Changeset 20809

Timestamp:

05/16/2012 08:59:02 PM (14 years ago)

Author:

koopersmith

Message:

Theme Customizer: Properly escape customize settings when sending values to JS. Add WP_Customize_Setting->js_value(). fixes #20687, see #19910.

Location:

trunk/wp-includes

Files:

• class-wp-customize-setting.php (modified) (1 diff)
• class-wp-customize.php (modified) (1 diff)
• customize-controls.php (modified) (1 diff)

trunk/wp-includes/class-wp-customize-setting.php

@@ -232 +232 @@
 
         /**
+         * Escape the parameter's value for use in JavaScript.
+         *
+         * @since 3.4.0
+         *
+         * @return mixed The requested escaped value.
+         */
+        public function js_value() {
+                $value = $this->value();
+
+                if ( is_string( $value ) )
+                        return html_entity_decode( $value, ENT_QUOTES, 'UTF-8');
+
+                return $value;
+        }
+
+        /**
          * Check if the theme supports the setting and check user capabilities.
          *

trunk/wp-includes/class-wp-customize.php

@@ -214 +214 @@
 
                 foreach ( $this->settings as $id => $setting ) {
-                        $settings['values'][ $id ] = $setting->value();
+                        $settings['values'][ $id ] = $setting->js_value();
                 }
 

trunk/wp-includes/customize-controls.php

@@ -109 +109 @@
         foreach ( $this->settings as $id => $setting ) {
                 $settings['settings'][ $id ] = array(
-                        'value'     => $setting->value(),
+                        'value'     => $setting->js_value(),
                         'transport' => $setting->transport,
                 );