Changeset 20809 for trunk/wp-includes/class-wp-customize-setting.php

Timestamp:

05/16/2012 08:59:02 PM (13 years ago)

Author:

koopersmith

Message:

Theme Customizer: Properly escape customize settings when sending values to JS. Add WP_Customize_Setting->js_value(). fixes #20687, see #19910.

File:

• trunk/wp-includes/class-wp-customize-setting.php (modified) (1 diff)

trunk/wp-includes/class-wp-customize-setting.php

@@ -232 +232 @@
 
     /**
+     * Escape the parameter's value for use in JavaScript.
+     *
+     * @since 3.4.0
+     *
+     * @return mixed The requested escaped value.
+     */
+    public function js_value() {
+        $value = $this->value();
+
+        if ( is_string( $value ) )
+            return html_entity_decode( $value, ENT_QUOTES, 'UTF-8');
+
+        return $value;
+    }
+
+    /**
      * Check if the theme supports the setting and check user capabilities.
      *