WordPress.org

Make WordPress Core

Changeset 43270


Ignore:
Timestamp:
05/15/2018 02:07:32 PM (12 months ago)
Author:
azaozz
Message:

Privacy: Escape comment URLs in personal export file to prevent XSS.

There doesn't appear to be any way for an attacker to introduce malicious input into the URL, unless a plugin is filtering the URL to add it, but it's better to be safe than sorry.

Props birgire.
Merges [43245] to the 4.9 branch.
Fixes #44054.

Location:
branches/4.9
Files:
2 edited

Legend:

Unmodified
Added
Removed
  • branches/4.9

  • branches/4.9/src/wp-includes/comment.php

    r43157 r43270  
    32383238                case 'comment_link':
    32393239                    $value = get_comment_link( $comment->comment_ID );
    3240                     $value = '<a href="' . $value . '" target="_blank" rel="noreferrer noopener">' . $value . '</a>';
     3240                    $value = sprintf(
     3241                        '<a href="%s" target="_blank" rel="noreferrer noopener">%s</a>',
     3242                        esc_url( $value ),
     3243                        esc_html( $value )
     3244                    );
    32413245                    break;
    32423246            }
Note: See TracChangeset for help on using the changeset viewer.