Index: wp-admin/edit-page-form.php
===================================================================
--- wp-admin/edit-page-form.php (.../2.0.10) (revision 6405)
+++ wp-admin/edit-page-form.php (.../2.0.11) (revision 6405)
@@ -9,11 +9,15 @@
$temp_ID = -1 * time();
$form_extra = "
";
} else {
+ $post_ID = (int) $post_ID;
$form_action = 'editpost';
$nonce_action = 'update-post_' . $post_ID;
$form_extra = "
";
}
+$temp_ID = (int) $temp_ID;
+$user_ID = (int) $user_ID;
+
$sendto = attribute_escape(wp_get_referer());
if ( 0 != $post_ID && $sendto == get_permalink($post_ID) )
@@ -60,7 +64,7 @@
@@ -85,7 +89,7 @@
+
id ) ) : // TODO: ROLE SYSTEM ?>
@@ -98,6 +102,8 @@
$o = get_userdata( $o->ID );
if ( $post->post_author == $o->ID || ( empty($post_ID) && $user_ID == $o->ID ) ) $selected = 'selected="selected"';
else $selected = '';
+$o->ID = (int) $o->ID;
+$o->display_name = wp_specialchars( $o->display_name );
echo "$o->display_name ";
endforeach;
?>
@@ -118,7 +124,7 @@
+
Index: wp-admin/import/livejournal.php
===================================================================
--- wp-admin/import/livejournal.php (.../2.0.10) (revision 6405)
+++ wp-admin/import/livejournal.php (.../2.0.11) (revision 6405)
@@ -153,6 +153,7 @@
$this->greet();
break;
case 1 :
+ check_admin_referer('import-upload');
$this->import();
break;
}
Index: wp-admin/import/dotclear.php
===================================================================
--- wp-admin/import/dotclear.php (.../2.0.10) (revision 6405)
+++ wp-admin/import/dotclear.php (.../2.0.11) (revision 6405)
@@ -1,16 +1,21 @@
get_var('SELECT cat_ID FROM '.$wpdb->categories.' WHERE category_nicename="'.$category_nicename.'"');
-
+
return $name;
}
}
@@ -55,58 +60,59 @@
//
// This cries out for a C-implementation to be included in PHP core
//
- function valid_1byte($char) {
- if(!is_int($char)) return false;
- return ($char & 0x80) == 0x00;
- }
-
- function valid_2byte($char) {
- if(!is_int($char)) return false;
- return ($char & 0xE0) == 0xC0;
- }
- function valid_3byte($char) {
- if(!is_int($char)) return false;
- return ($char & 0xF0) == 0xE0;
- }
+function valid_1byte($char) {
+ if(!is_int($char)) return false;
+ return ($char & 0x80) == 0x00;
+}
- function valid_4byte($char) {
- if(!is_int($char)) return false;
- return ($char & 0xF8) == 0xF0;
- }
-
- function valid_nextbyte($char) {
- if(!is_int($char)) return false;
- return ($char & 0xC0) == 0x80;
- }
-
- function valid_utf8($string) {
- $len = strlen($string);
- $i = 0;
- while( $i < $len ) {
- $char = ord(substr($string, $i++, 1));
- if(valid_1byte($char)) { // continue
- continue;
- } else if(valid_2byte($char)) { // check 1 byte
- if(!valid_nextbyte(ord(substr($string, $i++, 1))))
- return false;
- } else if(valid_3byte($char)) { // check 2 bytes
- if(!valid_nextbyte(ord(substr($string, $i++, 1))))
- return false;
- if(!valid_nextbyte(ord(substr($string, $i++, 1))))
- return false;
- } else if(valid_4byte($char)) { // check 3 bytes
- if(!valid_nextbyte(ord(substr($string, $i++, 1))))
- return false;
- if(!valid_nextbyte(ord(substr($string, $i++, 1))))
- return false;
- if(!valid_nextbyte(ord(substr($string, $i++, 1))))
- return false;
- } // goto next char
- }
- return true; // done
- }
+function valid_2byte($char) {
+ if(!is_int($char)) return false;
+ return ($char & 0xE0) == 0xC0;
+}
+function valid_3byte($char) {
+ if(!is_int($char)) return false;
+ return ($char & 0xF0) == 0xE0;
+}
+
+function valid_4byte($char) {
+ if(!is_int($char)) return false;
+ return ($char & 0xF8) == 0xF0;
+}
+
+function valid_nextbyte($char) {
