Changeset 41452 for branches/3.8/src/wp-admin/includes/template.php

Timestamp:

09/19/2017 01:48:11 PM (9 years ago)

Author:

johnbillion

Message:

General: Add missing URL-encoding and add extra hardening to plugin and template names when they're displayed in the admin area.

Merges [41434] with changes to the 3.8 branch.

See #13377

Location:

branches/3.8

Files:

• . (modified) (1 prop)
• src/wp-admin/includes/template.php (modified) (1 diff)

branches/3.8/src/wp-admin/includes/template.php

@@ -707 +707 @@
         else
             $selected = '';
-    echo "\n\t<option value='".$templates[$template]."' $selected>$template</option>";
+    echo "\n\t<option value='" . esc_attr( $templates[$template] ) ."' $selected>" . esc_html( $template ) . "</option>";
     endforeach;
 }