Changeset 48453

Timestamp:

07/12/2020 07:59:00 PM (5 years ago)

Author:

azaozz

Message:

Upgrade/Install: Use wp_strip_all_tags() for the fields in the compare table on the "Update theme/plugin from uploaded zip" screen. Some may contain HTML.

See #9757.

Location:

trunk/src/wp-admin/includes

Files:

• class-plugin-installer-skin.php (modified) (2 diffs)
• class-theme-installer-skin.php (modified) (2 diffs)

trunk/src/wp-admin/includes/class-plugin-installer-skin.php

@@ -218 +218 @@
 
         foreach ( $rows as $field => $label ) {
-            $old_value = ! empty( $current_plugin_data[ $field ] ) ? $current_plugin_data[ $field ] : '-';
-            $new_value = ! empty( $this->upgrader->new_plugin_data[ $field ] ) ? $this->upgrader->new_plugin_data[ $field ] : '-';
+            $old_value = ! empty( $current_plugin_data[ $field ] ) ? (string) $current_plugin_data[ $field ] : '-';
+            $new_value = ! empty( $this->upgrader->new_plugin_data[ $field ] ) ? (string) $this->upgrader->new_plugin_data[ $field ] : '-';
 
             $is_same_plugin = $is_same_plugin && ( $old_value === $new_value );
@@ -226 +226 @@
             $diff_version = ( 'Version' === $field && $this->is_downgrading );
 
-            $table .= '<tr><td class="name-label">' . $label . '</td><td>' . esc_html( $old_value ) . '</td>';
+            $table .= '<tr><td class="name-label">' . $label . '</td><td>' . wp_strip_all_tags( $old_value ) . '</td>';
             $table .= ( $diff_field || $diff_version ) ? '<td class="warning">' : '<td>';
-            $table .= esc_html( $new_value ) . '</td></tr>';
+            $table .= wp_strip_all_tags( $new_value ) . '</td></tr>';
         }
 

trunk/src/wp-admin/includes/class-theme-installer-skin.php

@@ -242 +242 @@
         foreach ( $rows as $field => $label ) {
             $old_value = $current_theme_data->display( $field, false );
-            $old_value = $old_value ? $old_value : '-';
-
-            $new_value = ! empty( $this->upgrader->new_theme_data[ $field ] ) ? $this->upgrader->new_theme_data[ $field ] : '-';
+            $old_value = $old_value ? (string) $old_value : '-';
+
+            $new_value = ! empty( $this->upgrader->new_theme_data[ $field ] ) ? (string) $this->upgrader->new_theme_data[ $field ] : '-';
 
             if ( $old_value === $new_value && '-' === $new_value && 'Template' === $field ) {
@@ -261 +261 @@
             }
 
-            $table .= '<tr><td class="name-label">' . $label . '</td><td>' . esc_html( $old_value ) . '</td>';
+            $table .= '<tr><td class="name-label">' . $label . '</td><td>' . wp_strip_all_tags( $old_value ) . '</td>';
             $table .= ( $diff_field || $diff_version || $invalid_parent ) ? '<td class="warning">' : '<td>';
-            $table .= esc_html( $new_value ) . '</td></tr>';
+            $table .= wp_strip_all_tags( $new_value ) . '</td></tr>';
         }