Changeset 4950 for trunk/includes/admin/replies.php

Timestamp:

05/27/2013 06:16:35 AM (13 years ago)

Author:

johnjamesjacoby

Message:

In admin, escape output of translated text where appropriate. Also review and refresh existing escaping approaches. See #1999.

File:

• trunk/includes/admin/replies.php (modified) (10 diffs)

trunk/includes/admin/replies.php

@@ -526 +526 @@
                                 return;
 
-                        $reply_title = esc_html( bbp_get_reply_title( $reply->ID ) );
+                        $reply_title = bbp_get_reply_title( $reply->ID );
 
                         switch ( $notice ) {
@@ -544 +544 @@
 
                         <div id="message" class="<?php echo $is_failure == true ? 'error' : 'updated'; ?> fade">
-                                <p style="line-height: 150%"><?php echo $message; ?></p>
+                                <p style="line-height: 150%"><?php echo esc_html( $message ); ?></p>
                         </div>
 
@@ -624 +624 @@
                                         $topic_title = bbp_get_topic_title( $topic_id );
                                         if ( empty( $topic_title ) ) {
-                                                $topic_title = __( 'No Topic', 'bbpress' );
+                                                $topic_title = esc_html__( 'No Topic', 'bbpress' );
                                         }
 
@@ -632 +632 @@
                                 // Reply has no topic
                                 } else {
-                                        _e( 'No Topic', 'bbpress' );
+                                        esc_html_e( 'No Topic', 'bbpress' );
                                 }
 
@@ -650 +650 @@
                                         $forum_title = bbp_get_forum_title( $reply_forum_id );
                                         if ( empty( $forum_title ) ) {
-                                                $forum_title = __( 'No Forum', 'bbpress' );
+                                                $forum_title = esc_html__( 'No Forum', 'bbpress' );
                                         }
 
@@ -656 +656 @@
                                         if ( $reply_forum_id != $topic_forum_id ) {
                                                 if ( current_user_can( 'edit_others_replies' ) || current_user_can( 'moderate' ) ) {
-                                                        $forum_title .= '<div class="attention">' . __( '(Mismatch)', 'bbpress' ) . '</div>';
+                                                        $forum_title .= '<div class="attention">' . esc_html__( '(Mismatch)', 'bbpress' ) . '</div>';
                                                 }
                                         }
@@ -679 +679 @@
 
                                 // Output last activity time and date
-                                printf( __( '%1$s <br /> %2$s', 'bbpress' ),
+                                printf( '%1$s <br /> %2$s',
                                         get_the_date(),
                                         esc_attr( get_the_time() )
@@ -724 +724 @@
 
                 // Reply view links to topic
-                $actions['view'] = '<a href="' . bbp_get_reply_url( $reply->ID ) . '" title="' . esc_attr( sprintf( __( 'View &#8220;%s&#8221;', 'bbpress' ), bbp_get_reply_title( $reply->ID ) ) ) . '" rel="permalink">' . __( 'View', 'bbpress' ) . '</a>';
+                $actions['view'] = '<a href="' . bbp_get_reply_url( $reply->ID ) . '" title="' . esc_attr( sprintf( __( 'View &#8220;%s&#8221;', 'bbpress' ), bbp_get_reply_title( $reply->ID ) ) ) . '" rel="permalink">' . esc_html__( 'View', 'bbpress' ) . '</a>';
 
