Ticket #28727: 28727.1.diff

src/wp-admin/plugin-editor.php

@@ -164 +164 @@
                 }
         }
 
-        $content = esc_textarea( $content );
+        $content = esc_plugineditor( $content );
         ?>
 <?php if (isset($_GET['a'])) : ?>
  <div id="message" class="updated notice is-dismissible"><p><?php _e('File edited successfully.') ?></p></div>

src/wp-includes/formatting.php

@@ -3589 +3589 @@
 }
 
 /**
+ * Escaping for plugin editor textarea.
+ *
+ * @since 4.5.0
+ *
+ * @param string $text
+ * @return string
+ */
+function esc_plugin_source( $text ) {
+        $safe_text = htmlspecialchars( $text, ENT_QUOTES );
+        /**
+         * Filter a string cleaned and escaped for output in a textarea element.
+         *
+         * @since 3.1.0
+         *
+         * @param string $safe_text The text after it has been escaped.
+         * @param string $text      The text prior to being escaped.
+         */
+        return apply_filters( 'esc_plugin_source', $safe_text, $text );
+}
+
+/**
  * Escape an HTML tag name.
  *
  * @since 2.5.0