Commit Graph

33 Commits

Author SHA1 Message Date
Ryan Boren 15a06a35ab Use wp_unslash() instead of stripslashes() and stripslashes_deep(). Use wp_slash() instead of add_magic_quotes().
see #WP21767


git-svn-id: http://core.svn.wordpress.org/trunk@23591 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2013-03-03 16:30:38 +00:00
Ryan Boren 43a7e695e9 Revert 23416, 23419, 23445 except for wp_reset_vars() changes. We are going a different direction with the slashing cleanup, so resetting to a clean slate. see #21767
git-svn-id: http://core.svn.wordpress.org/trunk@23554 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2013-03-01 16:28:40 +00:00
Ryan Boren cc5ed3a485 Change all core API to expect unslashed rather than slashed arguments.
The exceptions to this are update_post_meta() and add_post_meta() which are often used by plugins in POST handlers and will continue accepting slashed data for now.

Introduce wp_upate_post_meta() and wp_add_post_meta() as unslashed alternatives to update_post_meta() and add_post_meta(). These functions could become methods in WP_Post so don't use them too heavily yet.

Remove all escape() calls from wp_xmlrpc_server. Now that core expects unslashed data this is no longer needed.

Remove addslashes(), addslashes_gpc(), add_magic_quotes() calls on data being prepared for handoff to core functions that until now expected slashed data. Adding slashes in no longer necessary.

Introduce wp_unslash() and use to it remove slashes from GPCS data before using it in core API. Almost every instance of stripslashes() in core should now be wp_unslash(). In the future (a release or three) when GPCS is no longer slashed, wp_unslash() will stop stripping slashes and simply return what is passed. At this point wp_unslash() calls can be removed from core.

Introduce wp_slash() for slashing GPCS data. This will also turn into a noop once GPCS is no longer slashed. wp_slash() should almost never be used. It is mainly of use in unit tests.

Plugins should use wp_unslash() on data being passed to core API.

Plugins should no longer slash data being passed to core. So when you get_post() and then wp_insert_post() the post data from get_post() no longer needs addslashes(). Most plugins were not bothering with this. They will magically start doing the right thing. Unfortunately, those few souls who did it properly will now have to avoid calling addslashes() for 3.6 and newer.

Use wp_kses_post() and wp_kses_data(), which expect unslashed data, instead of wp_filter_post_kses() and wp_filter_kses(), which expect slashed data. Filters are no longer passed slashed data.

Remove many no longer necessary calls to $wpdb->escape() and esc_sql().

In wp_get_referer() and wp_get_original_referer(), return unslashed data.

Remove old stripslashes() calls from WP_Widget::update() handlers. These haven't been necessary since WP_Widget.

Switch several queries over to prepare().

Expect something to break.

Props alexkingorg
see #21767


git-svn-id: http://core.svn.wordpress.org/trunk@23416 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2013-02-14 22:51:06 +00:00
Ryan Boren 06ee370814 Pinking shears
git-svn-id: http://core.svn.wordpress.org/trunk@22634 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2012-11-17 15:11:29 +00:00
Andrew Nacin 180b0f19e5 Ensure a method is compatible with its parent. props kurtpayne, fixes #22265.
git-svn-id: http://core.svn.wordpress.org/trunk@22448 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2012-11-07 21:59:20 +00:00
ryan 564a7db2cb phpdoc for Customizer classes and methods. Props bananastalktome. see #21303
git-svn-id: http://core.svn.wordpress.org/trunk@21354 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2012-07-26 21:45:33 +00:00
nacin 2d07cd3fc5 Theme Customizer: Remove background_image_thumb when saving settings. fixes #20871.
This prevents the background_image and background_image_thumb settings from getting out of sync.
In 3.5 we can consider using background-size on Appearance > Background, eliminating _thumb.



git-svn-id: http://core.svn.wordpress.org/trunk@21053 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2012-06-11 20:49:45 +00:00
ryan 808ce796ae * Introduce remove_header_image(), reset_header_image(), set_header_image(), and get_header_image_data() for Custom_Image_Header.
* Handle all set/get of header theme mod through these methods.
* Use these methods in the customizer.

Props kovshenin, nacin, SergeyBiryukov, koopersmith.
fixes #20871


git-svn-id: http://core.svn.wordpress.org/trunk@21037 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2012-06-10 00:32:19 +00:00
koopersmith 0df3218cc2 Theme Customizer: Ensure that JS color controls always use real color values, even if the server-side value is a hex value without a hash. fixes #20448, see #19910.
Adds WP_Customize_Setting->sanitize_js_callback and 'customize_sanitize_js_$settingID' filter, to filter values before they're passed to JS using WP_Customize_Setting->js_value().

Adds support for regular hex colors to the color picker.

