Make WordPress Core

Changeset 32205


Ignore:
Timestamp:
04/20/2015 01:41:34 PM (10 years ago)
Author:
pento
Message:

Ensure post titles are correctly escaped on the Dashboard. Merge of [32175] to the 3.8 branch.

Props helen, ocean90, dd32, pento.

Location:
branches/3.8/src/wp-admin
Files:
4 edited

Legend:

Unmodified
Added
Removed
  • branches/3.8/src/wp-admin/includes/class-wp-comments-list-table.php

    r26962 r32205  
    538538        if ( current_user_can( 'edit_post', $post->ID ) ) {
    539539            $post_link = "<a href='" . get_edit_post_link( $post->ID ) . "'>";
    540             $post_link .= get_the_title( $post->ID ) . '</a>';
     540            $post_link .= esc_html( get_the_title( $post->ID ) ) . '</a>';
    541541        } else {
    542             $post_link = get_the_title( $post->ID );
     542            $post_link = esc_html( get_the_title( $post->ID ) );
    543543        }
    544544
  • branches/3.8/src/wp-admin/includes/dashboard.php

    r27001 r32205  
    431431
    432432    $comment_post_url = get_edit_post_link( $comment->comment_post_ID );
    433     $comment_post_title = strip_tags(get_the_title( $comment->comment_post_ID ));
     433    $comment_post_title = _draft_or_post_title( $comment->comment_post_ID );
    434434    $comment_post_link = "<a href='$comment_post_url'>$comment_post_title</a>";
    435435    $comment_link = '<a class="comment-link" href="' . esc_url(get_comment_link()) . '">#</a>';
  • branches/3.8/src/wp-admin/includes/template.php

    r26736 r32205  
    13741374    if ( empty( $title ) )
    13751375        $title = __( '(no title)' );
    1376     return $title;
     1376    return esc_html( $title );
    13771377}
    13781378
  • branches/3.8/src/wp-admin/js/nav-menu.js

    r26623 r32205  
    452452                    thisLink = menuItem.find( '.menus-move-left' ),
    453453                    thisLinkText = menus.outFrom.replace( '%s', prevItemNameLeft );
    454                     thisLink.prop( 'title', menus.moveOutFrom.replace( '%s', prevItemNameLeft ) ).html( thisLinkText ).css( 'display', 'inline' );
     454                    thisLink.prop( 'title', menus.moveOutFrom.replace( '%s', prevItemNameLeft ) ).text( thisLinkText ).css( 'display', 'inline' );
    455455                }
    456456
     
    459459                        thisLink = menuItem.find( '.menus-move-right' ),
    460460                        thisLinkText = menus.under.replace( '%s', prevItemNameRight );
    461                         thisLink.prop( 'title', menus.moveUnder.replace( '%s', prevItemNameRight ) ).html( thisLinkText ).css( 'display', 'inline' );
     461                        thisLink.prop( 'title', menus.moveUnder.replace( '%s', prevItemNameRight ) ).text( thisLinkText ).css( 'display', 'inline' );
    462462                    }
    463463                }
     
    481481                }
    482482
    483                 $this.prop('title', title).html( title );
     483                $this.prop('title', title).text( title );
    484484            });
    485485        },
Note: See TracChangeset for help on using the changeset viewer.