WordPress.org

Make WordPress Core

Ticket #15454: garyc40-15454-rev3.patch

File garyc40-15454-rev3.patch, 6.7 KB (added by garyc40, 7 years ago)

revert to esc_html() for link_notes, user_description and term_description

  • wp-admin/edit-tag-form.php

    diff --git wp-admin/edit-tag-form.php wp-admin/edit-tag-form.php
    index dbf669f..1598a62 100644
    do_action($taxonomy . '_pre_edit_form', $tag, $taxonomy); ?> 
    6161<?php endif; // is_taxonomy_hierarchical() ?>
    6262                <tr class="form-field">
    6363                        <th scope="row" valign="top"><label for="description"><?php _ex('Description', 'Taxonomy Description'); ?></label></th>
    64                         <td><textarea name="description" id="description" rows="5" cols="50" style="width: 97%;"><?php echo esc_textarea( $tag->description ); ?></textarea><br />
     64                        <td><textarea name="description" id="description" rows="5" cols="50" style="width: 97%;"><?php echo $tag->description; // already escaped ?></textarea><br />
    6565                        <span class="description"><?php _e('The description is not prominent by default, however some themes may show it.'); ?></span></td>
    6666                </tr>
    6767                <?php
  • wp-admin/includes/media.php

    diff --git wp-admin/includes/media.php wp-admin/includes/media.php
    index 33e7867..9038888 100644
    function get_media_item( $attachment_id, $args = null ) { 
    13431343                if ( !empty( $field[ $field['input'] ] ) )
    13441344                        $item .= $field[ $field['input'] ];
    13451345                elseif ( $field['input'] == 'textarea' ) {
    1346                         $item .= "<textarea type='text' id='$name' name='$name' $aria_required>" . esc_textarea( $field['value'] ) . '</textarea>';
     1346                        if ( user_can_richedit() ) { // already escaped when user_can_richedit() = false
     1347                                $field['value'] = esc_textarea( $field['value'] );
     1348                        }
     1349                        $item .= "<textarea type='text' id='$name' name='$name' $aria_required>" . $field['value'] . '</textarea>';
    13471350                } else {
    13481351                        $item .= "<input type='text' class='text' id='$name' name='$name' value='" . esc_attr( $field['value'] ) . "' $aria_required />";
    13491352                }
  • wp-admin/includes/meta-boxes.php

    diff --git wp-admin/includes/meta-boxes.php wp-admin/includes/meta-boxes.php
    index 42678db..96466b5 100644
    function post_tags_meta_box($post, $box) { 
    288288        <div class="jaxtag">
    289289        <div class="nojs-tags hide-if-js">
    290290        <p><?php echo $taxonomy->labels->add_or_remove_items; ?></p>
    291         <textarea name="<?php echo "tax_input[$tax_name]"; ?>" rows="3" cols="20" class="the-tags" id="tax-input-<?php echo $tax_name; ?>" <?php echo $disabled; ?>><?php echo esc_textarea( get_terms_to_edit( $post->ID, $tax_name ) ); ?></textarea></div>
     291        <textarea name="<?php echo "tax_input[$tax_name]"; ?>" rows="3" cols="20" class="the-tags" id="tax-input-<?php echo $tax_name; ?>" <?php echo $disabled; ?>><?php echo get_terms_to_edit( $post->ID, $tax_name ); // escaped by esc_attr() ?></textarea></div>
    292292        <?php if ( current_user_can($taxonomy->cap->assign_terms) ) : ?>
    293293        <div class="ajaxtag hide-if-no-js">
    294294                <label class="screen-reader-text" for="new-tag-<?php echo $tax_name; ?>"><?php echo $box['title']; ?></label>
    function link_advanced_meta_box($link) { 
    892892        </tr>
    893893        <tr class="form-field">
    894894                <th valign="top"  scope="row"><label for="link_notes"><?php _e('Notes') ?></label></th>
    895                 <td><textarea name="link_notes" id="link_notes" cols="50" rows="10" style="width: 95%"><?php echo esc_textarea( ( isset( $link->link_notes ) ? $link->link_notes : '') ); ?></textarea></td>
     895                <td><textarea name="link_notes" id="link_notes" cols="50" rows="10" style="width: 95%"><?php echo ( isset( $link->link_notes ) ? $link->link_notes : ''); // escaped ?></textarea></td>
    896896        </tr>
    897897        <tr class="form-field">
    898898                <th valign="top"  scope="row"><label for="link_rating"><?php _e('Rating') ?></label></th>
  • wp-admin/press-this.php