Changes color methods:
* sanitize_hex_color() accepts 3 and 6 digit hex colors (with hashes) and the empty string.
* sanitize_hex_color_no_hash() accepts 3 and 6 digit hex colors (without hashes) and the empty string.
* maybe_hash_hex_color() ensures that a hex color has a hash, and otherwise leaves the value untouched.


git-svn-id: http://core.svn.wordpress.org/trunk@20936 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2012-05-26 18:44:31 +00:00
koopersmith 507f3b2d0c Theme Customizer: Properly escape customize settings when sending values to JS. Add WP_Customize_Setting->js_value(). fixes #20687, see #19910.
git-svn-id: http://core.svn.wordpress.org/trunk@20809 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2012-05-16 20:59:02 +00:00
ryan db3da0b695 Add filters for the default to get_option() and get_site_option(). Provide default overrides in the customizer. Props Otto42. see #20448
git-svn-id: http://core.svn.wordpress.org/trunk@20783 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2012-05-14 16:45:32 +00:00
koopersmith 2f2cb0926f Theme Customizer: Migrate to an ajax-based solution for refreshing the preview and saving. see #20507, #19910.
* Use ajax-based saving, add saving indicator.
* Use ajax-based refreshing instead of form targets.
* Instead of using hidden inputs with prefixed names to track the canonical data, use the values stored in wp.customize. Encode the values as JSON before sending to avoid bugs with ids that contain square brackets (PHP mangles POST values with nested brackets).
* Use wp.customize.Previewer solely for the purpose of previewing; move the postMessage connection with the parent frame and other unrelated code snippets into the 'ready' handler.


git-svn-id: http://svn.automattic.com/wordpress/trunk@20645 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2012-04-30 15:46:17 +00:00
koopersmith 863a458165 Theme Customizer: For clarity, wp.customize.Setting.method to wp.customize.Setting.transport. Add WP_Customize_Setting->transport to allow setting the transport method via PHP. see #19910.
git-svn-id: http://svn.automattic.com/wordpress/trunk@20585 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2012-04-25 16:04:51 +00:00
koopersmith 23ef6d4aab Theme Customizer: Properly pass arguments by reference to WP_Customize_Setting->multidimensional(). see #19910, [20136], #20163.
This is necessary for WP_Customize_Setting->multidimensional_replace() to work properly on multidimensional arrays (which was, as the name indicates, the point of the function in the first place).

git-svn-id: http://svn.automattic.com/wordpress/trunk@20300 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2012-03-28 09:27:26 +00:00
koopersmith 30d798ec8d Create WP_Customize_Control to separate the process of rendering a control from fetching, previewing, and saving its values. see #19910.
Many-to-many mapping between settings and controls.
* Settings and controls have been separated in both the PHP (WP_Customize_Setting, WP_Customize_Control) and the JS (wp.customize.Setting, wp.customize.Control).
* While most settings are tied to a single control, some require multiple controls. The 'header_textcolor' control is a good example: to hide the header text, header_textcolor is set to 'blank'.

Add 'Display Header Text' control.

A handful of miscellaneous bugfixes along the way.

Notes:
* Controls should be separated out a bit more; juggling type-specific arguments in the switch statement is rather inelegant.
* Page dropdowns are currently inactive and need to be re-linked.

git-svn-id: http://svn.automattic.com/wordpress/trunk@20295 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2012-03-28 04:14:09 +00:00
koopersmith 4e2cbd6a4d Theme Customizer: Add 'choose image' functionality to image controls. Rough first pass, using header images as an example. see #19910.
git-svn-id: http://svn.automattic.com/wordpress/trunk@20290 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2012-03-25 21:18:32 +00:00
koopersmith 6213bdfa52 Theme Customizer: First pass at image controls. Use header_image as the initial case. Add a 'removed' control param for upload/image controls to map 'removed' to a value other than the empty string. see #19910.
git-svn-id: http://svn.automattic.com/wordpress/trunk@20278 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2012-03-24 04:35:13 +00:00
koopersmith cca689308c Theme Customizer: Add WP_Customizer_Setting->control_params, and wp.customize.Control.params to allow settings to pass arbitrary parameters to controls. Add the 'context' parameter to wp.customize.UploadControl. see #19910.
git-svn-id: http://svn.automattic.com/wordpress/trunk@20276 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2012-03-24 01:02:29 +00:00
koopersmith b6e48e5d81 Theme Customizer: Add background repeat, position, and attachment settings. Change visibility parameter to accept a string or array( , ). see #19910.
git-svn-id: http://svn.automattic.com/wordpress/trunk@20263 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2012-03-22 08:07:44 +00:00
koopersmith c6ae8b8e51 Theme Customizer: Only show uploader 'remove' links when there is an image to remove. see #19910.
git-svn-id: http://svn.automattic.com/wordpress/trunk@20261 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2012-03-22 07:30:44 +00:00
koopersmith 5443bec597 Theme Customizer: Add a WP_Customize_Setting->visibility parameter to show/hide a control based upon the value of another control. Also shifts rendering the setting wrapper element into WP_Customize_Setting->render() and adds WP_Customize_Setting->render_content(). see #19910.
git-svn-id: http://svn.automattic.com/wordpress/trunk@20260 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2012-03-22 07:17:26 +00:00
koopersmith 1d19466272 Theme Customizer: Make dropdown-pages a native customize control. see #19910.
While the customize_render_control- action has been removed, we could still accomplish this with the customize_render_setting action. That said, in this case, avoiding native integration was a matter of minor semantics that ended in the same result.

