Changeset 32176 for branches/4.1/src/wp-admin/includes/class-wp-comments-list-table.php

Timestamp:

04/20/2015 07:41:34 AM (11 years ago)

Author:

pento

Message:

Ensure post titles are correctly escaped on the Dashboard. Merge of [32175] to the 4.1 branch.

Props helen, ocean90, dd32, pento.

File:

• branches/4.1/src/wp-admin/includes/class-wp-comments-list-table.php (modified) (1 diff)

branches/4.1/src/wp-admin/includes/class-wp-comments-list-table.php

@@ -555 +555 @@
                 if ( current_user_can( 'edit_post', $post->ID ) ) {
                         $post_link = "<a href='" . get_edit_post_link( $post->ID ) . "'>";
-                        $post_link .= get_the_title( $post->ID ) . '</a>';
+                        $post_link .= esc_html( get_the_title( $post->ID ) ) . '</a>';
                 } else {
-                        $post_link = get_the_title( $post->ID );
+                        $post_link = esc_html( get_the_title( $post->ID ) );
                 }