    diff --git wp-admin/press-this.php wp-admin/press-this.php
    index 1d826a8..282c4f9 100644
    $title = isset( $_GET['t'] ) ? trim( strip_tags( html_entity_decode( stripslashe 
    8383$selection = '';
    8484if ( !empty($_GET['s']) ) {
    8585        $selection = str_replace('&apos;', "'", stripslashes($_GET['s']));
    86         $selection = trim( htmlspecialchars( html_entity_decode($selection, ENT_QUOTES) ) );
     86        $selection = trim( html_entity_decode($selection, ENT_QUOTES) );
    8787}
    8888
    8989if ( ! empty($selection) ) {
    var photostorage = false; 
    598598                        <div class="editor-container">
    599599                                <textarea name="content" id="content" style="width:100%;" class="theEditor" rows="15"><?php
    600600                                        if ( $selection )
    601                                                 echo wp_richedit_pre($selection);
     601                                                echo esc_textarea($selection);
    602602                                        if ( $url ) {
    603603                                                echo '<p>';
    604604                                                if ( $selection )
  • wp-includes/bookmark.php

    diff --git wp-includes/bookmark.php wp-includes/bookmark.php
    index ddb5e13..03ef92c 100644
    function sanitize_bookmark_field($field, $value, $bookmark_id, $context) { 
    334334                return $value;
    335335
    336336        if ( 'edit' == $context ) {
    337                 $format_to_edit = array('link_notes');
    338337                $value = apply_filters("edit_$field", $value, $bookmark_id);
    339 
    340                 if ( in_array($field, $format_to_edit) ) {
    341                         $value = format_to_edit($value);
     338                if ( $field == 'link_notes' ) {
     339                        $value = esc_html( $value );
    342340                } else {
    343                         $value = esc_attr($value);
     341                        $value = esc_attr( $value );
    344342                }
    345343        } else if ( 'db' == $context ) {
    346344                $value = apply_filters("pre_$field", $value);
  • wp-includes/formatting.php

    diff --git wp-includes/formatting.php wp-includes/formatting.php
    index c34c4f1..718ad71 100644
    function force_balance_tags( $text ) { 
    11261126function format_to_edit($content, $richedit = false) {
    11271127        $content = apply_filters('format_to_edit', $content);
    11281128        if (! $richedit )
    1129                 $content = htmlspecialchars($content);
     1129                $content = esc_textarea($content);
    11301130        return $content;
    11311131}
    11321132
  • wp-includes/taxonomy.php

    diff --git wp-includes/taxonomy.php wp-includes/taxonomy.php
    index b708838..05848b7 100644
    function sanitize_term_field($field, $value, $term_id, $taxonomy, $context) { 
    15201520        if ( 'edit' == $context ) {
    15211521                $value = apply_filters("edit_term_{$field}", $value, $term_id, $taxonomy);
    15221522                $value = apply_filters("edit_{$taxonomy}_{$field}", $value, $term_id);
    1523                 if ( 'description' == $field )
    1524                         $value = format_to_edit($value);
    1525                 else
    1526                         $value = esc_attr($value);
     1523               
     1524                if ( $field == 'description' ) {
     1525                        $value = esc_html( $value );
     1526                } else {
     1527                        $value = esc_attr( $value );
     1528                }
    15271529        } else if ( 'db' == $context ) {
    15281530                $value = apply_filters("pre_term_{$field}", $value, $taxonomy);
    15291531                $value = apply_filters("pre_{$taxonomy}_{$field}", $value);
  • wp-includes/user.php

    diff --git wp-includes/user.php wp-includes/user.php
    index c9e4cb4..fb97b06 100644
    function sanitize_user_field($field, $value, $user_id, $context) { 
    12111211                }
    12121212
    12131213                if ( 'description' == $field )
    1214                         $value = esc_textarea( $value );
     1214                        $value = esc_html( $value );
    12151215                else
    12161216                        $value = esc_attr($value);
    12171217        } else if ( 'db' == $context ) {