Changeset 35748

Timestamp:

11/29/2015 02:40:42 AM (6 years ago)

Author:

johnbillion

Message:

In a similar vein to [34133], escape the email address and IP address of comment authors to increase defence in depth.

Location:

trunk/src

Files:

• wp-admin/includes/class-wp-comments-list-table.php (modified) (2 diffs)
• wp-includes/comment-template.php (modified) (2 diffs)

trunk/src/wp-admin/includes/class-wp-comments-list-table.php

@@ -696 +696 @@
 
                 if ( ! empty( $email ) && '@' !== $email ) {
-                    printf( '<a href=\'mailto:%1$s\'>%1$s</a><br />', $email );
+                    printf( '<a href="%1$s">%2$s</a><br />', esc_url( 'mailto:' . $email ), esc_html( $email ) );
                 }
             }
@@ -706 +706 @@
                     $author_ip_url = add_query_arg( 'comment_status', 'spam', $author_ip_url );
                 }
-                printf( '<a href="%s">%s</a>', esc_url( $author_ip_url ), $author_ip );
+                printf( '<a href="%1$s">%2$s</a>', esc_url( $author_ip_url ), esc_html( $author_ip ) );
             }
         }

trunk/src/wp-includes/comment-template.php

@@ -185 +185 @@
     $display = ($linktext != '') ? $linktext : $email;
         $return  = $before;
-        $return .= "<a href='mailto:$email'>$display</a>";
+        $return .= sprintf( '<a href="%1$s">%2$s</a>', esc_url( 'mailto:' . $email ), esc_html( $display ) );
         $return .= $after;
         return $return;
@@ -279 +279 @@
  */
 function comment_author_IP( $comment_ID = 0 ) {
-    echo get_comment_author_IP( $comment_ID );
+    echo esc_html( get_comment_author_IP( $comment_ID ) );
 }