Changeset 32204

Timestamp:

04/20/2015 01:38:36 PM (11 years ago)

Author:

pento

Message:

Ensure post titles are correctly escaped on the Dashboard. Merge of [32175] to the 3.9 branch.

Props helen, ocean90, dd32, pento.

Location:

branches/3.9/src/wp-admin

Files:

• includes/class-wp-comments-list-table.php (modified) (1 diff)
• includes/dashboard.php (modified) (1 diff)
• includes/template.php (modified) (1 diff)
• js/nav-menu.js (modified) (3 diffs)

branches/3.9/src/wp-admin/includes/class-wp-comments-list-table.php

@@ -538 +538 @@
                 if ( current_user_can( 'edit_post', $post->ID ) ) {
                         $post_link = "<a href='" . get_edit_post_link( $post->ID ) . "'>";
-                        $post_link .= get_the_title( $post->ID ) . '</a>';
+                        $post_link .= esc_html( get_the_title( $post->ID ) ) . '</a>';
                 } else {
-                        $post_link = get_the_title( $post->ID );
+                        $post_link = esc_html( get_the_title( $post->ID ) );
                 }
 

branches/3.9/src/wp-admin/includes/dashboard.php

@@ -532 +532 @@
         $GLOBALS['comment'] =& $comment;
 
-        $comment_post_title = strip_tags(get_the_title( $comment->comment_post_ID ));
+        $comment_post_title = _draft_or_post_title( $comment->comment_post_ID );
 
         if ( current_user_can( 'edit_post', $comment->comment_post_ID ) ) {

branches/3.9/src/wp-admin/includes/template.php

@@ -1438 +1438 @@
         if ( empty( $title ) )
                 $title = __( '(no title)' );
-        return $title;
+        return esc_html( $title );
 }
 

branches/3.9/src/wp-admin/js/nav-menu.js

@@ -452 +452 @@
                                         thisLink = menuItem.find( '.menus-move-left' ),
                                         thisLinkText = menus.outFrom.replace( '%s', prevItemNameLeft );
-                                        thisLink.prop( 'title', menus.moveOutFrom.replace( '%s', prevItemNameLeft ) ).html( thisLinkText ).css( 'display', 'inline' );
+                                        thisLink.prop( 'title', menus.moveOutFrom.replace( '%s', prevItemNameLeft ) ).text( thisLinkText ).css( 'display', 'inline' );
                                 }
 
@@ -459 +459 @@
                                                 thisLink = menuItem.find( '.menus-move-right' ),
                                                 thisLinkText = menus.under.replace( '%s', prevItemNameRight );
-                                                thisLink.prop( 'title', menus.moveUnder.replace( '%s', prevItemNameRight ) ).html( thisLinkText ).css( 'display', 'inline' );
+                                                thisLink.prop( 'title', menus.moveUnder.replace( '%s', prevItemNameRight ) ).text( thisLinkText ).css( 'display', 'inline' );
                                         }
                                 }
@@ -481 +481 @@
                                 }
 
-                                $this.prop('title', title).html( title );
+                                $this.prop('title', title).text( title );
                         });
                 },