Changeset 48453 for trunk/src/wp-admin/includes/class-plugin-installer-skin.php

Timestamp:

07/12/2020 07:59:00 PM (4 years ago)

Author:

azaozz

Message:

Upgrade/Install: Use wp_strip_all_tags() for the fields in the compare table on the "Update theme/plugin from uploaded zip" screen. Some may contain HTML.

See #9757.

File:

• trunk/src/wp-admin/includes/class-plugin-installer-skin.php (modified) (2 diffs)

trunk/src/wp-admin/includes/class-plugin-installer-skin.php

@@ -218 +218 @@
 
         foreach ( $rows as $field => $label ) {
-            $old_value = ! empty( $current_plugin_data[ $field ] ) ? $current_plugin_data[ $field ] : '-';
-            $new_value = ! empty( $this->upgrader->new_plugin_data[ $field ] ) ? $this->upgrader->new_plugin_data[ $field ] : '-';
+            $old_value = ! empty( $current_plugin_data[ $field ] ) ? (string) $current_plugin_data[ $field ] : '-';
+            $new_value = ! empty( $this->upgrader->new_plugin_data[ $field ] ) ? (string) $this->upgrader->new_plugin_data[ $field ] : '-';
 
             $is_same_plugin = $is_same_plugin && ( $old_value === $new_value );
@@ -226 +226 @@
             $diff_version = ( 'Version' === $field && $this->is_downgrading );
 
-            $table .= '<tr><td class="name-label">' . $label . '</td><td>' . esc_html( $old_value ) . '</td>';
+            $table .= '<tr><td class="name-label">' . $label . '</td><td>' . wp_strip_all_tags( $old_value ) . '</td>';
             $table .= ( $diff_field || $diff_version ) ? '<td class="warning">' : '<td>';
-            $table .= esc_html( $new_value ) . '</td></tr>';
+            $table .= wp_strip_all_tags( $new_value ) . '</td></tr>';
         }