Issues (4967)

Security Analysis    not enabled

This project does not seem to handle request data directly as such no vulnerable execution paths were found.

  Cross-Site Scripting
Cross-Site Scripting enables an attacker to inject code into the response of a web-request that is viewed by other users. It can for example be used to bypass access controls, or even to take over other users' accounts.
  File Exposure
File Exposure allows an attacker to gain access to local files that he should not be able to access. These files can for example include database credentials, or other configuration files.
  File Manipulation
File Manipulation enables an attacker to write custom data to files. This potentially leads to injection of arbitrary code on the server.
  Object Injection
Object Injection enables an attacker to inject an object into PHP code, and can lead to arbitrary code execution, file exposure, or file manipulation attacks.
  Code Injection
Code Injection enables an attacker to execute arbitrary code on the server.
  Response Splitting
Response Splitting can be used to send arbitrary responses.
  File Inclusion
File Inclusion enables an attacker to inject custom files into PHP's file loading mechanism, either explicitly passed to include, or for example via PHP's auto-loading mechanism.
  Command Injection
Command Injection enables an attacker to inject a shell command that is execute with the privileges of the web-server. This can be used to expose sensitive data, or gain access of your server.
  SQL Injection
SQL Injection enables an attacker to execute arbitrary SQL code on your database server gaining access to user data, or manipulating user data.
  XPath Injection
XPath Injection enables an attacker to modify the parts of XML document that are read. If that XML document is for example used for authentication, this can lead to further vulnerabilities similar to SQL Injection.
  LDAP Injection
LDAP Injection enables an attacker to inject LDAP statements potentially granting permission to run unauthorized queries, or modify content inside the LDAP tree.
  Header Injection
  Other Vulnerability
This category comprises other attack vectors such as manipulating the PHP runtime, loading custom extensions, freezing the runtime, or similar.
  Regex Injection
Regex Injection enables an attacker to execute arbitrary code in your PHP process.
  XML Injection
XML Injection enables an attacker to read files on your local filesystem including configuration files, or can be abused to freeze your web-server process.
  Variable Injection
Variable Injection enables an attacker to overwrite program variables with custom data, and can lead to further vulnerabilities.
Unfortunately, the security analysis is currently not available for your project. If you are a non-commercial open-source project, please contact support to gain access.

src/wp-admin/edit-form-advanced.php (3 issues)

Upgrade to new PHP Analysis Engine

These results are based on our legacy PHP analysis, consider migrating to our new PHP analysis engine instead. Learn more

1
<?php
2
/**
3
 * Post advanced form for inclusion in the administration panels.
4
 *
5
 * @package WordPress
6
 * @subpackage Administration
7
 */
8
9
// don't load directly
10
if ( !defined('ABSPATH') )
11
	die('-1');
12
13
/**
14
 * @global string       $post_type
15
 * @global WP_Post_Type $post_type_object
16
 * @global WP_Post      $post
17
 */
18
global $post_type, $post_type_object, $post;
19
20
wp_enqueue_script('post');
21
$_wp_editor_expand = $_content_editor_dfw = false;
22
23
/**
24
 * Filters whether to enable the 'expand' functionality in the post editor.
25
 *
26
 * @since 4.0.0
27
 * @since 4.1.0 Added the `$post_type` parameter.
28
 *
29
 * @param bool   $expand    Whether to enable the 'expand' functionality. Default true.
30
 * @param string $post_type Post type.
31
 */
32
if ( post_type_supports( $post_type, 'editor' ) && ! wp_is_mobile() &&
33
	 ! ( $is_IE && preg_match( '/MSIE [5678]/', $_SERVER['HTTP_USER_AGENT'] ) ) &&
34
	 apply_filters( 'wp_editor_expand', true, $post_type ) ) {
35
36
	wp_enqueue_script('editor-expand');
37
	$_content_editor_dfw = true;
38
	$_wp_editor_expand = ( get_user_setting( 'editor_expand', 'on' ) === 'on' );
39
}
40
41
if ( wp_is_mobile() )
42
	wp_enqueue_script( 'jquery-touch-punch' );
43
44
/**
45
 * Post ID global
46
 * @name $post_ID
47
 * @var int
48
 */
49
$post_ID = isset($post_ID) ? (int) $post_ID : 0;
50
$user_ID = isset($user_ID) ? (int) $user_ID : 0;
51
$action = isset($action) ? $action : '';
52
53
if ( $post_ID == get_option( 'page_for_posts' ) && empty( $post->post_content ) ) {
54
	add_action( 'edit_form_after_title', '_wp_posts_page_notice' );
55
	remove_post_type_support( $post_type, 'editor' );
56
}
57
58
$thumbnail_support = current_theme_supports( 'post-thumbnails', $post_type ) && post_type_supports( $post_type, 'thumbnail' );
59 View Code Duplication
if ( ! $thumbnail_support && 'attachment' === $post_type && $post->post_mime_type ) {
60
	if ( wp_attachment_is( 'audio', $post ) ) {
61
		$thumbnail_support = post_type_supports( 'attachment:audio', 'thumbnail' ) || current_theme_supports( 'post-thumbnails', 'attachment:audio' );
62
	} elseif ( wp_attachment_is( 'video', $post ) ) {
63
		$thumbnail_support = post_type_supports( 'attachment:video', 'thumbnail' ) || current_theme_supports( 'post-thumbnails', 'attachment:video' );
64
	}
65
}
66
67
if ( $thumbnail_support ) {
68
	add_thickbox();
69
	wp_enqueue_media( array( 'post' => $post_ID ) );
70
}
71
72
// Add the local autosave notice HTML
73
add_action( 'admin_footer', '_local_storage_notice' );
74
75
/*
76
 * @todo Document the $messages array(s).
77
 */
78
$permalink = get_permalink( $post_ID );
79
if ( ! $permalink ) {
0 ignored issues
show
Bug Best Practice introduced by
The expression $permalink of type string|false is loosely compared to false; this is ambiguous if the string can be empty. You might want to explicitly use === false instead.

