Changeset 40632 for trunk/src/wp-admin/includes/ms.php

Timestamp:

05/11/2017 07:14:55 PM (8 years ago)

Author:

swissspidy

Message:

Mail: Ensure entities are decoded in email change notifications on Multisite.

Adds new tests to ensure this bug does not pop up again.

Props stephenharris.
Fixes #40015.

File:

• trunk/src/wp-admin/includes/ms.php (modified) (2 diffs)

trunk/src/wp-admin/includes/ms.php

@@ -326 +326 @@
     $content = str_replace( '###ADMIN_URL###', esc_url( self_admin_url( 'options.php?adminhash='.$hash ) ), $content );
     $content = str_replace( '###EMAIL###', $value, $content );
-    $content = str_replace( '###SITENAME###', get_site_option( 'site_name' ), $content );
+    $content = str_replace( '###SITENAME###', wp_specialchars_decode( get_site_option( 'site_name' ), ENT_QUOTES ), $content );
     $content = str_replace( '###SITEURL###', network_home_url(), $content );
 
-    wp_mail( $value, sprintf( __( '[%s] New Admin Email Address' ), wp_specialchars_decode( get_option( 'blogname' ) ) ), $content );
+    wp_mail( $value, sprintf( __( '[%s] New Admin Email Address' ), wp_specialchars_decode( get_option( 'blogname' ), ENT_QUOTES ) ), $content );
 
     if ( $switched_locale ) {
@@ -411 +411 @@
         $content = str_replace( '###ADMIN_URL###', esc_url( self_admin_url( 'profile.php?newuseremail=' . $hash ) ), $content );
         $content = str_replace( '###EMAIL###', $_POST['email'], $content);
-        $content = str_replace( '###SITENAME###', get_site_option( 'site_name' ), $content );
+        $content = str_replace( '###SITENAME###', wp_specialchars_decode( get_site_option( 'site_name' ), ENT_QUOTES ), $content );
         $content = str_replace( '###SITEURL###', network_home_url(), $content );
 
-        wp_mail( $_POST['email'], sprintf( __( '[%s] New Email Address' ), wp_specialchars_decode( get_option( 'blogname' ) ) ), $content );
+        wp_mail( $_POST['email'], sprintf( __( '[%s] New Email Address' ), wp_specialchars_decode( get_option( 'blogname' ), ENT_QUOTES ) ), $content );
         $_POST['email'] = $current_user->user_email;