From 39c0bce9f5573c2342360335285f923d6f169f44 Mon Sep 17 00:00:00 2001
From: John Bintz <john@coswellproductions.com>
Date: Sat, 14 Nov 2009 13:56:54 -0500
Subject: [PATCH] fix security echo issues, making this theme wp 2.8 only

---
 .../_comic-image-ordering-sorters.inc         | 20 +++++++++----------
 classes/partials/_comic-image-ordering.inc    |  4 ++--
 classes/partials/_image-type-editor.inc       |  8 ++++----
 classes/partials/options-admin.inc            |  2 +-
 4 files changed, 17 insertions(+), 17 deletions(-)

diff --git a/classes/partials/_comic-image-ordering-sorters.inc b/classes/partials/_comic-image-ordering-sorters.inc
index 80ea68e..673a1cb 100644
--- a/classes/partials/_comic-image-ordering-sorters.inc
+++ b/classes/partials/_comic-image-ordering-sorters.inc
@@ -3,7 +3,7 @@
 	<?php
 		printf(
 			__('To upload new images, use the %s.', 'comicpress'),
-			'<a href="' . $image_upload_iframe_src . '" class="thickbox" onclick="return false;">' . __('Image Uploader', 'comicpress') . '</a>'
+			'<a href="' . esc_attr($image_upload_iframe_src) . '" class="thickbox" onclick="return false;">' . __('Image Uploader', 'comicpress') . '</a>'
 		)
 	?>
 	<?php _e('Click the Refesh button underneath the zoom slider if you\'ve changed the images attached to this post.', 'comicpress') ?>
@@ -15,22 +15,22 @@
 			$result = ComicPressBackend::generate_from_id($id);
 			if (!empty($result)) {
 				$info = $result->get_info(); ?>
-				<div class="cp-comic-attachment" id="attachment_<?php echo $id ?>">
+				<div class="cp-comic-attachment" id="attachment_<?php echo esc_attr($id) ?>">
 					<div style="overflow: hidden">
-						<img src="<?php echo $result->url() ?>" border="0" height="<?php echo $zoom_level ?>" />
+						<img src="<?php echo esc_attr($result->url()) ?>" border="0" height="<?php echo esc_attr($zoom_level) ?>" />
 						<div class="cp-comic-info">
 							<p>
 								<label>
-									<input type="checkbox" name="cp[attachments][<?php echo $id ?>][visible]" value="yes" <?php echo ($attachment_info['enabled']) ? 'checked="checked"' : '' ?>/> <?php _e('Allow this image to be shown', 'comicpress') ?>
+									<input type="checkbox" name="cp[attachments][<?php echo esc_attr($id) ?>][visible]" value="yes" <?php echo ($attachment_info['enabled']) ? 'checked="checked"' : '' ?>/> <?php _e('Allow this image to be shown', 'comicpress') ?>
 								</label>
 							</p>
 							<?php if (isset($info['file'])) { ?>
-								<p><strong><?php echo $result->source_name ?>:</strong> <?php echo basename($info['file']) ?></p>
+								<p><strong><?php echo esc_html($result->source_name) ?>:</strong> <?php echo esc_html(basename($info['file'])) ?></p>
 							<?php } ?>
 							<?php if (isset($info['width']) && isset($info['height'])) { ?>
 								<p>
 									<strong><?php _e('Size:', 'comicpress') ?></strong>
-									<?php printf('%dx%d', $info['width'], $info['height'] ) ?>
+									<?php echo esc_html(sprintf('%dx%d', $info['width'], $info['height'])) ?>
 								</p>
 							<?php } ?>
 							<?php	if (count($comicpress->comicpress_options['image_types']) > 1) { ?>
@@ -40,8 +40,8 @@
 										<?php foreach ($comicpress->comicpress_options['image_types'] as $type => $info) { ?>
 											<?php if (!$info['default']) { ?>
 												<li>
-												  <strong><?php echo $info['name'] ?>:</strong>
-												  <select name="cp[attachments][<?php echo $id ?>][<?php echo $type ?>]"></select>
+												  <strong><?php echo esc_html($info['name']) ?>:</strong>
+												  <select name="cp[attachments][<?php echo esc_attr($id) ?>][<?php echo esc_attr($type) ?>]"></select>
 												</li>
 											<?php } ?>
 										<?php } ?>
@@ -58,8 +58,8 @@
 <?php } ?>
 
