['bulk']['bookmarks'] = array(__('Are you sure you want to bulk modify bookmarks?'), false); + + $trans['add']['page'] = array(__('Are you sure you want to add this page?'), false); + $trans['delete']['page'] = array(__('Are you sure you want to delete this page: "%s"?'), 'get_the_title'); + $trans['update']['page'] = array(__('Are you sure you want to edit this page: "%s"?'), 'get_the_title'); + + $trans['edit']['plugin'] = array(__('Are you sure you want to edit this plugin file: "%s"?'), 'use_id'); + $trans['activate']['plugin'] = array(__('Are you sure you want to activate this plugin: "%s"?'), 'use_id'); + $trans['deactivate']['plugin'] = array(__('Are you sure you want to deactivate this plugin: "%s"?'), 'use_id'); + + $trans['add']['post'] = array(__('Are you sure you want to add this post?'), false); + $trans['delete']['post'] = array(__('Are you sure you want to delete this post: "%s"?'), 'get_the_title'); + $trans['update']['post'] = array(__('Are you sure you want to edit this post: "%s"?'), 'get_the_title'); + + $trans['add']['user'] = array(__('Are you sure you want to add this user?'), false); + $trans['delete']['users'] = array(__('Are you sure you want to delete users?'), false); + $trans['bulk']['users'] = array(__('Are you sure you want to bulk modify users?'), false); + $trans['update']['user'] = array(__('Are you sure you want to edit this user: "%s"?'), 'get_author_name'); + $trans['update']['profile'] = array(__('Are you sure you want to modify the profile for: "%s"?'), 'get_author_name'); + + $trans['update']['options'] = array(__('Are you sure you want to edit your settings?'), false); + $trans['update']['permalink'] = array(__('Are you sure you want to change your permalink structure to: %s?'), 'use_id'); + $trans['edit']['file'] = array(__('Are you sure you want to edit this file: "%s"?'), 'use_id'); + $trans['edit']['theme'] = array(__('Are you sure you want to edit this theme file: "%s"?'), 'use_id'); + $trans['switch']['theme'] = array(__('Are you sure you want to switch to this theme: "%s"?'), 'use_id'); + + if ( isset($trans[$verb][$noun]) ) { + if ( !empty($trans[$verb][$noun][1]) ) { + $lookup = $trans[$verb][$noun][1]; + $object = $matches[4]; + if ( 'use_id' != $lookup ) + $object = call_user_func($lookup, $object); + return sprintf($trans[$verb][$noun][0], $object); + } else { + return $trans[$verb][$noun][0]; + } + } + } + + return __('Are you sure you want to do this'); +} + +function wp_nonce_ays($action) { + global $pagenow, $menu, $submenu, $parent_file, $submenu_file; + + $adminurl = get_settings('siteurl') . '/wp-admin'; + if ( wp_get_referer() ) + $adminurl = wp_get_referer(); + + $title = __('WordPress Confirmation'); + // Remove extra layer of slashes. + $_POST = stripslashes_deep($_POST ); + if ( $_POST ) { + $q = http_build_query($_POST); + $q = explode( ini_get('arg_separator.output'), $q); + $html .= "\t\n"; + } else { + $html .= "\t" . wp_explain_nonce($action) . "
\n\t\n\t