Skip to content

Commit

Permalink
Add nonces to importers
Browse files Browse the repository at this point in the history 
git-svn-id: https://develop.svn.wordpress.org/branches/2.2@5405 602fd350-edb4-49c9-b593-d223f7449a82
  • Loading branch information
@ryanboren
ryanboren committed May 7, 2007
1 parent 9cd2dfa commit b678697
Show file tree
Hide file tree
Showing 9 changed files with 57 additions and 26 deletions.
1 change: 1 addition & 0 deletions wp-admin/admin-functions.php
View file
Expand Up @@ -2002,6 +2002,7 @@ function wp_import_upload_form( $action ) {
?>
<form enctype="multipart/form-data" id="import-upload-form" method="post" action="<?php echo attribute_escape($action) ?>">
<p>
<?php wp_nonce_field('import-upload'); ?>
<label for="upload"><?php _e( 'Choose a file from your computer:' ); ?></label> (<?php printf( __('Maximum size: %s' ), $size ); ?> )
<input type="file" id="upload" name="import" size="25" />
<input type="hidden" name="action" value="save" />
Expand Down
4 changes: 3 additions & 1 deletion wp-admin/import/blogger.php
View file
Expand Up @@ -743,10 +743,11 @@ function parse_response($this_response) {

// Step 9: Congratulate the user
function congrats() {
$blog = (int) $_GET['blog'];
echo '<h1>'.__('Congratulations!').'</h1><p>'.__('Now that you have imported your Blogger blog into WordPress, what are you going to do? Here are some suggestions:').'</p><ul><li>'.__('That was hard work! Take a break.').'</li>';
if ( count($this->import['blogs']) > 1 )
echo '<li>'.__('In case you haven\'t done it already, you can import the posts from your other blogs:'). $this->show_blogs() . '</li>';
if ( $n = count($this->import['blogs'][$_GET['blog']]['newusers']) )
if ( $n = count($this->import['blogs'][$blog]['newusers']) )
echo '<li>'.sprintf(__('Go to <a href="%s" target="%s">Authors &amp; Users</a>, where you can modify the new user(s) or delete them. If you want to make all of the imported posts yours, you will be given that option when you delete the new authors.'), 'users.php', '_parent').'</li>';
echo '<li>'.__('For security, click the link below to reset this importer.').'</li>';
echo '</ul>';
Expand All @@ -765,6 +766,7 @@ function start() {

if ( isset( $_REQUEST['blog'] ) ) {
$blog = is_array($_REQUEST['blog']) ? array_shift( array_keys( $_REQUEST['blog'] ) ) : $_REQUEST['blog'];
$blog = (int) $blog;
$this->import_blog( $blog );
} elseif ( isset($_GET['token']) )
$this->auth();
Expand Down
32 changes: 20 additions & 12 deletions wp-admin/import/dotclear.php
View file
Expand Up @@ -147,8 +147,9 @@ function greet()
echo '<div class="narrow"><p>'.__('Howdy! This importer allows you to extract posts from a DotClear database into your blog. Mileage may vary.').'</p>';
echo '<p>'.__('Your DotClear Configuration settings are as follows:').'</p>';
echo '<form action="admin.php?import=dotclear&amp;step=1" method="post">';
wp_nonce_field('import-dotclear');
$this->db_form();
echo '<p class="submit"><input type="submit" name="submit" value="'.__('Import Categories').' &raquo;" /></p>';
echo '<p class="submit"><input type="submit" name="submit" value="'.attribute_escape(__('Import Categories &raquo;')).'" /></p>';
echo '</form></div>';
}

Expand Down Expand Up @@ -558,7 +559,8 @@ function import_categories()


echo '<form action="admin.php?import=dotclear&amp;step=2" method="post">';
printf('<input type="submit" name="submit" value="%s" />', __('Import Users'));
wp_nonce_field('import-dotclear');
printf('<input type="submit" name="submit" value="%s" />', attribute_escape(__('Import Users')));
echo '</form>';

}
Expand All @@ -570,7 +572,8 @@ function import_users()
$this->users2wp($users);

echo '<form action="admin.php?import=dotclear&amp;step=3" method="post">';
printf('<input type="submit" name="submit" value="%s" />', __('Import Posts'));
wp_nonce_field('import-dotclear');
printf('<input type="submit" name="submit" value="%s" />', attribute_escape(__('Import Posts')));
echo '</form>';
}

Expand All @@ -581,7 +584,8 @@ function import_posts()
$this->posts2wp($posts);

echo '<form action="admin.php?import=dotclear&amp;step=4" method="post">';
printf('<input type="submit" name="submit" value="%s" />', __('Import Comments'));
wp_nonce_field('import-dotclear');
printf('<input type="submit" name="submit" value="%s" />', attribute_escape(__('Import Comments')));
echo '</form>';
}