In PHP, under loose comparison (like ==, or !=, or switch conditions), values of different types might be equal.

For string values, the empty string '' is a special case, in particular the following results might be unexpected:

''   == false // true
''   == null  // true
'ab' == false // false
'ab' == null  // false

// It is often better to use strict comparison
'' === false // false
'' === null  // false
Loading history...
80
	$permalink = '';
81
}
82
83
$messages = array();
84
85
$preview_post_link_html = $scheduled_post_link_html = $view_post_link_html = '';
86
$preview_page_link_html = $scheduled_page_link_html = $view_page_link_html = '';
87
88
$preview_url = get_preview_post_link( $post );
89
90
$viewable = is_post_type_viewable( $post_type_object );
91
92
if ( $viewable ) {
93
94
	// Preview post link.
95
	$preview_post_link_html = sprintf( ' <a target="_blank" href="%1$s">%2$s</a>',
96
		esc_url( $preview_url ),
97
		__( 'Preview post' )
98
	);
99
100
	// Scheduled post preview link.
101
	$scheduled_post_link_html = sprintf( ' <a target="_blank" href="%1$s">%2$s</a>',
102
		esc_url( $permalink ),
103
		__( 'Preview post' )
104
	);
105
106
	// View post link.
107
	$view_post_link_html = sprintf( ' <a href="%1$s">%2$s</a>',
108
		esc_url( $permalink ),
109
		__( 'View post' )
110
	);
111
112
	// Preview page link.
113
	$preview_page_link_html = sprintf( ' <a target="_blank" href="%1$s">%2$s</a>',
114
		esc_url( $preview_url ),
115
		__( 'Preview page' )
116
	);
117
118
	// Scheduled page preview link.
119
	$scheduled_page_link_html = sprintf( ' <a target="_blank" href="%1$s">%2$s</a>',
120
		esc_url( $permalink ),
121
		__( 'Preview page' )
122
	);
123
124
	// View page link.
125
	$view_page_link_html = sprintf( ' <a href="%1$s">%2$s</a>',
126
		esc_url( $permalink ),
127
		__( 'View page' )
128
	);
129
130
}
131
132
/* translators: Publish box date format, see https://secure.php.net/date */
133
$scheduled_date = date_i18n( __( 'M j, Y @ H:i' ), strtotime( $post->post_date ) );
134
135
$messages['post'] = array(
136
	 0 => '', // Unused. Messages start at index 1.
137
	 1 => __( 'Post updated.' ) . $view_post_link_html,
138
	 2 => __( 'Custom field updated.' ),
139
	 3 => __( 'Custom field deleted.' ),
140
	 4 => __( 'Post updated.' ),
141
	/* translators: %s: date and time of the revision */
142
	 5 => isset($_GET['revision']) ? sprintf( __( 'Post restored to revision from %s.' ), wp_post_revision_title( (int) $_GET['revision'], false ) ) : false,
143
	 6 => __( 'Post published.' ) . $view_post_link_html,
144
	 7 => __( 'Post saved.' ),
145
	 8 => __( 'Post submitted.' ) . $preview_post_link_html,
146
	 9 => sprintf( __( 'Post scheduled for: %s.' ), '<strong>' . $scheduled_date . '</strong>' ) . $scheduled_post_link_html,
147
	10 => __( 'Post draft updated.' ) . $preview_post_link_html,
148
);
149
$messages['page'] = array(
150
	 0 => '', // Unused. Messages start at index 1.
151
	 1 => __( 'Page updated.' ) . $view_page_link_html,
152
	 2 => __( 'Custom field updated.' ),
153
	 3 => __( 'Custom field deleted.' ),
154
	 4 => __( 'Page updated.' ),
155
	/* translators: %s: date and time of the revision */
156
	 5 => isset($_GET['revision']) ? sprintf( __( 'Page restored to revision from %s.' ), wp_post_revision_title( (int) $_GET['revision'], false ) ) : false,
157
	 6 => __( 'Page published.' ) . $view_page_link_html,
158
	 7 => __( 'Page saved.' ),
159
	 8 => __( 'Page submitted.' ) . $preview_page_link_html,
160
	 9 => sprintf( __( 'Page scheduled for: %s.' ), '<strong>' . $scheduled_date . '</strong>' ) . $scheduled_page_link_html,
161
	10 => __( 'Page draft updated.' ) . $preview_page_link_html,
162
);
163
$messages['attachment'] = array_fill( 1, 10, __( 'Media file updated.' ) ); // Hack, for now.
164
165
/**
166
 * Filters the post updated messages.
167
 *
168
 * @since 3.0.0
169
 *
170
 * @param array $messages Post updated messages. For defaults @see $messages declarations above.
171
 */
172
$messages = apply_filters( 'post_updated_messages', $messages );
173
174
$message = false;
175
if ( isset($_GET['message']) ) {
176
	$_GET['message'] = absint( $_GET['message'] );
177
	if ( isset($messages[$post_type][$_GET['message']]) )
178
		$message = $messages[$post_type][$_GET['message']];
179
	elseif ( !isset($messages[$post_type]) && isset($messages['post'][$_GET['message']]) )
180
		$message = $messages['post'][$_GET['message']];
181
}
182
183
$notice = false;
184
$form_extra = '';
185
if ( 'auto-draft' == $post->post_status ) {
186
	if ( 'edit' == $action )
187
		$post->post_title = '';
188
	$autosave = false;
189
	$form_extra .= "<input type='hidden' id='auto_draft' name='auto_draft' value='1' />";
190
} else {
191
	$autosave = wp_get_post_autosave( $post_ID );
192
}
193
194
$form_action = 'editpost';
195
$nonce_action = 'update-post_' . $post_ID;
196
$form_extra .= "<input type='hidden' id='post_ID' name='post_ID' value='" . esc_attr($post_ID) . "' />";
197
198
// Detect if there exists an autosave newer than the post and if that autosave is different than the post
199
if ( $autosave && mysql2date( 'U', $autosave->post_modified_gmt, false ) > mysql2date( 'U', $post->post_modified_gmt, false ) ) {
200
	foreach ( _wp_post_revision_fields( $post ) as $autosave_field => $_autosave_field ) {
201
		if ( normalize_whitespace( $autosave->$autosave_field ) != normalize_whitespace( $post->$autosave_field ) ) {
202
			$notice = sprintf( __( 'There is an autosave of this post that is more recent than the version below. <a href="%s">View the autosave</a>' ), get_edit_post_link( $autosave->ID ) );
203
			break;
204
		}
205
	}
206
	// If this autosave isn't different from the current post, begone.
207
	if ( ! $notice )
0 ignored issues
show
Bug Best Practice introduced by
The expression $notice of type string|false is loosely compared to false; this is ambiguous if the string can be empty. You might want to explicitly use === false instead.

