Changeset 41399 for trunk/src/wp-admin/theme-editor.php

Timestamp:

09/19/2017 10:10:35 AM (8 years ago)

Author:

johnbillion

Message:

General: Add missing URL-encoding and add extra hardening to plugin and template names when they're displayed in the admin area.

Props kawauso, Mte90 for initial patches

Fixes #13377

File:

• trunk/src/wp-admin/theme-editor.php (modified) (3 diffs)

trunk/src/wp-admin/theme-editor.php

@@ -133 +133 @@
     $file = $allowed_files['style.css'];
 } else {
-    $relative_file = $file;
+    $relative_file = wp_unslash( $file );
     $file = $theme->get_stylesheet_directory() . '/' . $relative_file;
 }
@@ -196 +196 @@
 <?php endif;
 
-$description = get_file_description( $relative_file );
+$file_description = get_file_description( $relative_file );
 $file_show = array_search( $file, array_filter( $allowed_files ) );
-if ( $description != $file_show )
-    $description .= ' <span>(' . $file_show . ')</span>';
+$description = esc_html( $file_description );
+if ( $file_description != $file_show ) {
+    $description .= ' <span>(' . esc_html( $file_show ) . ')</span>';
+}
 ?>
 <div class="wrap">
@@ -270 +272 @@
         }
 
-        $file_description = get_file_description( $filename );
+        $file_description = esc_html( get_file_description( $filename ) );
         if ( $filename !== basename( $absolute_filename ) || $file_description !== $filename ) {
-            $file_description .= '<br /><span class="nonessential">(' . $filename . ')</span>';
+            $file_description .= '<br /><span class="nonessential">(' . esc_html( $filename ) . ')</span>';
         }