Changeset 53640

Timestamp:

07/04/2022 08:14:41 AM (4 years ago)

Author:

audrasjb

Message:

Comments: Use more appropriate escaping functions in class WP_Comments_List_Table.

This changeset replaces esc_attr escaping function with esc_html as it is more appropriate in this context.

Props chintan1896, afragen, peterwilsoncc, SergeyBiryukov.
Fixes #56101.

File:

• trunk/src/wp-admin/includes/class-wp-comments-list-table.php (modified) (1 diff)

trunk/src/wp-admin/includes/class-wp-comments-list-table.php

@@ -918 +918 @@
                 <div id="inline-<?php echo $comment->comment_ID; ?>" class="hidden">
                         <textarea class="comment" rows="1" cols="1"><?php echo esc_textarea( $comment_content ); ?></textarea>
-                        <div class="author-email"><?php echo esc_attr( $comment->comment_author_email ); ?></div>
-                        <div class="author"><?php echo esc_attr( $comment->comment_author ); ?></div>
+                        <div class="author-email"><?php echo esc_html( $comment->comment_author_email ); ?></div>
+                        <div class="author"><?php echo esc_html( $comment->comment_author ); ?></div>
                         <div class="author-url"><?php echo esc_url( $comment->comment_author_url ); ?></div>
                         <div class="comment_status"><?php echo $comment->comment_approved; ?></div>