In PHP, under loose comparison (like ==, or !=, or switch conditions), values of different types might be equal.

For string values, the empty string '' is a special case, in particular the following results might be unexpected:

''   == false // true
''   == null  // true
'ab' == false // false
'ab' == null  // false

// It is often better to use strict comparison
'' === false // false
'' === null  // false
Loading history...
208
		wp_delete_post_revision( $autosave->ID );
209
	unset($autosave_field, $_autosave_field);
210
}
211
212
$post_type_object = get_post_type_object($post_type);
213
214
// All meta boxes should be defined and added before the first do_meta_boxes() call (or potentially during the do_meta_boxes action).
215
require_once( ABSPATH . 'wp-admin/includes/meta-boxes.php' );
216
217
218
$publish_callback_args = null;
219
if ( post_type_supports($post_type, 'revisions') && 'auto-draft' != $post->post_status ) {
220
	$revisions = wp_get_post_revisions( $post_ID );
221
222
	// We should aim to show the revisions meta box only when there are revisions.
223
	if ( count( $revisions ) > 1 ) {
224
		reset( $revisions ); // Reset pointer for key()
225
		$publish_callback_args = array( 'revisions_count' => count( $revisions ), 'revision_id' => key( $revisions ) );
226
		add_meta_box('revisionsdiv', __('Revisions'), 'post_revisions_meta_box', null, 'normal', 'core');
227
	}
228
}
229
230
if ( 'attachment' == $post_type ) {
231
	wp_enqueue_script( 'image-edit' );
232
	wp_enqueue_style( 'imgareaselect' );
233
	add_meta_box( 'submitdiv', __('Save'), 'attachment_submit_meta_box', null, 'side', 'core' );
234
	add_action( 'edit_form_after_title', 'edit_form_image_editor' );
235
236
	if ( wp_attachment_is( 'audio', $post ) ) {
237
		add_meta_box( 'attachment-id3', __( 'Metadata' ), 'attachment_id3_data_meta_box', null, 'normal', 'core' );
238
	}
239
} else {
240
	add_meta_box( 'submitdiv', __( 'Publish' ), 'post_submit_meta_box', null, 'side', 'core', $publish_callback_args );
241
}
242
243
if ( current_theme_supports( 'post-formats' ) && post_type_supports( $post_type, 'post-formats' ) )
244
	add_meta_box( 'formatdiv', _x( 'Format', 'post format' ), 'post_format_meta_box', null, 'side', 'core' );
245
246
// all taxonomies
247
foreach ( get_object_taxonomies( $post ) as $tax_name ) {
248
	$taxonomy = get_taxonomy( $tax_name );
249
	if ( ! $taxonomy->show_ui || false === $taxonomy->meta_box_cb )
250
		continue;
251
252
	$label = $taxonomy->labels->name;
253
254
	if ( ! is_taxonomy_hierarchical( $tax_name ) )
255
		$tax_meta_box_id = 'tagsdiv-' . $tax_name;
256
	else
257
		$tax_meta_box_id = $tax_name . 'div';
258
259
	add_meta_box( $tax_meta_box_id, $label, $taxonomy->meta_box_cb, null, 'side', 'core', array( 'taxonomy' => $tax_name ) );
260
}
261
262
if ( post_type_supports( $post_type, 'page-attributes' ) || count( get_page_templates( $post ) ) > 0 ) {
263
	add_meta_box( 'pageparentdiv', $post_type_object->labels->attributes, 'page_attributes_meta_box', null, 'side', 'core' );
264
}
265
266
if ( $thumbnail_support && current_user_can( 'upload_files' ) )
267
	add_meta_box('postimagediv', esc_html( $post_type_object->labels->featured_image ), 'post_thumbnail_meta_box', null, 'side', 'low');
268
269
if ( post_type_supports($post_type, 'excerpt') )
270
	add_meta_box('postexcerpt', __('Excerpt'), 'post_excerpt_meta_box', null, 'normal', 'core');
271
272
if ( post_type_supports($post_type, 'trackbacks') )
273
	add_meta_box('trackbacksdiv', __('Send Trackbacks'), 'post_trackback_meta_box', null, 'normal', 'core');
274
275
if ( post_type_supports($post_type, 'custom-fields') )
276
	add_meta_box('postcustom', __('Custom Fields'), 'post_custom_meta_box', null, 'normal', 'core');
277
278
/**
279
 * Fires in the middle of built-in meta box registration.
280
 *
281
 * @since 2.1.0
282
 * @deprecated 3.7.0 Use 'add_meta_boxes' instead.
283
 *
284
 * @param WP_Post $post Post object.
285
 */
286
do_action( 'dbx_post_advanced', $post );
287
288
// Allow the Discussion meta box to show up if the post type supports comments,
289
// or if comments or pings are open.
290 View Code Duplication
if ( comments_open( $post ) || pings_open( $post ) || post_type_supports( $post_type, 'comments' ) ) {
291
	add_meta_box( 'commentstatusdiv', __( 'Discussion' ), 'post_comment_status_meta_box', null, 'normal', 'core' );
292
}
293
294
$stati = get_post_stati( array( 'public' => true ) );
295
if ( empty( $stati ) ) {
296
	$stati = array( 'publish' );
297
}
298
$stati[] = 'private';
299
300
if ( in_array( get_post_status( $post ), $stati ) ) {
301
	// If the post type support comments, or the post has comments, allow the