+ if(!is_int($char)) return false;
+ return ($char & 0xC0) == 0x80;
+}
+
+function valid_utf8($string) {
+ $len = strlen($string);
+ $i = 0;
+ while( $i < $len ) {
+ $char = ord(substr($string, $i++, 1));
+ if(valid_1byte($char)) { // continue
+ continue;
+ } else if(valid_2byte($char)) { // check 1 byte
+ if(!valid_nextbyte(ord(substr($string, $i++, 1))))
+ return false;
+ } else if(valid_3byte($char)) { // check 2 bytes
+ if(!valid_nextbyte(ord(substr($string, $i++, 1))))
+ return false;
+ if(!valid_nextbyte(ord(substr($string, $i++, 1))))
+ return false;
+ } else if(valid_4byte($char)) { // check 3 bytes
+ if(!valid_nextbyte(ord(substr($string, $i++, 1))))
+ return false;
+ if(!valid_nextbyte(ord(substr($string, $i++, 1))))
+ return false;
+ if(!valid_nextbyte(ord(substr($string, $i++, 1))))
+ return false;
+ } // goto next char
+ }
+ return true; // done
+}
+
function csc ($s) {
if (valid_utf8 ($s)) {
return $s;
@@ -127,7 +133,7 @@
function header()
{
echo '';
- echo '
'.__('Import Dotclear').' ';
+ echo '
'.__('Import DotClear').' ';
echo '
'.__('Steps may take a few minutes depending on the size of your database. Please be patient.').'
';
}
@@ -135,78 +141,79 @@
{
echo '
'.__('Howdy! This importer allows you to extract posts from a Dotclear database into your blog. Mileage may vary.').'
';
- echo ''.__('Your Dotclear Configuration settings are as follows:').'
';
+ echo ''.__('Howdy! This importer allows you to extract posts from a DotClear database into your blog. Mileage may vary.').'
';
+ echo '
'.__('Your DotClear Configuration settings are as follows:').'
';
echo '
';
+ echo '
';
+ echo '
'.__('Importing Categories...').'
';
- foreach ($categories as $category)
+ foreach ($categories as $category)
{
$count++;
extract($category);
-
+
// Make Nice Variables
$name = $wpdb->escape($cat_libelle_url);
$title = $wpdb->escape(csc ($cat_libelle));
@@ -236,7 +243,7 @@
}
$dccat2wpcat[$id] = $ret_id;
}
-
+
// Store category translation for future use
add_option('dccat2wpcat',$dccat2wpcat);
echo ''.sprintf(__('Done! %1$s categories imported.'), $count).'
';
@@ -245,14 +252,14 @@
echo __('No Categories to Import!');
return false;
}
-
+
function users2wp($users='')
{
// General Housekeeping
global $wpdb;
$count = 0;
$dcid2wpid = array();
-
+
// Midnight Mojo
if(is_array($users))
{
@@ -261,14 +268,14 @@
{
$count++;
extract($user);
-
+
// Make Nice Variables
$name = $wpdb->escape(csc ($name));
$RealName = $wpdb->escape(csc ($user_pseudo));
-
+
if($uinfo = get_userdatabylogin($name))
{
-
+
$ret_id = wp_insert_user(array(
'ID' => $uinfo->ID,
'user_login' => $user_id,
@@ -278,7 +285,7 @@
'display_name' => $Realname)
);
}
- else
+ else
{
$ret_id = wp_insert_user(array(
'user_login' => $user_id,
@@ -289,9 +296,9 @@
);
}
$dcid2wpid[$user_id] = $ret_id;
-
- // Set Dotclear-to-WordPress permissions translation
-
+
+ // Set DotClear-to-WordPress permissions translation
+
// Update Usermeta Data
$user = new WP_User($ret_id);
$wp_perms = $user_level + 1;
@@ -302,26 +309,26 @@
else if(3 <= $wp_perms) { $user->set_role('contributor'); }
else if(2 <= $wp_perms) { $user->set_role('contributor'); }
else { $user->set_role('subscriber'); }
-
+
update_usermeta( $ret_id, 'wp_user_level', $wp_perms);
update_usermeta( $ret_id, 'rich_editing', 'false');
update_usermeta( $ret_id, 'first_name', csc ($user_prenom));
update_usermeta( $ret_id, 'last_name', csc ($user_nom));
}// End foreach($users as $user)
-
+
// Store id translation array for future use
add_option('dcid2wpid',$dcid2wpid);
-
-
+
+
echo ''.sprintf(__('Done! %1$s users imported.'), $count).'