git-svn-id: http://svn.automattic.com/wordpress/trunk@20254 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2012-03-22 04:14:26 +00:00
koopersmith dbd50b0972 Theme Customizer: Numerous API refinements and bugfixes. Add a theme_supports check for header_textcolor. see #19910.
* prepare_controls() now removes any settings and sections that return false for check_capabilities().
* Added maybe_render() methods to both settings and sections that call the protected render() methods.
* Stop firing front-end preview functionality when rendering the controls.
* Merged the WP_Customize_Setting->_render_type() method into WP_Customize_Setting->render().
* Removed the 'customize_render_control-' hook; use 'customize_render_setting' instead.
* Added a  property to sections and settings so they no longer rely on the  global. Hooray for dependency injection.
* Shifted calls to WP_Customize_Setting->enqueue() to the 'customize_controls_enqueue_scripts' action.
* Added a theme_supports check for the header_textcolor setting.

git-svn-id: http://svn.automattic.com/wordpress/trunk@20248 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2012-03-21 22:55:43 +00:00
koopersmith 61d7f6a476 Theme Customizer: Improve WP_Customize_Setting->check_capabilities(). Add support for arrays in WP_Customize_Setting->capability and WP_Customize_Setting->theme_supports. Don't bail when WP_Customize_Setting->capability is empty. see #19910.
git-svn-id: http://svn.automattic.com/wordpress/trunk@20232 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2012-03-21 04:59:57 +00:00
koopersmith 6bda61536e Theme Customizer: Improve sidebar CSS. Display most elements inline, refine padding/line-heights. see #19910.
git-svn-id: http://svn.automattic.com/wordpress/trunk@20181 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2012-03-15 05:30:11 +00:00
koopersmith c06576d410 Theme Customizer: First pass for upload controls, using background image as an example. Add a wrapper for Plupload that allows for custom upload UIs. see #19910.
wp.Uploader is a wrapper that provides a simple way to upload an attachment (using the wp_ajax_upload_attachment handler). It is intentionally decoupled from the UI. When an upload succeeds, it will receive the attachment information (id, url, meta, etc) as a JSON response. If the upload fails, the wrapper handles both WordPress and plupload errors through a single handler.

As todos, we should add drag classes for the uploader dropzone and account for the rough 100mb filesize limit in most browsers. The UI for the customizer upload controls could be improved as well.

git-svn-id: http://svn.automattic.com/wordpress/trunk@20179 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2012-03-15 04:14:05 +00:00
duck_ 55d5ed2be1 Remove call-time pass by reference as it causes a compile time fatal error in PHP 5.4. See #20163.
git-svn-id: http://svn.automattic.com/wordpress/trunk@20136 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2012-03-07 16:32:11 +00:00
koopersmith 28ee213574 Theme Customizer: Color picker markup/CSS improvements. Part 1. see #19910.
git-svn-id: http://svn.automattic.com/wordpress/trunk@20130 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2012-03-06 23:55:16 +00:00
koopersmith e9652cf3fd Theme Customizer: Add a Control object to better encapsulate different UI elements and make it easy to switch between hard refreshes and postMessage. see #19910.
git-svn-id: http://svn.automattic.com/wordpress/trunk@20128 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2012-03-06 22:48:07 +00:00
koopersmith 380985868b Theme Customizer: Add working color pickers. First pass. see #19910.
git-svn-id: http://svn.automattic.com/wordpress/trunk@20120 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2012-03-06 02:03:50 +00:00
koopersmith f596a23899 Theme Customizer: Strip slashes when sanitizing previewed values. see #19910.
git-svn-id: http://svn.automattic.com/wordpress/trunk@20028 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2012-02-28 21:21:16 +00:00
ryan d910c26182 Pinking shears 6-20000
git-svn-id: http://svn.automattic.com/wordpress/trunk@20000 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2012-02-27 19:46:52 +00:00
koopersmith c832f904ae Introduce new theme customizer to replace theme preview. Rough first pass. props koopersmith, ocean90. see #19910.
Merges in http://plugins.svn.wordpress.org/gandalf/branches/dev/ rev 510148.

git-svn-id: http://svn.automattic.com/wordpress/trunk@19995 1a063a9b-81f0-0310-95a4-ce76da25c4cd
2012-02-25 04:12:43 +00:00