 <script type="text/javascript">
-	ComicImageOrdering.slider_value = <?php echo 190 - $zoom_level ?>;
-	ComicImageOrdering.available_attachments = <?php echo $this->_json_encode($available_attachments) ?>;
+	ComicImageOrdering.slider_value = <?php echo esc_js(190 - $zoom_level) ?>;
+	ComicImageOrdering.available_attachments = <?php echo esc_js($this->_json_encode($available_attachments)) ?>;
 
 	ComicImageOrdering.setup();
 </script>
diff --git a/classes/partials/_comic-image-ordering.inc b/classes/partials/_comic-image-ordering.inc
index 142c13b..a90cdc6 100644
--- a/classes/partials/_comic-image-ordering.inc
+++ b/classes/partials/_comic-image-ordering.inc
@@ -1,5 +1,5 @@
 <div style="overflow: hidden">
-  <input type="hidden" name="cp[_nonce]" value="<?php echo $nonce ?>" />
+  <input type="hidden" name="cp[_nonce]" value="<?php echo esc_attr($nonce) ?>" />
   <input type="hidden" name="cp[action]" value="comic-ordering" />
   <div id="ordering-zoom-slider-holder">
     <div id="ordering-zoom-slider">
@@ -32,4 +32,4 @@
       });
     }())
   </script>
-</div>
\ No newline at end of file
+</div>
diff --git a/classes/partials/_image-type-editor.inc b/classes/partials/_image-type-editor.inc
index f4d3572..be7b2ca 100644
--- a/classes/partials/_image-type-editor.inc
+++ b/classes/partials/_image-type-editor.inc
@@ -3,11 +3,11 @@
 	<table cellspacing="0">
 		<tr class="image-type-editor-name">
 			<th scope="row" width="30%">Name:</th>
-			<td width="70%"><input type="text" name="cp[image_types][<?php echo $type ?>][name]" value="<?php echo $info['name'] ?>" /></td>
+			<td width="70%"><input type="text" name="cp[image_types][<?php echo esc_attr($type) ?>][name]" value="<?php echo esc_attr($info['name']) ?>" /></td>
 		</tr>
 		<tr class="image-type-editor-short-name">
 			<th scope="row">Short name <em>(used in template tags):</em></th>
-			<td><input type="text" name="cp[image_types][<?php echo $type ?>][short_name]" value="<?php echo $type ?>" /></td>
+			<td><input type="text" name="cp[image_types][<?php echo esc_attr($type) ?>][short_name]" value="<?php echo esc_attr($type) ?>" /></td>
 		</tr>
 		<tr class="image-type-editor-default">
 			<th scope="row">Default image type?</th>
@@ -22,8 +22,8 @@
 			<th scope="row">Dimensions</th>
 			<td>
 				<?php list($width, $height) = explode("x", $info['dimensions']) ?>
-				<input type="text" name="cp[image_types][<?php echo $type ?>][dimensions][width]" value="<?php echo $width ?>" size="5" /> x
-				<input type="text" name="cp[image_types][<?php echo $type ?>][dimensions][height]" value="<?php echo $height ?>" size="5" />
+				<input type="text" name="cp[image_types][<?php echo esc_attr($type) ?>][dimensions][width]" value="<?php echo esc_attr($width) ?>" size="5" /> x
+				<input type="text" name="cp[image_types][<?php echo esc_attr($type) ?>][dimensions][height]" value="<?php echo esc_attr($height) ?>" size="5" />
 				<br />
 				<em>(<?php _e('Leave a dimension blank to allow WordPress to calculate that dimension while scaling', 'comicpress') ?>)</em>
 			</td>
diff --git a/classes/partials/options-admin.inc b/classes/partials/options-admin.inc
index 060b9f8..809e018 100644
--- a/classes/partials/options-admin.inc
+++ b/classes/partials/options-admin.inc
@@ -1,7 +1,7 @@
 <div class="wrap">
 	<h2><?php _e('ComicPress Config', 'comicpress') ?></h2>
 	<form method="post" action="">
-		<input type="hidden" name="cp[_nonce]" value="<?php echo $nonce ?>" />
+		<input type="hidden" name="cp[_nonce]" value="<?php echo esc_attr($nonce) ?>" />
 		<h3><?php _e('Global Options', 'comicpress') ?></h3>
 		<table class="widefat fixed">
 			<tr>