Changeset 41415 for branches/4.5/src/wp-admin/theme-editor.php

Timestamp:

09/19/2017 10:31:43 AM (7 years ago)

Author:

johnbillion

Message:

General: Add missing URL-encoding and add extra hardening to plugin and template names when they're displayed in the admin area.

Merges [41414] into the 4.5. branch

See #13377

Location:

branches/4.5

Files:

• . (modified) (1 prop)
• src/wp-admin/theme-editor.php (modified) (3 diffs)

branches/4.5/src/wp-admin/theme-editor.php

@@ -100 +100 @@
     $file = $allowed_files['style.css'];
 } else {
-    $relative_file = $file;
+    $relative_file = wp_unslash( $file );
     $file = $theme->get_stylesheet_directory() . '/' . $relative_file;
 }
@@ -157 +157 @@
 <?php endif;
 
-$description = get_file_description( $relative_file );
+$file_description = get_file_description( $relative_file );
 $file_show = array_search( $file, array_filter( $allowed_files ) );
-if ( $description != $file_show )
-    $description .= ' <span>(' . $file_show . ')</span>';
+$description = esc_html( $file_description );
+if ( $file_description != $file_show ) {
+    $description .= ' <span>(' . esc_html( $file_show ) . ')</span>';
+}
 ?>
 <div class="wrap">
@@ -231 +233 @@
         }
         
-        $file_description = get_file_description( $filename );
+        $file_description = esc_html( get_file_description( $filename ) );
         if ( $filename !== basename( $absolute_filename ) || $file_description !== $filename ) {
-            $file_description .= '<br /><span class="nonessential">(' . $filename . ')</span>';
+            $file_description .= '<br /><span class="nonessential">(' . esc_html( $filename ) . ')</span>';
         }