302
	// Comments meta box.
303 View Code Duplication
	if ( comments_open( $post ) || pings_open( $post ) || $post->comment_count > 0 || post_type_supports( $post_type, 'comments' ) ) {
304
		add_meta_box( 'commentsdiv', __( 'Comments' ), 'post_comment_meta_box', null, 'normal', 'core' );
305
	}
306
}
307
308 View Code Duplication
if ( ! ( 'pending' == get_post_status( $post ) && ! current_user_can( $post_type_object->cap->publish_posts ) ) )
309
	add_meta_box('slugdiv', __('Slug'), 'post_slug_meta_box', null, 'normal', 'core');
310
311 View Code Duplication
if ( post_type_supports( $post_type, 'author' ) && current_user_can( $post_type_object->cap->edit_others_posts ) ) {
312
	add_meta_box( 'authordiv', __( 'Author' ), 'post_author_meta_box', null, 'normal', 'core' );
313
}
314
315
/**
316
 * Fires after all built-in meta boxes have been added.
317
 *
318
 * @since 3.0.0
319
 *
320
 * @param string  $post_type Post type.
321
 * @param WP_Post $post      Post object.
322
 */
323
do_action( 'add_meta_boxes', $post_type, $post );
324
325
/**
326
 * Fires after all built-in meta boxes have been added, contextually for the given post type.
327
 *
328
 * The dynamic portion of the hook, `$post_type`, refers to the post type of the post.
329
 *
330
 * @since 3.0.0
331
 *
332
 * @param WP_Post $post Post object.
333
 */
334
do_action( "add_meta_boxes_{$post_type}", $post );
335
336
/**
337
 * Fires after meta boxes have been added.
338
 *
339
 * Fires once for each of the default meta box contexts: normal, advanced, and side.
340
 *
341
 * @since 3.0.0
342
 *
343
 * @param string  $post_type Post type of the post.
344
 * @param string  $context   string  Meta box context.
345
 * @param WP_Post $post      Post object.
346
 */
347
do_action( 'do_meta_boxes', $post_type, 'normal', $post );
348
/** This action is documented in wp-admin/edit-form-advanced.php */
349
do_action( 'do_meta_boxes', $post_type, 'advanced', $post );
350
/** This action is documented in wp-admin/edit-form-advanced.php */
351
do_action( 'do_meta_boxes', $post_type, 'side', $post );
352
353
add_screen_option('layout_columns', array('max' => 2, 'default' => 2) );
354
355
if ( 'post' == $post_type ) {
356
	$customize_display = '<p>' . __('The title field and the big Post Editing Area are fixed in place, but you can reposition all the other boxes using drag and drop. You can also minimize or expand them by clicking the title bar of each box. Use the Screen Options tab to unhide more boxes (Excerpt, Send Trackbacks, Custom Fields, Discussion, Slug, Author) or to choose a 1- or 2-column layout for this screen.') . '</p>';
357
358
	get_current_screen()->add_help_tab( array(
359
		'id'      => 'customize-display',
360
		'title'   => __('Customizing This Display'),
361
		'content' => $customize_display,
362
	) );
363
364
	$title_and_editor  = '<p>' . __('<strong>Title</strong> &mdash; Enter a title for your post. After you enter a title, you&#8217;ll see the permalink below, which you can edit.') . '</p>';
365
	$title_and_editor .= '<p>' . __( '<strong>Post editor</strong> &mdash; Enter the text for your post. There are two modes of editing: Visual and Text. Choose the mode by clicking on the appropriate tab.' ) . '</p>';
366
	$title_and_editor .= '<p>' . __( 'Visual mode gives you an editor that is similar to a word processor. Click the Toolbar Toggle button to get a second row of controls.' ) . '</p>';
367
	$title_and_editor .= '<p>' . __( 'The Text mode allows you to enter HTML along with your post text. Note that &lt;p&gt; and &lt;br&gt; tags are converted to line breaks when switching to the Text editor to make it less cluttered. When you type, a single line break can be used instead of typing &lt;br&gt;, and two line breaks instead of paragraph tags. The line breaks are converted back to tags automatically.' ) . '</p>';
368
	$title_and_editor .= '<p>' . __( 'You can insert media files by clicking the icons above the post editor and following the directions. You can align or edit images using the inline formatting toolbar available in Visual mode.' ) . '</p>';
369
	$title_and_editor .= '<p>' . __( 'You can enable distraction-free writing mode using the icon to the right. This feature is not available for old browsers or devices with small screens, and requires that the full-height editor be enabled in Screen Options.' ) . '</p>';
370
	$title_and_editor .= '<p>' . __( 'Keyboard users: When you&#8217;re working in the visual editor, you can use <kbd>Alt + F10</kbd> to access the toolbar.' ) . '</p>';
371
372
	get_current_screen()->add_help_tab( array(
373
		'id'      => 'title-post-editor',