';
return true;
}// End if(is_array($users)
-
+
echo __('No Users to Import!');
return false;
-
+
}// End function user2wp()
-
+
function posts2wp($posts='')
{
// General Housekeeping
@@ -338,17 +345,18 @@
{
$count++;
extract($post);
-
- // Set Dotclear-to-WordPress status translation
+
+ // Set DotClear-to-WordPress status translation
$stattrans = array(0 => 'draft', 1 => 'publish');
$comment_status_map = array (0 => 'closed', 1 => 'open');
-
+
//Can we do this more efficiently?
$uinfo = ( get_userdatabylogin( $user_id ) ) ? get_userdatabylogin( $user_id ) : 1;
$authorid = ( is_object( $uinfo ) ) ? $uinfo->ID : $uinfo ;
$Title = $wpdb->escape(csc ($post_titre));
$post_content = textconv ($post_content);
+ $post_excerpt = "";
if ($post_chapo != "") {
$post_excerpt = textconv ($post_chapo);
$post_content = $post_excerpt ."\n\n".$post_content;
@@ -356,9 +364,9 @@
$post_excerpt = $wpdb->escape ($post_excerpt);
$post_content = $wpdb->escape ($post_content);
$post_status = $stattrans[$post_pub];
-
+
// Import Post data into WordPress
-
+
if($pinfo = post_exists($Title,$post_content))
{
$ret_id = wp_insert_post(array(
@@ -378,7 +386,7 @@
'comment_count' => $post_nb_comment + $post_nb_trackback)
);
}
- else
+ else
{
$ret_id = wp_insert_post(array(
'post_author' => $authorid,
@@ -397,7 +405,7 @@
);
}
$dcposts2wpposts[$post_id] = $ret_id;
-
+
// Make Post-to-Category associations
$cats = array();
if($cat1 = get_catbynicename($post_cat_name)) { $cats[1] = $cat1; }
@@ -407,11 +415,11 @@
}
// Store ID translation for later use
add_option('dcposts2wpposts',$dcposts2wpposts);
-
+
echo ''.sprintf(__('Done! %1$s posts imported.'), $count).'
';
- return true;
+ return true;
}
-
+
function comments2wp($comments='')
{
// General Housekeeping
@@ -419,7 +427,7 @@
$count = 0;
$dccm2wpcm = array();
$postarr = get_option('dcposts2wpposts');
-
+
// Magic Mojo
if(is_array($comments))
{
@@ -428,7 +436,7 @@
{
$count++;
extract($comment);
-
+
// WordPressify Data
$comment_ID = (int) ltrim($comment_id, '0');
$comment_post_ID = (int) $postarr[$post_id];
@@ -437,7 +445,7 @@
$email = $wpdb->escape($comment_email);
$web = "http://".$wpdb->escape($comment_site);
$message = $wpdb->escape(textconv ($comment_content));
-
+
if($cinfo = comment_exists($name, $comment_dt))
{
// Update comments
@@ -454,7 +462,7 @@
'comment_approved' => $comment_approved)
);
}
- else
+ else
{
// Insert comments
$ret_id = wp_insert_comment(array(
@@ -472,25 +480,25 @@
$dccm2wpcm[$comment_ID] = $ret_id;
}
// Store Comment ID translation for future use
- add_option('dccm2wpcm', $dccm2wpcm);
-
+ add_option('dccm2wpcm', $dccm2wpcm);
+
// Associate newly formed categories with posts
get_comment_count($ret_id);
-
-
+
+
echo ''.sprintf(__('Done! %1$s comments imported.'), $count).'
