Changeset 32205 for branches/3.8/src/wp-admin/includes/class-wp-comments-list-table.php

Timestamp:

04/20/2015 01:41:34 PM (10 years ago)

Author:

pento

Message:

Ensure post titles are correctly escaped on the Dashboard. Merge of [32175] to the 3.8 branch.

Props helen, ocean90, dd32, pento.

File:

• branches/3.8/src/wp-admin/includes/class-wp-comments-list-table.php (modified) (1 diff)

branches/3.8/src/wp-admin/includes/class-wp-comments-list-table.php

@@ -538 +538 @@
         if ( current_user_can( 'edit_post', $post->ID ) ) {
             $post_link = "<a href='" . get_edit_post_link( $post->ID ) . "'>";
-            $post_link .= get_the_title( $post->ID ) . '</a>';
+            $post_link .= esc_html( get_the_title( $post->ID ) ) . '</a>';
         } else {
-            $post_link = get_the_title( $post->ID );
+            $post_link = esc_html( get_the_title( $post->ID ) );
         }