Make WordPress Core


Ignore:
Timestamp:
09/04/2019 04:35:39 PM (5 years ago)
Author:
SergeyBiryukov
Message:

Escape the output in wp_ajax_upload_attachment().

Merges [45936] to the 4.5 branch.
Props whyisjake, sstoqnov.

Location:
branches/4.5
Files:
2 edited

Legend:

Unmodified
Added
Removed
  • branches/4.5

  • branches/4.5/src/wp-admin/includes/ajax-actions.php

    r44849 r45950  
    20052005            'data'    => array(
    20062006                'message'  => __( 'You do not have permission to upload files.' ),
    2007                 'filename' => $_FILES['async-upload']['name'],
     2007                'filename' => esc_html( $_FILES['async-upload']['name'] ),
    20082008            )
    20092009        ) );
     
    20192019                'data'    => array(
    20202020                    'message'  => __( "You don't have permission to attach files to this post." ),
    2021                     'filename' => $_FILES['async-upload']['name'],
     2021                    'filename' => esc_html( $_FILES['async-upload']['name'] ),
    20222022                )
    20232023            ) );
     
    20432043                'data'    => array(
    20442044                    'message'  => __( 'The uploaded file is not a valid image. Please try again.' ),
    2045                     'filename' => $_FILES['async-upload']['name'],
     2045                    'filename' => esc_html( $_FILES['async-upload']['name'] ),
    20462046                )
    20472047            ) );
     
    20582058            'data'    => array(
    20592059                'message'  => $attachment_id->get_error_message(),
    2060                 'filename' => $_FILES['async-upload']['name'],
     2060                'filename' => esc_html( $_FILES['async-upload']['name'] ),
    20612061            )
    20622062        ) );
Note: See TracChangeset for help on using the changeset viewer.