Expand All @@ -592,7 +596,8 @@ function import_comments()
$this->comments2wp($comments);

echo '<form action="admin.php?import=dotclear&amp;step=5" method="post">';
printf('<input type="submit" name="submit" value="%s" />', __('Import Links'));
wp_nonce_field('import-dotclear');
printf('<input type="submit" name="submit" value="%s" />', attribute_escape(__('Import Links')));
echo '</form>';
}

Expand All @@ -604,7 +609,8 @@ function import_links()
add_option('dc_links', $links);

echo '<form action="admin.php?import=dotclear&amp;step=6" method="post">';
printf('<input type="submit" name="submit" value="%s" />', __('Finish'));
wp_nonce_field('import-dotclear');
printf('<input type="submit" name="submit" value="%s" />', attribute_escape(__('Finish')));
echo '</form>';
}

Expand Down Expand Up @@ -667,42 +673,44 @@ function dispatch()

if ( $step > 0 )
{
check_admin_referer('import-dotclear');

if($_POST['dbuser'])
{
if(get_option('dcuser'))
delete_option('dcuser');
add_option('dcuser',$_POST['dbuser']);
add_option('dcuser', sanitize_user($_POST['dbuser'], true));
}
if($_POST['dbpass'])
{
if(get_option('dcpass'))
delete_option('dcpass');
add_option('dcpass',$_POST['dbpass']);
add_option('dcpass', sanitize_user($_POST['dbpass'], true));
}

if($_POST['dbname'])
{
if(get_option('dcname'))
delete_option('dcname');
add_option('dcname',$_POST['dbname']);
add_option('dcname', sanitize_user($_POST['dbname'], true));
}
if($_POST['dbhost'])
{
if(get_option('dchost'))
delete_option('dchost');
add_option('dchost',$_POST['dbhost']);
add_option('dchost', sanitize_user($_POST['dbhost'], true));
}
if($_POST['dccharset'])
{
if(get_option('dccharset'))
delete_option('dccharset');
add_option('dccharset',$_POST['dccharset']);
add_option('dccharset', sanitize_user($_POST['dccharset'], true));
}
if($_POST['dbprefix'])
{
if(get_option('dcdbprefix'))
delete_option('dcdbprefix');
add_option('dcdbprefix',$_POST['dbprefix']);
add_option('dcdbprefix', sanitize_user($_POST['dbprefix'], true));
}


Expand Down
8 changes: 6 additions & 2 deletions wp-admin/import/greymatter.php
View file
Expand Up @@ -34,6 +34,7 @@ function greet() {
<form name="stepOne" method="get">
<input type="hidden" name="import" value="greymatter" />
<input type="hidden" name="step" value="1" />
<?php wp_nonce_field('import-greymatter'); ?>
<h3><?php _e('Second step: GreyMatter details:') ?></h3>
<p><table cellpadding="0">
<tr>
Expand Down Expand Up @@ -87,10 +88,12 @@ function import() {
}

if (!chdir($archivespath))
wp_die(sprintf(__("Wrong path, %s\ndoesn't exist\non the server"), $archivespath));
wp_die(__("Wrong path, the path to the GM entries does not exist on the server"));

if (!chdir($gmpath))
wp_die(sprintf(__("Wrong path, %s\ndoesn't exist\non the server"), $gmpath));
wp_die(__("Wrong path, the path to the GM files does not exist on the server"));

$lastentry = (int) $lastentry;

$this->header();
?>
Expand Down Expand Up @@ -297,6 +300,7 @@ function dispatch() {
$this->greet();
break;
case 1:
check_admin_referer('import-greymatter');
$this->import();
break;
}
Expand Down
1 change: 1 addition & 0 deletions wp-admin/import/livejournal.php
View file
Expand Up @@ -153,6 +153,7 @@ function dispatch() {
$this->greet();
break;
case 1 :
check_admin_referer('import-upload');
$this->import();
break;
}
Expand Down
3 changes: 3 additions & 0 deletions wp-admin/import/mt.php
View file
Expand Up @@ -147,6 +147,7 @@ function mt_authors_form() {
$authors = $this->get_mt_authors();
echo '<ol id="authors">';
echo '<form action="?import=mt&amp;step=2&amp;id=' . $this->id . '" method="post">';
wp_nonce_field('import-mt');
$j = -1;
foreach ($authors as $author) {
++ $j;
Expand Down Expand Up @@ -417,9 +418,11 @@ function dispatch() {
$this->greet();
break;
case 1 :
check_admin_referer('import-upload');
$this->select_authors();
break;
case 2:
check_admin_referer('import-mt');
$this->import();
break;
}
Expand Down
1 change: 1 addition & 0 deletions wp-admin/import/rss.php
View file
Expand Up @@ -156,6 +156,7 @@ function dispatch() {
$this->greet();
break;
case 1 :
check_admin_referer('import-upload');
$this->import();
break;
}
Expand Down
30 changes: 19 additions & 11 deletions wp-admin/import/textpattern.php
View file
Expand Up @@ -56,8 +56,9 @@ function greet() {
echo '<p>'.__('This has not been tested on previous versions of Textpattern. Mileage may vary.').'</p>';
echo '<p>'.__('Your Textpattern Configuration settings are as follows:').'</p>';
echo '<form action="admin.php?import=textpattern&amp;step=1" method="post">';
wp_nonce_field('import-textpattern');
$this->db_form();
echo '<p class="submit"><input type="submit" name="submit" value="'.__('Import Categories').' &raquo;" /></p>';
echo '<p class="submit"><input type="submit" name="submit" value="'.attribute_escape(__('Import Categories &raquo;')).'" /></p>';
echo '</form>';
echo '</div>';
}
Expand Down Expand Up @@ -483,7 +484,8 @@ function import_categories()