374
		'title'   => __('Title and Post Editor'),
375
		'content' => $title_and_editor,
376
	) );
377
378
	get_current_screen()->set_help_sidebar(
379
			'<p>' . sprintf(__('You can also create posts with the <a href="%s">Press This bookmarklet</a>.'), 'tools.php') . '</p>' .
380
			'<p><strong>' . __('For more information:') . '</strong></p>' .
381
			'<p>' . __('<a href="https://codex.wordpress.org/Posts_Add_New_Screen">Documentation on Writing and Editing Posts</a>') . '</p>' .
382
			'<p>' . __('<a href="https://wordpress.org/support/">Support Forums</a>') . '</p>'
383
	);
384
} elseif ( 'page' == $post_type ) {
385
	$about_pages = '<p>' . __('Pages are similar to posts in that they have a title, body text, and associated metadata, but they are different in that they are not part of the chronological blog stream, kind of like permanent posts. Pages are not categorized or tagged, but can have a hierarchy. You can nest pages under other pages by making one the &#8220;Parent&#8221; of the other, creating a group of pages.') . '</p>' .
386
		'<p>' . __('Creating a Page is very similar to creating a Post, and the screens can be customized in the same way using drag and drop, the Screen Options tab, and expanding/collapsing boxes as you choose. This screen also has the distraction-free writing space, available in both the Visual and Text modes via the Fullscreen buttons. The Page editor mostly works the same as the Post editor, but there are some Page-specific features in the Page Attributes box.') . '</p>';
387
388
	get_current_screen()->add_help_tab( array(
389
		'id'      => 'about-pages',
390
		'title'   => __('About Pages'),
391
		'content' => $about_pages,
392
	) );
393
394
	get_current_screen()->set_help_sidebar(
395
			'<p><strong>' . __('For more information:') . '</strong></p>' .
396
			'<p>' . __('<a href="https://codex.wordpress.org/Pages_Add_New_Screen">Documentation on Adding New Pages</a>') . '</p>' .
397
			'<p>' . __('<a href="https://codex.wordpress.org/Pages_Screen#Editing_Individual_Pages">Documentation on Editing Pages</a>') . '</p>' .
398
			'<p>' . __('<a href="https://wordpress.org/support/">Support Forums</a>') . '</p>'
399
	);
400
} elseif ( 'attachment' == $post_type ) {
401
	get_current_screen()->add_help_tab( array(
402
		'id'      => 'overview',
403
		'title'   => __('Overview'),
404
		'content' =>
405
			'<p>' . __('This screen allows you to edit four fields for metadata in a file within the media library.') . '</p>' .
406
			'<p>' . __('For images only, you can click on Edit Image under the thumbnail to expand out an inline image editor with icons for cropping, rotating, or flipping the image as well as for undoing and redoing. The boxes on the right give you more options for scaling the image, for cropping it, and for cropping the thumbnail in a different way than you crop the original image. You can click on Help in those boxes to get more information.') . '</p>' .
407
			'<p>' . __('Note that you crop the image by clicking on it (the Crop icon is already selected) and dragging the cropping frame to select the desired part. Then click Save to retain the cropping.') . '</p>' .
408
			'<p>' . __('Remember to click Update Media to save metadata entered or changed.') . '</p>'
409
	) );
410
411
	get_current_screen()->set_help_sidebar(
412
	'<p><strong>' . __('For more information:') . '</strong></p>' .
413
	'<p>' . __('<a href="https://codex.wordpress.org/Media_Add_New_Screen#Edit_Media">Documentation on Edit Media</a>') . '</p>' .
414
	'<p>' . __('<a href="https://wordpress.org/support/">Support Forums</a>') . '</p>'
415
	);
416
}
417
418
if ( 'post' == $post_type || 'page' == $post_type ) {
419
	$inserting_media = '<p>' . __( 'You can upload and insert media (images, audio, documents, etc.) by clicking the Add Media button. You can select from the images and files already uploaded to the Media Library, or upload new media to add to your page or post. To create an image gallery, select the images to add and click the &#8220;Create a new gallery&#8221; button.' ) . '</p>';
420
	$inserting_media .= '<p>' . __( 'You can also embed media from many popular websites including Twitter, YouTube, Flickr and others by pasting the media URL on its own line into the content of your post/page. Please refer to the Codex to <a href="https://codex.wordpress.org/Embeds">learn more about embeds</a>.' ) . '</p>';
421
422
	get_current_screen()->add_help_tab( array(
423
		'id'		=> 'inserting-media',
424
		'title'		=> __( 'Inserting Media' ),
425
		'content' 	=> $inserting_media,
426
	) );
427
}
428
429
if ( 'post' == $post_type ) {
430
