Changeset 41434 for branches/4.4/src/wp-admin/includes/template.php

Timestamp:

09/19/2017 12:12:15 PM (8 years ago)

Author:

johnbillion

Message:

General: Add missing URL-encoding and add extra hardening to plugin and template names when they're displayed in the admin area.

Merges [41415] and [41416] into the 4.4 branch.

See #13377

Location:

branches/4.4

Files:

• . (modified) (1 prop)
• src/wp-admin/includes/template.php (modified) (1 diff)

branches/4.4/src/wp-admin/includes/template.php

@@ -770 +770 @@
     foreach ( array_keys( $templates ) as $template ) {
         $selected = selected( $default, $templates[ $template ], false );
-        echo "\n\t<option value='" . $templates[ $template ] . "' $selected>$template</option>";
+        echo "\n\t<option value='" . esc_attr( $templates[ $template ] ) . "' $selected>" . esc_html( $template ) . "</option>";
     }
 }