WordPress.org

Make WordPress Core


Ignore:
Timestamp:
02/17/2016 08:14:37 PM (5 years ago)
Author:
ocean90
Message:

Plugins: Remove slashes from search terms and use urldecode() in non-URL contexts.

Fixes #35712.

File:
1 edited

Legend:

Unmodified
Added
Removed
  • trunk/src/wp-admin/plugins.php

    r36302 r36560  
    1919
    2020$plugin = isset($_REQUEST['plugin']) ? $_REQUEST['plugin'] : '';
    21 $s = isset($_REQUEST['s']) ? urlencode($_REQUEST['s']) : '';
     21$s = isset($_REQUEST['s']) ? urlencode( wp_unslash( $_REQUEST['s'] ) ) : '';
    2222
    2323// Clean up request URI from temporary args for screen options/paging uri's to work as expected.
     
    487487if ( strlen( $s ) ) {
    488488    /* translators: %s: search keywords */
    489     printf( '<span class="subtitle">' . __( 'Search results for &#8220;%s&#8221;' ) . '</span>', esc_html( $s ) );
     489    printf( '<span class="subtitle">' . __( 'Search results for &#8220;%s&#8221;' ) . '</span>', esc_html( urldecode( $s ) ) );
    490490}
    491491?>
Note: See TracChangeset for help on using the changeset viewer.