Make WordPress Core

Changeset 4540


Ignore:
Timestamp:
11/29/2006 09:22:49 AM (16 years ago)
Author:
markjaquith
Message:

Sanitize all plugin metadata, for consistency. Props Viper007Bond. fixes #3396

File:
1 edited

Legend:

Unmodified
Added
Removed
  • trunk/wp-admin/plugins.php

    r4480 r4540  
    106106            $toggle = "<a href='" . wp_nonce_url("plugins.php?action=activate&amp;plugin=$plugin_file", 'activate-plugin_' . $plugin_file) . "' title='".__('Activate this plugin')."' class='edit'>".__('Activate')."</a>";
    107107        }
    108         $plugin_data['Description'] = wp_kses($plugin_data['Description'], array('a' => array('href' => array(),'title' => array()),'abbr' => array('title' => array()),'acronym' => array('title' => array()),'code' => array(),'em' => array(),'strong' => array()) ); ;
     108
     109        $plugins_allowedtags = array('a' => array('href' => array(),'title' => array()),'abbr' => array('title' => array()),'acronym' => array('title' => array()),'code' => array(),'em' => array(),'strong' => array());
     110
     111        // Sanitize all displayed data
     112        $plugin_data['Title']       = wp_kses($plugin_data['Title'], $plugins_allowedtags);
     113        $plugin_data['Version']     = wp_kses($plugin_data['Version'], $plugins_allowedtags);
     114        $plugin_data['Description'] = wp_kses($plugin_data['Description'], $plugins_allowedtags);
     115        $plugin_data['Author']      = wp_kses($plugin_data['Author'], $plugins_allowedtags);
     116
    109117        if ( $style != '' )
    110118            $style = 'class="' . $style . '"';
Note: See TracChangeset for help on using the changeset viewer.