echo '<form action="admin.php?import=textpattern&amp;step=2" method="post">';
printf('<input type="submit" name="submit" value="%s" />', __('Import Users'));
wp_nonce_field('import-textpattern');
printf('<input type="submit" name="submit" value="%s" />', attribute_escape(__('Import Users')));
echo '</form>';

}
Expand All @@ -495,7 +497,8 @@ function import_users()
$this->users2wp($users);

echo '<form action="admin.php?import=textpattern&amp;step=3" method="post">';
printf('<input type="submit" name="submit" value="%s" />', __('Import Posts'));
wp_nonce_field('import-textpattern');
printf('<input type="submit" name="submit" value="%s" />', attribute_escape(__('Import Posts')));
echo '</form>';
}

Expand All @@ -506,7 +509,8 @@ function import_posts()
$this->posts2wp($posts);

echo '<form action="admin.php?import=textpattern&amp;step=4" method="post">';
printf('<input type="submit" name="submit" value="%s" />', __('Import Comments'));
wp_nonce_field('import-textpattern');
printf('<input type="submit" name="submit" value="%s" />', attribute_escape(__('Import Comments')));
echo '</form>';
}

Expand All @@ -517,7 +521,8 @@ function import_comments()
$this->comments2wp($comments);

echo '<form action="admin.php?import=textpattern&amp;step=5" method="post">';
printf('<input type="submit" name="submit" value="%s" />', __('Import Links'));
wp_nonce_field('import-textpattern');
printf('<input type="submit" name="submit" value="%s" />', attribute_escape(__('Import Links')));
echo '</form>';
}

Expand All @@ -529,7 +534,8 @@ function import_links()
add_option('txp_links', $links);

echo '<form action="admin.php?import=textpattern&amp;step=6" method="post">';
printf('<input type="submit" name="submit" value="%s" />', __('Finish'));
wp_nonce_field('import-textpattern');
printf('<input type="submit" name="submit" value="%s" />', attribute_escape(__('Finish')));
echo '</form>';
}

Expand Down Expand Up @@ -590,36 +596,38 @@ function dispatch()

if ( $step > 0 )
{
check_admin_referer('import-textpattern');

if($_POST['dbuser'])
{
if(get_option('txpuser'))
delete_option('txpuser');
add_option('txpuser',$_POST['dbuser']);
add_option('txpuser', sanitize_user($_POST['dbuser'], true));
}
if($_POST['dbpass'])
{
if(get_option('txppass'))
delete_option('txppass');
add_option('txppass',$_POST['dbpass']);
add_option('txppass', sanitize_user($_POST['dbpass'], true));
}

if($_POST['dbname'])
{
if(get_option('txpname'))
delete_option('txpname');
add_option('txpname',$_POST['dbname']);
add_option('txpname', sanitize_user($_POST['dbname'], true));
}
if($_POST['dbhost'])
{
if(get_option('txphost'))
delete_option('txphost');
add_option('txphost',$_POST['dbhost']);
add_option('txphost', sanitize_user($_POST['dbhost'], true));
}
if($_POST['dbprefix'])
{
if(get_option('tpre'))
delete_option('tpre');
add_option('tpre',$_POST['dbprefix']);
add_option('tpre', sanitize_user($_POST['dbprefix']));
}


Expand Down
3 changes: 3 additions & 0 deletions wp-admin/import/wordpress.php
View file
Expand Up @@ -159,6 +159,7 @@ function wp_authors_form() {
$authors = $this->get_wp_authors();
echo '<ol id="authors">';
echo '<form action="?import=wordpress&amp;step=2&amp;id=' . $this->id . '" method="post">';
wp_nonce_field('import-wordpress');
$j = -1;
foreach ($authors as $author) {
++ $j;
Expand Down Expand Up @@ -363,9 +364,11 @@ function dispatch() {
$this->greet();
break;
case 1 :
check_admin_referer('import-upload');
$this->select_authors();
break;
case 2:
check_admin_referer('import-wordpress');
$this->import();
break;
}
Expand Down

0 comments on commit b678697

Please sign in to comment.