Changeset 46734 for trunk/src/wp-includes/class-wp-admin-bar.php

Timestamp:

11/15/2019 11:22:19 PM (5 years ago)

Author:

whyisjake

Message:

Toolbar: Properly escape the onclick attribute.

The onclick attribute was being escaped twice, once with esc_js and again with esc_attr.

Fixes #48117.
Props tmatsuur, dinhtungdu.

File:

• trunk/src/wp-includes/class-wp-admin-bar.php (modified) (2 diffs)

trunk/src/wp-includes/class-wp-admin-bar.php

@@ -551 +551 @@
             $attributes = array( 'onclick', 'target', 'title', 'rel', 'lang', 'dir' );
             echo "<a class='ab-item'$aria_attributes href='" . esc_url( $node->href ) . "'";
-            if ( ! empty( $node->meta['onclick'] ) ) {
-                echo ' onclick="' . esc_js( $node->meta['onclick'] ) . '"';
-            }
         } else {
             $attributes = array( 'onclick', 'target', 'title', 'rel', 'lang', 'dir' );
@@ -560 +557 @@
 
         foreach ( $attributes as $attribute ) {
-            if ( ! empty( $node->meta[ $attribute ] ) ) {
+            if ( empty( $node->meta[ $attribute ] ) ) {
+                continue;
+            }
+
+            if ( 'onclick' === $attribute ) {
+                echo " $attribute='" . esc_js( $node->meta[ $attribute ] ) . "'";
+            } else {
                 echo " $attribute='" . esc_attr( $node->meta[ $attribute ] ) . "'";
             }