	$publish_box = '<p>' . __('Several boxes on this screen contain settings for how your content will be published, including:') . '</p>';
431
	$publish_box .= '<ul><li>' .
432
		__( '<strong>Publish</strong> &mdash; You can set the terms of publishing your post in the Publish box. For Status, Visibility, and Publish (immediately), click on the Edit link to reveal more options. Visibility includes options for password-protecting a post or making it stay at the top of your blog indefinitely (sticky). The Password protected option allows you to set an arbitrary password for each post. The Private option hides the post from everyone except editors and administrators. Publish (immediately) allows you to set a future or past date and time, so you can schedule a post to be published in the future or backdate a post.' ) .
433
	'</li>';
434
435
	if ( current_theme_supports( 'post-formats' ) && post_type_supports( 'post', 'post-formats' ) ) {
436
		$publish_box .= '<li>' . __( '<strong>Format</strong> &mdash; Post Formats designate how your theme will display a specific post. For example, you could have a <em>standard</em> blog post with a title and paragraphs, or a short <em>aside</em> that omits the title and contains a short text blurb. Please refer to the Codex for <a href="https://codex.wordpress.org/Post_Formats#Supported_Formats">descriptions of each post format</a>. Your theme could enable all or some of 10 possible formats.' ) . '</li>';
437
	}
438
439
	if ( current_theme_supports( 'post-thumbnails' ) && post_type_supports( 'post', 'thumbnail' ) ) {
440
		/* translators: %s: Featured Image */
441
		$publish_box .= '<li>' . sprintf( __( '<strong>%s</strong> &mdash; This allows you to associate an image with your post without inserting it. This is usually useful only if your theme makes use of the image as a post thumbnail on the home page, a custom header, etc.' ), esc_html( $post_type_object->labels->featured_image ) ) . '</li>';
442
	}
443
444
	$publish_box .= '</ul>';
445
446
	get_current_screen()->add_help_tab( array(
447
		'id'      => 'publish-box',
448
		'title'   => __('Publish Settings'),
449
		'content' => $publish_box,
450
	) );
451
452
	$discussion_settings  = '<p>' . __('<strong>Send Trackbacks</strong> &mdash; Trackbacks are a way to notify legacy blog systems that you&#8217;ve linked to them. Enter the URL(s) you want to send trackbacks. If you link to other WordPress sites they&#8217;ll be notified automatically using pingbacks, and this field is unnecessary.') . '</p>';
453
	$discussion_settings .= '<p>' . __('<strong>Discussion</strong> &mdash; You can turn comments and pings on or off, and if there are comments on the post, you can see them here and moderate them.') . '</p>';
454
455
	get_current_screen()->add_help_tab( array(
456
		'id'      => 'discussion-settings',
457
		'title'   => __('Discussion Settings'),
458
		'content' => $discussion_settings,
459
	) );
460
} elseif ( 'page' == $post_type ) {
461
	$page_attributes = '<p>' . __('<strong>Parent</strong> &mdash; You can arrange your pages in hierarchies. For example, you could have an &#8220;About&#8221; page that has &#8220;Life Story&#8221; and &#8220;My Dog&#8221; pages under it. There are no limits to how many levels you can nest pages.') . '</p>' .
462
		'<p>' . __('<strong>Template</strong> &mdash; Some themes have custom templates you can use for certain pages that might have additional features or custom layouts. If so, you&#8217;ll see them in this dropdown menu.') . '</p>' .
463
		'<p>' . __('<strong>Order</strong> &mdash; Pages are usually ordered alphabetically, but you can choose your own order by entering a number (1 for first, etc.) in this field.') . '</p>';
464
465
	get_current_screen()->add_help_tab( array(
466
		'id' => 'page-attributes',
467
		'title' => __('Page Attributes'),
468
		'content' => $page_attributes,
469
	) );
470
}
471
472
require_once( ABSPATH . 'wp-admin/admin-header.php' );
473
?>
474
475
<div class="wrap">
476
<h1 class="wp-heading-inline"><?php
477
echo esc_html( $title );
478
?></h1>
479
480
<?php
481 View Code Duplication
if ( isset( $post_new_file ) && current_user_can( $post_type_object->cap->create_posts ) ) {
482
	echo ' <a href="' . esc_url( admin_url( $post_new_file ) ) . '" class="page-title-action">' . esc_html( $post_type_object->labels->add_new ) . '</a>';
483
}
484
?>
485
486
<hr class="wp-header-end">
487
488
<?php if ( $notice ) : ?>
0 ignored issues
show
Bug Best Practice introduced by
The expression $notice of type string|false is loosely compared to true; this is ambiguous if the string can be empty. You might want to explicitly use !== false instead.

