Changeset 34973 for trunk/src/wp-admin/plugins.php

Timestamp:

10/08/2015 11:13:00 PM (9 years ago)

Author:

johnbillion

Message:

Remove HTML escaping for the plugin name and author fields that are displayed when deleting a plugin.

While it might seem counter-intuitive to remove HTML escaping, these fields are already safe (they originate in _get_plugin_data_markup_translate() which handles sanitization and escaping), and the AuthorName field actually allows some HTML. This change prevents escaped HTML from appearing here.

Fixes #25422

File:

• trunk/src/wp-admin/plugins.php (modified) (1 diff)

trunk/src/wp-admin/plugins.php

@@ -322 +322 @@
                             if ( $plugin['is_uninstallable'] ) {
                                 /* translators: 1: plugin name, 2: plugin author */
-                                echo '<li>', sprintf( __( '<strong>%1$s</strong> by <em>%2$s</em> (will also <strong>delete its data</strong>)' ), esc_html($plugin['Name']), esc_html($plugin['AuthorName']) ), '</li>';
+                                echo '<li>', sprintf( __( '<strong>%1$s</strong> by <em>%2$s</em> (will also <strong>delete its data</strong>)' ), $plugin['Name'], $plugin['AuthorName'] ), '</li>';
                                 $data_to_delete = true;
                             } else {
                                 /* translators: 1: plugin name, 2: plugin author */
-                                echo '<li>', sprintf( __('<strong>%1$s</strong> by <em>%2$s</em>' ), esc_html($plugin['Name']), esc_html($plugin['AuthorName']) ), '</li>';
+                                echo '<li>', sprintf( __('<strong>%1$s</strong> by <em>%2$s</em>' ), $plugin['Name'], $plugin['AuthorName'] ), '</li>';
                             }
                         }