posts deleted without prompting for confirmation

onclick=”return deleteSomething…

do you have javascript disabled in your browser?

umm, i have checked my Internet Explorer and Firefox browsers. both have javascript enabled.

i did some tests, wordpress 2.0 is having problems with posts that contain the straight quote mark/apostrophe in their post titles.

*note:: anpersand-hex refers to &#
i could not display the actual code as it got rendered into the actual character.

the straight quote mark/apostrophe in html code is anpersand-hex39;

post titles containing other html codes like anpersand-hex145; (left curly quote mark) or anpersand-hex149; (bullet) still display the confirmation dialog properly.

can the developers please take alook at this issue? or is there another place i can post this to bring it to their attention?

thanks =)

anyone able to help?
thanks =)

just discovered the same problem. im grateful for the above investigation, it’s dead on – the straigt quote (apostrophe) breaks the javascript, causing the post to be deleted with no confirmation.

very dangerous, as the “delete” link can very easily be accidentally clicked.

(i also discoved that the WP database actually deletes “deleted” rows – this is bad design in my opinion. they should just be updated to a status of “deleted,” or archived to a separate table)

i’m kinda new to WP – is this a community developed app? if not (even if so) is there a place where i can see open issues? i’ll look at the code tomorrow to fix the problem, but would like to first be sure that no one else is working on it.

This has already been fixed, at least in WordPress 2.0.2. It replaces the single quotes with & #039; to avoid the problem.

But yeah, you still need Javascript on.

i have 2.0.2. here’s a cut and paste from the footer: “2.0.2 — 0.24 seconds”

believe me, the problem still exists in 2.0.2. — i get a popup confirmation for all posts except for the posts with an apostrophe in the title.

why do you say that the problem was fixed? can you point me to some sort of bug tracking system?

why do you say that the problem was fixed?

Are you freakin’ kidding me? Because I can click on the “Delete” and get the confirmation popup. On ALL posts, including those with single quote marks (aka apostrophes).

can you point me to some sort of bug tracking system?

https://trac.www.ads-software.com

But I can *show* you where the relevant code is:

wp-admin/edit.php, line 213. It’s a long line, but it contains this bit of code: js_escape(get_the_title())

That function is in wp-includes/functions-formatting.php, line 1019. It makes a call to wp_specialchars() to clean up a lot of stuff. wp_specialchars is in the same file, line 99. One of the things it does:
$text = str_replace(“‘”, ‘& #039;’, $text);

That line removes the apostrophes and replaces them. So the problem with the single quotes in the javascript: Fixed. Look at the source of the Manage page. The javascript is clear, and that’s where the problem mentioned above was.

If you’re not getting popups, then you have javascript disabled. Turn javascript back on.

Are you freakin’ kidding me? Because I can click on the “Delete” and get the confirmation popup. On ALL posts, including those with single quote marks (aka apostrophes).

“are you freakin’ kidding me?” as my post clearly states, I get the popups for all posts EXCEPT for the ones with the apostrophe. as my post clearly states, i have version 2.0.2. therefore, javascript is CLEARLY TURNED ON, and the problem IS NOT FIXED in 2.0.2.

my god, i don’t know what your problem is, but i didn’t ask to be talked down to by you. all i did was report a problem, ask where i could find more information, and let you know that youre giving out bad information, because it ISNT fixed in 2.0.2.

the code you refer to doesn’t even exist in 2.0.2, genius. perhaps you meant to say that it was fixed in 2.0.3?

dumbass.

my god, i don’t know what your problem is, but i didn’t ask to be talked down to by you.

I really was not trying to talk down to you, I just thought your question was silly. Sorry if you misunderstood.

I was able to get it to happen on 2.0.2 just now, by making a new post with a single quote in it. It still doesn’t work on some other posts I have with single quotes in them. I don’t know what the difference is yet.