Changeset 32206

Timestamp:

04/20/2015 01:43:56 PM (10 years ago)

Author:

pento

Message:

Ensure post titles are correctly escaped on the Dashboard. Merge of [32175] to the 3.7 branch.

Props helen, ocean90, dd32, pento.

Location:

branches/3.7/src/wp-admin

Files:

• includes/class-wp-comments-list-table.php (modified) (1 diff)
• includes/dashboard.php (modified) (1 diff)
• includes/template.php (modified) (1 diff)
• js/nav-menu.js (modified) (3 diffs)

branches/3.7/src/wp-admin/includes/class-wp-comments-list-table.php

@@ -494 +494 @@
         if ( current_user_can( 'edit_post', $post->ID ) ) {
             $post_link = "<a href='" . get_edit_post_link( $post->ID ) . "'>";
-            $post_link .= get_the_title( $post->ID ) . '</a>';
+            $post_link .= esc_html( get_the_title( $post->ID ) ) . '</a>';
         } else {
-            $post_link = get_the_title( $post->ID );
+            $post_link = esc_html( get_the_title( $post->ID ) );
         }
 

branches/3.7/src/wp-admin/includes/dashboard.php

@@ -659 +659 @@
 
     $comment_post_url = get_edit_post_link( $comment->comment_post_ID );
-    $comment_post_title = strip_tags(get_the_title( $comment->comment_post_ID ));
+    $comment_post_title = _draft_or_post_title( $comment->comment_post_ID );
     $comment_post_link = "<a href='$comment_post_url'>$comment_post_title</a>";
     $comment_link = '<a class="comment-link" href="' . esc_url(get_comment_link()) . '">#</a>';

branches/3.7/src/wp-admin/includes/template.php

@@ -1374 +1374 @@
     if ( empty( $title ) )
         $title = __( '(no title)' );
-    return $title;
+    return esc_html( $title );
 }
 

branches/3.7/src/wp-admin/js/nav-menu.js

@@ -445 +445 @@
                     var thisLink = menuItem.find( '.menus-move-left' ),
                         thisLinkText = menus.outFrom.replace( '%s', prevItemNameLeft );
-                    thisLink.prop( 'title', menus.moveOutFrom.replace( '%s', prevItemNameLeft ) ).html( thisLinkText ).css( 'display', 'inline' );
+                    thisLink.prop( 'title', menus.moveOutFrom.replace( '%s', prevItemNameLeft ) ).text( thisLinkText ).css( 'display', 'inline' );
                 }
 
@@ -452 +452 @@
                         var thisLink = menuItem.find( '.menus-move-right' ),
                             thisLinkText = menus.under.replace( '%s', prevItemNameRight );
-                        thisLink.prop( 'title', menus.moveUnder.replace( '%s', prevItemNameRight ) ).html( thisLinkText ).css( 'display', 'inline' );
+                        thisLink.prop( 'title', menus.moveUnder.replace( '%s', prevItemNameRight ) ).text( thisLinkText ).css( 'display', 'inline' );
                     }
                 }
@@ -474 +474 @@
                 }
 
-                $this.prop('title', title).html( title );
+                $this.prop('title', title).text( title );
             });
         },