';
return true;
}
echo __('No Comments to Import!');
return false;
}
-
+
function links2wp($links='')
{
// General Housekeeping
global $wpdb;
$count = 0;
-
+
// Deal with the links
if(is_array($links))
{
@@ -499,7 +507,7 @@
{
$count++;
extract($link);
-
+
if ($title != "") {
if ($cinfo = link_cat_exists (csc ($title))) {
$category = $cinfo;
@@ -511,7 +519,7 @@
} else {
$linkname = $wpdb->escape(csc ($label));
$description = $wpdb->escape(csc ($title));
-
+
if($linfo = link_exists($linkname)) {
$ret_id = wp_insert_link(array(
'link_id' => $linfo,
@@ -540,70 +548,75 @@
echo __('No Links to Import!');
return false;
}
-
- function import_categories()
- {
- // Category Import
+
+ function import_categories()
+ {
+ // Category Import
$cats = $this->get_dc_cats();
$this->cat2wp($cats);
add_option('dc_cats', $cats);
-
-
-
+
+
+
echo '';
}
-
+
function import_users()
{
// User Import
- $users = $this->get_dc_users();
+ $users = $this->get_dc_users();
$this->users2wp($users);
-
+
echo '';
}
-
+
function import_posts()
{
// Post Import
$posts = $this->get_dc_posts();
$this->posts2wp($posts);
-
+
echo '';
}
-
+
function import_comments()
{
// Comment Import
$comments = $this->get_dc_comments();
$this->comments2wp($comments);
-
+
echo '';
}
-
+
function import_links()
{
//Link Import
$links = $this->get_dc_links();
$this->links2wp($links);
add_option('dc_links', $links);
-
+
echo '';
}
-
+
function cleanup_dcimport()
{
- delete_option('tpre');
+ delete_option('dcdbprefix');
delete_option('dc_cats');
delete_option('dcid2wpid');
delete_option('dccat2wpcat');
@@ -617,16 +630,16 @@
delete_option('dccharset');
$this->tips();
}
-
+
function tips()
{
- echo ''.__('Welcome to WordPress. We hope (and expect!) that you will find this platform incredibly rewarding! As a new WordPress user coming from Dotclear, there are some things that we would like to point out. Hopefully, they will help your transition go as smoothly as possible.').'
';
+ echo ''.__('Welcome to WordPress. We hope (and expect!) that you will find this platform incredibly rewarding! As a new WordPress user coming from DotClear, there are some things that we would like to point out. Hopefully, they will help your transition go as smoothly as possible.').'
';
echo ''.__('Users').' ';
- echo ''.sprintf(__('You have already setup WordPress and have been assigned an administrative login and password. Forget it. You didn\'t have that login in Dotclear, why should you have it here? Instead we have taken care to import all of your users into our system. Unfortunately there is one downside. Because both WordPress and Dotclear uses a strong encryption hash with passwords, it is impossible to decrypt it and we are forced to assign temporary passwords to all your users. Every user has the same username, but their passwords are reset to password123. So Login and change it.'), '/wp-login.php').'
';
+ echo ''.sprintf(__('You have already setup WordPress and have been assigned an administrative login and password. Forget it. You didn\'t have that login in DotClear, why should you have it here? Instead we have taken care to import all of your users into our system. Unfortunately there is one downside. Because both WordPress and DotClear uses a strong encryption hash with passwords, it is impossible to decrypt it and we are forced to assign temporary passwords to all your users. Every user has the same username, but their passwords are reset to password123. So Login and change it.'), '/wp-login.php').'
';
echo ''.__('Preserving Authors').' ';
echo ''.__('Secondly, we have attempted to preserve post authors. If you are the only author or contributor to your blog, then you are safe. In most cases, we are successful in this preservation endeavor. However, if we cannot ascertain the name of the writer due to discrepancies between database tables, we assign it to you, the administrative user.').'
