WordPress.org

Make WordPress Core

Changeset 12235


Ignore:
Timestamp:
11/20/2009 01:31:06 AM (9 years ago)
Author:
azaozz
Message:

Escape $title in dashboard Recent Drafts to reveal HTML tags, props Simek, fixes #11128

File:
1 edited

Legend:

Unmodified
Added
Removed
  • trunk/wp-admin/includes/dashboard.php

    r12209 r12235  
    449449            $url = get_edit_post_link( $draft->ID );
    450450            $title = _draft_or_post_title( $draft->ID );
    451             $item = "<h4><a href='$url' title='" . sprintf( __( 'Edit &#8220;%s&#8221;' ), esc_attr( $title ) ) . "'>$title</a> <abbr title='" . get_the_time(__('Y/m/d g:i:s A'), $draft) . "'>" . get_the_time( get_option( 'date_format' ), $draft ) . '</abbr></h4>';
     451            $item = "<h4><a href='$url' title='" . sprintf( __( 'Edit &#8220;%s&#8221;' ), esc_attr( $title ) ) . "'>" . esc_html($title) . "</a> <abbr title='" . get_the_time(__('Y/m/d g:i:s A'), $draft) . "'>" . get_the_time( get_option( 'date_format' ), $draft ) . '</abbr></h4>';
    452452            if ( $the_content = preg_split( '#\s#', strip_tags( $draft->post_content ), 11, PREG_SPLIT_NO_EMPTY ) )
    453453                $item .= '<p>' . join( ' ', array_slice( $the_content, 0, 10 ) ) . ( 10 < count( $the_content ) ? '&hellip;' : '' ) . '</p>';
Note: See TracChangeset for help on using the changeset viewer.