<?xml version="1.0" encoding="UTF-8"?><!-- generator="wordpress.com" -->
<rss version="2.0"
	xmlns:content="http://purl.org/rss/1.0/modules/content/"
	xmlns:wfw="http://wellformedweb.org/CommentAPI/"
	xmlns:dc="http://purl.org/dc/elements/1.1/"
	>

<channel>
	<title>custom-fields &amp;laquo; WordPress.com Tag Feed</title>
	<link>http://wordpress.com/tag/custom-fields/</link>
	<description>Feed of posts on WordPress.com tagged "custom-fields"</description>
	<pubDate>Mon, 08 Sep 2008 14:07:38 +0000</pubDate>

	<generator>http://wordpress.com/tags/</generator>
	<language>en</language>

<item>
<title><![CDATA[Campos Personalizados en Project Server 2007]]></title>
<link>http://terum.wordpress.com/?p=8</link>
<pubDate>Fri, 11 Apr 2008 19:41:22 +0000</pubDate>
<dc:creator>terum</dc:creator>
<guid>http://terum.wordpress.com/?p=8</guid>
<description><![CDATA[Al crear campos personalizados tanto desde PWA como desde Project Professional he tenido problemas e]]></description>
<content:encoded><![CDATA[<p>Al crear campos personalizados tanto desde PWA como desde Project Professional he tenido problemas en el momento de validar las fórmulas de los mismos.</p>
<p>En algunos casos si las fórmulas las había introducido desde PWA luego Project Prfessional no me las mostraba.</p>
<p>El problema se ha solucionado al instalar el SP1 de Project Professional.</p>
<p>Luego postearé, la forma que tenemos de subir Enterprise Custom Fields.</p>
]]></content:encoded>
</item>
<item>
<title><![CDATA[Custom Field price calculation]]></title>
<link>http://webreserv.wordpress.com/?p=71</link>
<pubDate>Thu, 27 Mar 2008 15:25:00 +0000</pubDate>
<dc:creator>webreserv</dc:creator>
<guid>http://webreserv.wordpress.com/?p=71</guid>
<description><![CDATA[You probably already knew that you can add a price to a custom fields and use the custom field to ch]]></description>
<content:encoded><![CDATA[<p>You probably already knew that you can add a price to a custom fields and use the custom field to charge for additional items, for example, extra equipment or catering. Starting with the latest release of WebReserv.com you, you can now specify the time basis for such charges.</p>
<p>To set up your custom field charges, go to <strong>Setup – Custom Fields</strong>.</p>
<p><a href="http://webreserv.files.wordpress.com/2008/05/custom-field-prices.jpg"><img class="alignnone size-medium wp-image-79" src="http://webreserv.wordpress.com/files/2008/05/custom-field-prices.jpg?w=300" alt="Custom Field Price Settings" width="300" height="139" /></a></p>
<p>If the price for an add-on charge is for the entire reservation, simply leave the time setting at 0. If the price depends on the length of the reservation, select the time frame that the price is for.</p>
<p>Say for example that the charge for DVD player is $15 per day, enter <em>1</em> in the time field and select <em>day(s)</em>. Now the price will automatically be calculated based on the length of the reservation.</p>
<p> </p>
]]></content:encoded>
</item>
<item>
<title><![CDATA[Authorization and intention/origination verification when using the edit_post hook]]></title>
<link>http://markjaquith.wordpress.com/2007/01/28/authorization-and-intentionorigination-verification-when-using-the-edit_post-hook/</link>
<pubDate>Sun, 28 Jan 2007 05:32:48 +0000</pubDate>
<dc:creator>Mark Jaquith</dc:creator>
<guid>http://markjaquith.wordpress.com/2007/01/28/authorization-and-intentionorigination-verification-when-using-the-edit_post-hook/</guid>
<description><![CDATA[There have been reports of plugins that have started erasing their managed Custom Fields upon action]]></description>
<content:encoded><![CDATA[<p>There have been reports of plugins that have started erasing their managed Custom Fields upon actions like comment submission.  <a href="http://www.neato.co.nz/archives/2007/01/17/ultimate-tag-warrior-31415926/">UTW</a> was <a href="http://ocaoimh.ie/2007/01/23/the-new-wp-utw-gotcha/">bitten</a>, as was  Jerome's Keywords and <a href="http://wordpress.org/support/topic/102423">some other plugins</a> that use custom fields.</p>
<p>The problem was brought to light with the release of WordPress 2.1, but circumstances exist in older WP versions that would trigger these issues in some plugins.</p>
<p>The plugins are doing this:</p>
<ol>
<li>A plugin inserts a special form field into the post edit form</li>
<li>The plugin monitors the form field by hooking into <code>edit_post</code></li>
<li>When the form value is empty or doesn't exist, the plugin assumes the user deleted what was in it, and procedes to delete all the custom values the plugin had stored for that post</li>
</ol>
<p>The issue occurs because the plugins assume that every time <code>edit_post</code> is triggered, their inserted form field will be included in <code>$_POST</code>.  This isn't the case.  <code>edit_post</code> is called for requests that do not originate from the post edit form and for requests that are not initiated by a privileged user.  Comment submission in WordPress 2.1 is one of these cases.  Editing of a post in 2.1 (and earlier versions) via XML-RPC is another case.</p>
<p><strong>Plugins cannot assume that the absence of a POST field means that POST field existed in an empty state, and plugins cannot assume that all calls to <code>edit_post</code> are performed by privileged users.</strong></p>
<p>Here are the two things that plugins must do:</p>
<ol>
<li>Verify that the user performing the action is authorized to perform the action by using the <code>current_user_can()</code> function or its siblings.</li>
<li>Verify intention of the user and the origination of the request by embedding a hidden form field with a nonce value, along with your usual custom field.</li>
</ol>
<p>Here is an example:</p>
<pre>function your_form_hook() {
	echo '&#60;input type="text" name="your-plugin" id="your-plugin"
			value="' . your_get_value() . '" /&#62;
		&#60;input type="hidden" name="your-plugin-verify-key" id="your-plugin-verify-key"
			value="' . wp_create_nonce('your-plugin') . '" /&#62;';
}

add_action('edit_form_advanced', 'your_form_hook');

function your_edit_post_hook($post_id) {
	// authorization
	if ( !current_user_can('edit_post', $post_id) )
		return $post_id;
	// origination and intention
	if ( !wp_verify_nonce($_POST['your-plugin-verify-key'], 'your-plugin') )
		return $post_id;
	your_update($post_id); // do the actual update here
	return $post_id;
}

add_action('edit_post', 'your_edit_post_hook');
</pre>
<p>This is a post aimed at plugin authors, so I'd appreciate it if we could save the comment space below for plugin authors who have questions about this topic.  If a particular plugin you're using is erasing Custom Fields, please contact its author directly.</p>
<p><strong>Note:</strong> I've mentioned the <code>edit_post</code> hook, but there are other similar hooks that the above also applies to.  <code>publish_post</code> and <code>save_post</code> are two that come to mind.</p>
]]></content:encoded>
</item>

</channel>
</rss>
