WordPress.org

Make WordPress Core


Ignore:
Timestamp:
09/19/2017 01:19:20 PM (3 years ago)
Author:
johnbillion
Message:

General: Add missing URL-encoding and add extra hardening to plugin and template names when they're displayed in the admin area.

Merges [41434] with changes to the 4.3 branch.

See #13377

Location:
branches/4.3
Files:
2 edited

Legend:

Unmodified
Added
Removed
  • branches/4.3

  • branches/4.3/src/wp-admin/plugin-editor.php

    r32974 r41444  
    9494
    9595        if ( ( ! empty( $_GET['networkwide'] ) && ! is_plugin_active_for_network($file) ) || ! is_plugin_active($file) )
    96             activate_plugin($file, "plugin-editor.php?file=$file&phperror=1", ! empty( $_GET['networkwide'] ) ); // we'll override this later if the plugin can be included without fatal error
    97 
    98         wp_redirect( self_admin_url("plugin-editor.php?file=$file&a=te&scrollto=$scrollto") );
     96            activate_plugin($file, "plugin-editor.php?file=" . urlencode( $file ) . "&phperror=1", ! empty( $_GET['networkwide'] ) ); // we'll override this later if the plugin can be included without fatal error
     97
     98        wp_redirect( self_admin_url("plugin-editor.php?file=" . urlencode( $file ) . "&a=te&scrollto=$scrollto") );
    9999        exit;
    100100    }
     
    182182    if ( is_plugin_active($plugin) ) {
    183183        if ( is_writeable($real_file) )
    184             echo sprintf(__('Editing <strong>%s</strong> (active)'), $file);
     184            echo sprintf(__('Editing <strong>%s</strong> (active)'), esc_html( $file ) );
    185185        else
    186             echo sprintf(__('Browsing <strong>%s</strong> (active)'), $file);
     186            echo sprintf(__('Browsing <strong>%s</strong> (active)'), esc_html( $file ) );
    187187    } else {
    188188        if ( is_writeable($real_file) )
    189             echo sprintf(__('Editing <strong>%s</strong> (inactive)'), $file);
     189            echo sprintf(__('Editing <strong>%s</strong> (inactive)'), esc_html( $file ) );
    190190        else
    191             echo sprintf(__('Browsing <strong>%s</strong> (inactive)'), $file);
     191            echo sprintf(__('Browsing <strong>%s</strong> (inactive)'), esc_html( $file ) );
    192192    }
    193193    ?></big>
     
    233233    }
    234234?>
    235         <li<?php echo $file == $plugin_file ? ' class="highlight"' : ''; ?>><a href="plugin-editor.php?file=<?php echo urlencode( $plugin_file ) ?>&amp;plugin=<?php echo urlencode( $plugin ) ?>"><?php echo $plugin_file ?></a></li>
     235        <li<?php echo $file == $plugin_file ? ' class="highlight"' : ''; ?>><a href="plugin-editor.php?file=<?php echo urlencode( $plugin_file ) ?>&amp;plugin=<?php echo urlencode( $plugin ) ?>"><?php echo esc_html( $plugin_file ); ?></a></li>
    236236<?php endforeach; ?>
    237237    </ul>
Note: See TracChangeset for help on using the changeset viewer.