Changeset 49375

Timestamp:

10/29/2020 04:56:34 PM (4 years ago)

Author:

whyisjake

Message:

Coding standards: Modify escaping functions to avoid potential false positives.

Props xknown, zieladam, peterwilsoncc.Y

Location:

branches/5.5/src/wp-admin

Files:

• admin-header.php (modified) (1 diff)
• includes/class-custom-image-header.php (modified) (1 diff)
• includes/media.php (modified) (1 diff)
• includes/ms.php (modified) (1 diff)
• includes/template.php (modified) (1 diff)
• media-new.php (modified) (1 diff)
• network/site-users.php (modified) (1 diff)

branches/5.5/src/wp-admin/admin-header.php

@@ -83 +83 @@
 <script type="text/javascript">
 addLoadEvent = function(func){if(typeof jQuery!=='undefined')jQuery(document).ready(func);else if(typeof wpOnload!=='function'){wpOnload=func;}else{var oldonload=wpOnload;wpOnload=function(){oldonload();func();}}};
-var ajaxurl = '<?php echo admin_url( 'admin-ajax.php', 'relative' ); ?>',
-    pagenow = '<?php echo $current_screen->id; ?>',
-    typenow = '<?php echo $current_screen->post_type; ?>',
-    adminpage = '<?php echo $admin_body_class; ?>',
-    thousandsSeparator = '<?php echo addslashes( $wp_locale->number_format['thousands_sep'] ); ?>',
-    decimalPoint = '<?php echo addslashes( $wp_locale->number_format['decimal_point'] ); ?>',
+var ajaxurl = '<?php echo esc_js( admin_url( 'admin-ajax.php', 'relative' ) ); ?>',
+    pagenow = '<?php echo esc_js( $current_screen->id ); ?>',
+    typenow = '<?php echo esc_js( $current_screen->post_type ); ?>',
+    adminpage = '<?php echo esc_js( $admin_body_class ); ?>',
+    thousandsSeparator = '<?php echo esc_js( $wp_locale->number_format['thousands_sep'] ); ?>',
+    decimalPoint = '<?php echo esc_js( $wp_locale->number_format['decimal_point'] ); ?>',
     isRtl = <?php echo (int) is_rtl(); ?>;
 </script>

branches/5.5/src/wp-admin/includes/class-custom-image-header.php

@@ -344 +344 @@
 <script type="text/javascript">
 (function($){
-    var default_color = '<?php echo $default_color; ?>',
+    var default_color = '<?php echo esc_js( $default_color ); ?>',
         header_text_fields;
 

branches/5.5/src/wp-admin/includes/media.php

@@ -531 +531 @@
     <script type="text/javascript">
     addLoadEvent = function(func){if(typeof jQuery!="undefined")jQuery(document).ready(func);else if(typeof wpOnload!='function'){wpOnload=func;}else{var oldonload=wpOnload;wpOnload=function(){oldonload();func();}}};
-    var ajaxurl = '<?php echo admin_url( 'admin-ajax.php', 'relative' ); ?>', pagenow = 'media-upload-popup', adminpage = 'media-upload-popup',
+    var ajaxurl = '<?php echo esc_js( admin_url( 'admin-ajax.php', 'relative' ) ); ?>', pagenow = 'media-upload-popup', adminpage = 'media-upload-popup',
     isRtl = <?php echo (int) is_rtl(); ?>;
     </script>

branches/5.5/src/wp-admin/includes/ms.php

@@ -843 +843 @@
     ?>
 <script type="text/javascript">
-var tb_pathToImage = "<?php echo includes_url( 'js/thickbox/loadingAnimation.gif', 'relative' ); ?>";
+var tb_pathToImage = "<?php echo esc_js( includes_url( 'js/thickbox/loadingAnimation.gif', 'relative' ) ); ?>";
 </script>
     <?php

branches/5.5/src/wp-admin/includes/template.php

@@ -2019 +2019 @@
 addLoadEvent = function(func){if(typeof jQuery!="undefined")jQuery(document).ready(func);else if(typeof wpOnload!='function'){wpOnload=func;}else{var oldonload=wpOnload;wpOnload=function(){oldonload();func();}}};
 function tb_close(){var win=window.dialogArguments||opener||parent||top;win.tb_remove();}
-var ajaxurl = '<?php echo admin_url( 'admin-ajax.php', 'relative' ); ?>',
-    pagenow = '<?php echo $current_screen->id; ?>',
-    typenow = '<?php echo $current_screen->post_type; ?>',
-    adminpage = '<?php echo $admin_body_class; ?>',
-    thousandsSeparator = '<?php echo addslashes( $wp_locale->number_format['thousands_sep'] ); ?>',
-    decimalPoint = '<?php echo addslashes( $wp_locale->number_format['decimal_point'] ); ?>',
+var ajaxurl = '<?php echo esc_js( admin_url( 'admin-ajax.php', 'relative' ) ); ?>',
+    pagenow = '<?php echo esc_js( $current_screen->id ); ?>',
+    typenow = '<?php echo esc_js( $current_screen->post_type ); ?>',
+    adminpage = '<?php echo esc_js( $admin_body_class ); ?>',
+    thousandsSeparator = '<?php echo esc_js( $wp_locale->number_format['thousands_sep'] ); ?>',
+    decimalPoint = '<?php echo esc_js( $wp_locale->number_format['decimal_point'] ); ?>',
     isRtl = <?php echo (int) is_rtl(); ?>;
 </script>

branches/5.5/src/wp-admin/media-new.php

@@ -78 +78 @@
 
     <script type="text/javascript">
-    var post_id = <?php echo $post_id; ?>, shortform = 3;
+    var post_id = <?php echo absint( $post_id ); ?>, shortform = 3;
     </script>
-    <input type="hidden" name="post_id" id="post_id" value="<?php echo $post_id; ?>" />
+    <input type="hidden" name="post_id" id="post_id" value="<?php echo absint( $post_id ); ?>" />
     <?php wp_nonce_field( 'media-form' ); ?>
     <div id="media-items" class="hide-if-no-js"></div>

branches/5.5/src/wp-admin/network/site-users.php

@@ -221 +221 @@
 
 <script type="text/javascript">
-var current_site_id = <?php echo $id; ?>;
+var current_site_id = <?php echo absint( $id ); ?>;
 </script>