In PHP, under loose comparison (like ==, or !=, or switch conditions), values of different types might be equal.

For string values, the empty string '' is a special case, in particular the following results might be unexpected:

''   == false // true
''   == null  // true
'ab' == false // false
'ab' == null  // false

// It is often better to use strict comparison
'' === false // false
'' === null  // false
Loading history...
489
<div id="notice" class="notice notice-warning"><p id="has-newer-autosave"><?php echo $notice ?></p></div>
490
<?php endif; ?>
491
<?php if ( $message ) : ?>
492
<div id="message" class="updated notice notice-success is-dismissible"><p><?php echo $message; ?></p></div>
493
<?php endif; ?>
494
<div id="lost-connection-notice" class="error hidden">
495
	<p><span class="spinner"></span> <?php _e( '<strong>Connection lost.</strong> Saving has been disabled until you&#8217;re reconnected.' ); ?>
496
	<span class="hide-if-no-sessionstorage"><?php _e( 'We&#8217;re backing up this post in your browser, just in case.' ); ?></span>
497
	</p>
498
</div>
499
<form name="post" action="post.php" method="post" id="post"<?php
500
/**
501
 * Fires inside the post editor form tag.
502
 *
503
 * @since 3.0.0
504
 *
505
 * @param WP_Post $post Post object.
506
 */
507
do_action( 'post_edit_form_tag', $post );
508
509
$referer = wp_get_referer();
510
?>>
511
<?php wp_nonce_field($nonce_action); ?>
512
<input type="hidden" id="user-id" name="user_ID" value="<?php echo (int) $user_ID ?>" />
513
<input type="hidden" id="hiddenaction" name="action" value="<?php echo esc_attr( $form_action ) ?>" />
514
<input type="hidden" id="originalaction" name="originalaction" value="<?php echo esc_attr( $form_action ) ?>" />
515
<input type="hidden" id="post_author" name="post_author" value="<?php echo esc_attr( $post->post_author ); ?>" />
516
<input type="hidden" id="post_type" name="post_type" value="<?php echo esc_attr( $post_type ) ?>" />
517
<input type="hidden" id="original_post_status" name="original_post_status" value="<?php echo esc_attr( $post->post_status) ?>" />
518
<input type="hidden" id="referredby" name="referredby" value="<?php echo $referer ? esc_url( $referer ) : ''; ?>" />
519
<?php if ( ! empty( $active_post_lock ) ) { ?>
520
<input type="hidden" id="active_post_lock" value="<?php echo esc_attr( implode( ':', $active_post_lock ) ); ?>" />
521
<?php
522
}
523
if ( 'draft' != get_post_status( $post ) )
524
	wp_original_referer_field(true, 'previous');
525
526
echo $form_extra;
527
528
wp_nonce_field( 'meta-box-order', 'meta-box-order-nonce', false );
529
wp_nonce_field( 'closedpostboxes', 'closedpostboxesnonce', false );
530
?>
531
532
<?php
533
/**
534
 * Fires at the beginning of the edit form.
535
 *
536
 * At this point, the required hidden fields and nonces have already been output.
537
 *
538
 * @since 3.7.0
539
 *
540
 * @param WP_Post $post Post object.
541
 */
542
do_action( 'edit_form_top', $post ); ?>
543
544
<div id="poststuff">
545
<div id="post-body" class="metabox-holder columns-<?php echo 1 == get_current_screen()->get_columns() ? '1' : '2'; ?>">
546
<div id="post-body-content">
547
548
<?php if ( post_type_supports($post_type, 'title') ) { ?>
549
<div id="titlediv">
550
<div id="titlewrap">
551
	<?php
552
	/**
553
	 * Filters the title field placeholder text.
554
	 *
555
	 * @since 3.1.0
556
	 *
557
	 * @param string  $text Placeholder text. Default 'Enter title here'.
558
	 * @param WP_Post $post Post object.
559
	 */
560
	$title_placeholder = apply_filters( 'enter_title_here', __( 'Enter title here' ), $post );
561
	?>
562
	<label class="screen-reader-text" id="title-prompt-text" for="title"><?php echo $title_placeholder; ?></label>
563
	<input type="text" name="post_title" size="30" value="<?php echo esc_attr( $post->post_title ); ?>" id="title" spellcheck="true" autocomplete="off" />
564
</div>
565
<?php
566
/**
567
 * Fires before the permalink field in the edit form.
568
 *
569
 * @since 4.1.0
570
 *
571
 * @param WP_Post $post Post object.
572
 */
573
do_action( 'edit_form_before_permalink', $post );
574
?>
575
<div class="inside">
576
<?php
577
if ( $viewable ) :
578
$sample_permalink_html = $post_type_object->public ? get_sample_permalink_html($post->ID) : '';
579
580
// As of 4.4, the Get Shortlink button is hidden by default.
581
if ( has_filter( 'pre_get_shortlink' ) || has_filter( 'get_shortlink' ) ) {
582
	$shortlink = wp_get_shortlink($post->ID, 'post');
583
584
	if ( !empty( $shortlink ) && $shortlink !== $permalink && $permalink !== home_url('?page_id=' . $post->ID) ) {
585
		$sample_permalink_html .= '<input id="shortlink" type="hidden" value="' . esc_attr( $shortlink ) . '" /><button type="button" class="button button-small" onclick="prompt(&#39;URL:&#39;, jQuery(\'#shortlink\').val());">' . __( 'Get Shortlink' ) . '</button>';
586
	}
587
}
588
589
if ( $post_type_object->public && ! ( 'pending' == get_post_status( $post ) && !current_user_can( $post_type_object->cap->publish_posts ) ) ) {