                 // User cannot view replies in trash
@@ -733 +733 @@
                 if ( current_user_can( 'moderate', $reply->ID ) ) {
                         if ( in_array( $reply->post_status, array( bbp_get_public_status_id(), bbp_get_spam_status_id() ) ) ) {
-                                $spam_uri  = esc_url( wp_nonce_url( add_query_arg( array( 'reply_id' => $reply->ID, 'action' => 'bbp_toggle_reply_spam' ), remove_query_arg( array( 'bbp_reply_toggle_notice', 'reply_id', 'failed', 'super' ) ) ), 'spam-reply_'  . $reply->ID ) );
+                                $spam_uri  = wp_nonce_url( add_query_arg( array( 'reply_id' => $reply->ID, 'action' => 'bbp_toggle_reply_spam' ), remove_query_arg( array( 'bbp_reply_toggle_notice', 'reply_id', 'failed', 'super' ) ) ), 'spam-reply_'  . $reply->ID );
                                 if ( bbp_is_reply_spam( $reply->ID ) ) {
-                                        $actions['spam'] = '<a href="' . $spam_uri . '" title="' . esc_attr__( 'Mark the reply as not spam', 'bbpress' ) . '">' . __( 'Not spam', 'bbpress' ) . '</a>';
+                                        $actions['spam'] = '<a href="' . esc_url( $spam_uri ) . '" title="' . esc_attr__( 'Mark the reply as not spam', 'bbpress' ) . '">' . esc_html__( 'Not spam', 'bbpress' ) . '</a>';
                                 } else {
-                                        $actions['spam'] = '<a href="' . $spam_uri . '" title="' . esc_attr__( 'Mark this reply as spam',    'bbpress' ) . '">' . __( 'Spam',     'bbpress' ) . '</a>';
+                                        $actions['spam'] = '<a href="' . esc_url( $spam_uri ) . '" title="' . esc_attr__( 'Mark this reply as spam',    'bbpress' ) . '">' . esc_html__( 'Spam',     'bbpress' ) . '</a>';
                                 }
                         }
@@ -745 +745 @@
                 if ( current_user_can( 'delete_reply', $reply->ID ) ) {
                         if ( bbp_get_trash_status_id() == $reply->post_status ) {
-                                $post_type_object = get_post_type_object( bbp_get_reply_post_type() );
-                                $actions['untrash'] = "<a title='" . esc_attr__( 'Restore this item from the Trash', 'bbpress' ) . "' href='" . add_query_arg( array( '_wp_http_referer' => add_query_arg( array( 'post_type' => bbp_get_reply_post_type() ), admin_url( 'edit.php' ) ) ), wp_nonce_url( admin_url( sprintf( $post_type_object->_edit_link . '&amp;action=untrash', $reply->ID ) ), 'untrash-' . $reply->post_type . '_' . $reply->ID ) ) . "'>" . __( 'Restore', 'bbpress' ) . "</a>";
+                                $post_type_object   = get_post_type_object( bbp_get_reply_post_type() );
+                                $actions['untrash'] = "<a title='" . esc_attr__( 'Restore this item from the Trash', 'bbpress' ) . "' href='" . add_query_arg( array( '_wp_http_referer' => add_query_arg( array( 'post_type' => bbp_get_reply_post_type() ), admin_url( 'edit.php' ) ) ), wp_nonce_url( admin_url( sprintf( $post_type_object->_edit_link . '&amp;action=untrash', $reply->ID ) ), 'untrash-' . $reply->post_type . '_' . $reply->ID ) ) . "'>" . esc_html__( 'Restore', 'bbpress' ) . "</a>";
                         } elseif ( EMPTY_TRASH_DAYS ) {
-                                $actions['trash'] = "<a class='submitdelete' title='" . esc_attr__( 'Move this item to the Trash', 'bbpress' ) . "' href='" . add_query_arg( array( '_wp_http_referer' => add_query_arg( array( 'post_type' => bbp_get_reply_post_type() ), admin_url( 'edit.php' ) ) ), get_delete_post_link( $reply->ID ) ) . "'>" . __( 'Trash', 'bbpress' ) . "</a>";
+                                $actions['trash'] = "<a class='submitdelete' title='" . esc_attr__( 'Move this item to the Trash', 'bbpress' ) . "' href='" . add_query_arg( array( '_wp_http_referer' => add_query_arg( array( 'post_type' => bbp_get_reply_post_type() ), admin_url( 'edit.php' ) ) ), get_delete_post_link( $reply->ID ) ) . "'>" . esc_html__( 'Trash', 'bbpress' ) . "</a>";
                         }
 
                         if ( bbp_get_trash_status_id() == $reply->post_status || !EMPTY_TRASH_DAYS ) {
-                                $actions['delete'] = "<a class='submitdelete' title='" . esc_attr__( 'Delete this item permanently', 'bbpress' ) . "' href='" . add_query_arg( array( '_wp_http_referer' => add_query_arg( array( 'post_type' => bbp_get_reply_post_type() ), admin_url( 'edit.php' ) ) ), get_delete_post_link( $reply->ID, '', true ) ) . "'>" . __( 'Delete Permanently', 'bbpress' ) . "</a>";
+                                $actions['delete'] = "<a class='submitdelete' title='" . esc_attr__( 'Delete this item permanently', 'bbpress' ) . "' href='" . add_query_arg( array( '_wp_http_referer' => add_query_arg( array( 'post_type' => bbp_get_reply_post_type() ), admin_url( 'edit.php' ) ) ), get_delete_post_link( $reply->ID, '', true ) ) . "'>" . esc_html__( 'Delete Permanently', 'bbpress' ) . "</a>";
                         } elseif ( bbp_get_spam_status_id() == $reply->post_status ) {
                                 unset( $actions['trash'] );