themefoundation/custom-meta-box-template — pull request #1 by BoiteAWeb (2013-10-21 01:15:50+00:00)
Title: New version, less code, vulnerabilities fixed.

- I bumped up all filters/actions to create souples with thier
associated funtions, more simple to read, and avoid back and forth to
see the function.
- I created a correct nonce, I would suggest reading Mark Jaquith’s post
on nonces in WordPress.
(http://markjaquith.wordpress.com/2006/06/02/wordpress-203-nonces/) A
nonce is an "object(who)", an "action (what)" and an "unique ID(which
one)".
- I did a trick with an array to simply treat the save with corrects key
instead of copying same blocks of "if isset $_POST..." Remark the usage
of $$ in $$key and a ternary test.
- All inputs are named _metas[] and are part of an array, this is part
of the trick too.
- All labels and inputs are now correctly linked with for=""
- All values from input are printed safely using esc_attr (or like) so
XSS falw is not patched
- Noo need to check if isset because of the $$key trick, defaults values
are set.
- The save method is short now. Many things has change here :
* we do not need to check wp_is_post_autosave or wp_is_post_revision
here because if my post is a revision, my data were not saved, why? Thi
is a mistake so, you just have to test if an AUTOSAVE is not the one
triggering the hook, that's all. WordPress can update meta with revision
post's ID. When you enter a post, editing it, for example ou have the ID
"123", wait few seconds, WP will autosave it, you ID is not "124", so if
i hit "update", i am a revision. So my data can be saved?? strange!
Also i check the nonce with check_admin_referer wince you're using
wp_nonce_field, this is even better, autodie when fail.
No need to performs 1 check per field. I check if allowed keys, i check
if the data was postd in $_POST so i update it or i delete it (do not
update with empty, useless).
And i use the $_POS['post_ID'] and not the $post_id from hook because
this one can be a revision id, so as i need it to check the correct
nonce, i sue the $_POST one.

Questions? @boiteaweb - julio@boiteaweb.fr - julio.boiteaweb (skype)
ps : i did not check the JS file but the "image upload" button do not
add the choosen media in the field.