';
echo ''.__('Textile').' ';
- echo ''.__('Also, since you\'re coming from Dotclear, you probably have been using Textile to format your comments and posts. If this is the case, we recommend downloading and installing Textile for WordPress . Trust me... You\'ll want it.').'
';
+ echo ''.__('Also, since you\'re coming from DotClear, you probably have been using Textile to format your comments and posts. If this is the case, we recommend downloading and installing Textile for WordPress . Trust me... You\'ll want it.').'
';
echo ''.__('WordPress Resources').' ';
echo ''.__('Finally, there are numerous WordPress resources around the internet. Some of them are:').'
';
echo '';
@@ -636,20 +649,20 @@
echo ' ';
echo ''.sprintf(__('That\'s it! What are you waiting for? Go login !'), '../wp-login.php').'
';
}
-
+
function db_form()
{
- echo '';
+ echo '';
}
-
- function dispatch()
+
+ function dispatch()
{
if (empty ($_GET['step']))
@@ -657,51 +670,53 @@
else
$step = (int) $_GET['step'];
$this->header();
-
- if ( $step > 0 )
+
+ if ( $step > 0 )
{
+ check_admin_referer('import-dotclear');
+
if($_POST['dbuser'])
{
if(get_option('dcuser'))
- delete_option('dcuser');
- add_option('dcuser',$_POST['dbuser']);
+ delete_option('dcuser');
+ add_option('dcuser', sanitize_user($_POST['dbuser'], true));
}
if($_POST['dbpass'])
{
if(get_option('dcpass'))
- delete_option('dcpass');
- add_option('dcpass',$_POST['dbpass']);
+ delete_option('dcpass');
+ add_option('dcpass', sanitize_user($_POST['dbpass'], true));
}
-
+
if($_POST['dbname'])
{
if(get_option('dcname'))
- delete_option('dcname');
- add_option('dcname',$_POST['dbname']);
+ delete_option('dcname');
+ add_option('dcname', sanitize_user($_POST['dbname'], true));
}
if($_POST['dbhost'])
{
if(get_option('dchost'))
delete_option('dchost');
- add_option('dchost',$_POST['dbhost']);
+ add_option('dchost', sanitize_user($_POST['dbhost'], true));
}
if($_POST['dccharset'])
{
if(get_option('dccharset'))
delete_option('dccharset');
- add_option('dccharset',$_POST['dccharset']);
- }
+ add_option('dccharset', sanitize_user($_POST['dccharset'], true));
+ }
if($_POST['dbprefix'])
{
- if(get_option('tpre'))
- delete_option('tpre');
- add_option('tpre',$_POST['dbprefix']);
- }
+ if(get_option('dcdbprefix'))
+ delete_option('dcdbprefix');
+ add_option('dcdbprefix', sanitize_user($_POST['dbprefix'], true));
+ }
}
- switch ($step)
+ switch ($step)
{
default:
case 0 :
@@ -726,16 +741,16 @@
$this->cleanup_dcimport();
break;
}
-
+
$this->footer();
}
- function Dotclear_Import()
+ function Dotclear_Import()
{
- // Nothing.
+ // Nothing.
}
}
$dc_import = new Dotclear_Import();
-register_importer('dotclear', __('Dotclear'), __('Import posts from a Dotclear Blog'), array ($dc_import, 'dispatch'));
+register_importer('dotclear', __('DotClear'), __('Import categories, users, posts, comments, and links from a DotClear blog'), array ($dc_import, 'dispatch'));
?>
Property changes on: wp-admin/import/dotclear.php
___________________________________________________________________
Name: svn:eol-style
+ native
Index: wp-admin/import/mt.php
===================================================================
--- wp-admin/import/mt.php (.../2.0.10) (revision 6405)
+++ wp-admin/import/mt.php (.../2.0.11) (revision 6405)
@@ -145,6 +145,7 @@
$authors = $this->get_mt_authors();
echo '';
echo '