Changeset 51080

Timestamp:

06/07/2021 06:45:56 PM (3 years ago)

Author:

SergeyBiryukov

Message:

Comments: Escape comment author's email in the Edit Comment form.

Technically, this is redundant, as the comment_author, comment_author_email, and comment_author_url fields are already escaped via get_comment_to_edit() before the form is displayed.

However, this brings some consistency with the comment_author and comment_author_url fields being escaped in the same form.

Follow-up to [11721].

Props utsav72640.
Fixes #53349.

File:

• trunk/src/wp-admin/edit-form-comment.php (modified) (1 diff)

trunk/src/wp-admin/edit-form-comment.php

@@ -53 +53 @@
     <td class="first"><label for="email"><?php _e( 'Email' ); ?></label></td>
     <td>
-        <input type="text" name="newcomment_author_email" size="30" value="<?php echo $comment->comment_author_email; ?>" id="email" />
+        <input type="text" name="newcomment_author_email" size="30" value="<?php echo esc_attr( $comment->comment_author_email ); ?>" id="email" />
     </td>
 </tr>