590
	$has_sample_permalink = $sample_permalink_html && 'auto-draft' != $post->post_status;
591
?>
592
	<div id="edit-slug-box" class="hide-if-no-js">
593
	<?php
594
		if ( $has_sample_permalink )
595
			echo $sample_permalink_html;
596
	?>
597
	</div>
598
<?php
599
}
600
endif;
601
?>
602
</div>
603
<?php
604
wp_nonce_field( 'samplepermalink', 'samplepermalinknonce', false );
605
?>
606
</div><!-- /titlediv -->
607
<?php
608
}
609
/**
610
 * Fires after the title field.
611
 *
612
 * @since 3.5.0
613
 *
614
 * @param WP_Post $post Post object.
615
 */
616
do_action( 'edit_form_after_title', $post );
617
618
if ( post_type_supports($post_type, 'editor') ) {
619
?>
620
<div id="postdivrich" class="postarea<?php if ( $_wp_editor_expand ) { echo ' wp-editor-expand'; } ?>">
621
622
<?php wp_editor( $post->post_content, 'content', array(
623
	'_content_editor_dfw' => $_content_editor_dfw,
624
	'drag_drop_upload' => true,
625
	'tabfocus_elements' => 'content-html,save-post',
626
	'editor_height' => 300,
627
	'tinymce' => array(
628
		'resize' => false,
629
		'wp_autoresize_on' => $_wp_editor_expand,
630
		'add_unload_trigger' => false,
631
	),
632
) ); ?>
633
<table id="post-status-info"><tbody><tr>
634
	<td id="wp-word-count" class="hide-if-no-js"><?php printf( __( 'Word count: %s' ), '<span class="word-count">0</span>' ); ?></td>
635
	<td class="autosave-info">
636
	<span class="autosave-message">&nbsp;</span>
637
<?php
638
	if ( 'auto-draft' != $post->post_status ) {
639
		echo '<span id="last-edit">';
640
		if ( $last_user = get_userdata( get_post_meta( $post_ID, '_edit_last', true ) ) ) {
641
			/* translators: 1: Name of most recent post author, 2: Post edited date, 3: Post edited time */
642
			printf( __( 'Last edited by %1$s on %2$s at %3$s' ), esc_html( $last_user->display_name ), mysql2date( __( 'F j, Y' ), $post->post_modified ), mysql2date( __( 'g:i a' ), $post->post_modified ) );
643
		} else {
644
			/* translators: 1: Post edited date, 2: Post edited time */
645
			printf( __( 'Last edited on %1$s at %2$s' ), mysql2date( __( 'F j, Y' ), $post->post_modified ), mysql2date( __( 'g:i a' ), $post->post_modified ) );
646
		}
647
		echo '</span>';
648
	} ?>
649
	</td>
650
	<td id="content-resize-handle" class="hide-if-no-js"><br /></td>
651
</tr></tbody></table>
652
653
</div>
654
<?php }
655
/**
656
 * Fires after the content editor.
657
 *
658
 * @since 3.5.0
659
 *
660
 * @param WP_Post $post Post object.
661
 */
662
do_action( 'edit_form_after_editor', $post );
663
?>
664
</div><!-- /post-body-content -->
665
666
<div id="postbox-container-1" class="postbox-container">
667
<?php
668
669
if ( 'page' == $post_type ) {
670
	/**
671
	 * Fires before meta boxes with 'side' context are output for the 'page' post type.
672
	 *
673
	 * The submitpage box is a meta box with 'side' context, so this hook fires just before it is output.
674
	 *
675
	 * @since 2.5.0
676
	 *
677
	 * @param WP_Post $post Post object.
678
	 */
679
	do_action( 'submitpage_box', $post );
680
}
681
else {
682
	/**
683
	 * Fires before meta boxes with 'side' context are output for all post types other than 'page'.
684
	 *
685
	 * The submitpost box is a meta box with 'side' context, so this hook fires just before it is output.
686
	 *
687
	 * @since 2.5.0
688
	 *
689
	 * @param WP_Post $post Post object.
690
	 */
691
	do_action( 'submitpost_box', $post );
692
}
693
694
695
do_meta_boxes($post_type, 'side', $post);
696
697
?>
698
</div>
699
<div id="postbox-container-2" class="postbox-container">
700
<?php
701
702
do_meta_boxes(null, 'normal', $post);
703
704
if ( 'page' == $post_type ) {
705
	/**
706
	 * Fires after 'normal' context meta boxes have been output for the 'page' post type.
707
	 *
708
	 * @since 1.5.0
709
	 *
710
	 * @param WP_Post $post Post object.
711
	 */
712
	do_action( 'edit_page_form', $post );
713
}
714
else {
715
	/**
716
	 * Fires after 'normal' context meta boxes have been output for all post types other than 'page'.
717
	 *
718
	 * @since 1.5.0
719
	 *
720
	 * @param WP_Post $post Post object.
721
	 */
722
	do_action( 'edit_form_advanced', $post );
723
}
724
725
726
do_meta_boxes(null, 'advanced', $post);
727
728
?>
729
</div>
730
<?php
731
/**
732
 * Fires after all meta box sections have been output, before the closing #post-body div.
733
 *
734
 * @since 2.1.0
735
 *
736
 * @param WP_Post $post Post object.
737
 */
738
do_action( 'dbx_post_sidebar', $post );
739
740
?>
741
</div><!-- /post-body -->
742
<br class="clear" />
743
</div><!-- /poststuff -->
744
</form>
745
</div>
746
747
<?php
748
if ( post_type_supports( $post_type, 'comments' ) )
749
	wp_comment_reply();
750
?>
751
752
<?php if ( ! wp_is_mobile() && post_type_supports( $post_type, 'title' ) && '' === $post->post_title ) : ?>
753
<script type="text/javascript">
754
try{document.post.title.focus();}catch(e){}
755
</script>
756
<?php endif; ?>
757