Changeset 32175

Timestamp:

04/20/2015 07:38:29 AM (10 years ago)

Author:

pento

Message:

Ensure post titles are correctly escaped on the Dashboard.

Props helen, ocean90, dd32, pento.

Location:

trunk/src/wp-admin

Files:

• includes/class-wp-comments-list-table.php (modified) (1 diff)
• includes/dashboard.php (modified) (1 diff)
• includes/template.php (modified) (1 diff)
• js/nav-menu.js (modified) (2 diffs)

trunk/src/wp-admin/includes/class-wp-comments-list-table.php

@@ -562 +562 @@
         if ( current_user_can( 'edit_post', $post->ID ) ) {
             $post_link = "<a href='" . get_edit_post_link( $post->ID ) . "'>";
-            $post_link .= get_the_title( $post->ID ) . '</a>';
+            $post_link .= esc_html( get_the_title( $post->ID ) ) . '</a>';
         } else {
-            $post_link = get_the_title( $post->ID );
+            $post_link = esc_html( get_the_title( $post->ID ) );
         }
 

trunk/src/wp-admin/includes/dashboard.php

@@ -521 +521 @@
     $GLOBALS['comment'] =& $comment;
 
-    $comment_post_title = strip_tags(get_the_title( $comment->comment_post_ID ));
+    $comment_post_title = _draft_or_post_title( $comment->comment_post_ID );
 
     if ( current_user_can( 'edit_post', $comment->comment_post_ID ) ) {

trunk/src/wp-admin/includes/template.php

@@ -1557 +1557 @@
     if ( empty( $title ) )
         $title = __( '(no title)' );
-    return $title;
+    return esc_html( $title );
 }
 

trunk/src/wp-admin/js/nav-menu.js

@@ -464 +464 @@
                 thisLink = menuItem.find( '.menus-move-left' ),
                 thisLinkText = menus.outFrom.replace( '%s', prevItemNameLeft );
-                thisLink.prop( 'title', menus.moveOutFrom.replace( '%s', prevItemNameLeft ) ).html( thisLinkText ).css( 'display', 'inline' );
+                thisLink.prop( 'title', menus.moveOutFrom.replace( '%s', prevItemNameLeft ) ).text( thisLinkText ).css( 'display', 'inline' );
             }
 
@@ -471 +471 @@
                     thisLink = menuItem.find( '.menus-move-right' ),
                     thisLinkText = menus.under.replace( '%s', prevItemNameRight );
-                    thisLink.prop( 'title', menus.moveUnder.replace( '%s', prevItemNameRight ) ).html( thisLinkText ).css( 'display', 'inline' );
+                    thisLink.prop( 'title', menus.moveUnder.replace( '%s', prevItemNameRight ) ).text( thisLinkText ).css( 'display', 'inline' );
                 }
             }