Changeset 53758 for trunk/src/wp-admin/plugin-editor.php

Timestamp:

07/22/2022 11:31:27 AM (2 years ago)

Author:

SergeyBiryukov

Message:

Administration: Correct the escaping in documentation lookup for plugin and theme editor.

This brings consistency to similar code fragments that evolved in slightly different ways over the years:

• A check that the list of functions is not empty now exists in both editors.
• "Function Name..." is an option label, not an attribute, so esc_html__() is the correct function here.
• esc_attr( urlencode( $function ) ) in the theme editor is replaced with esc_attr( $function ).
• htmlspecialchars( $function ) in the theme editor is replaced with esc_html( $function ).

Follow-up to [10607], [10879], [11110], [11173], [11204], [11671], [14989].

Props aristath, justinahinon, poena, audrasjb, pratiweb, SergeyBiryukov.
Fixes #56007.

File:

• trunk/src/wp-admin/plugin-editor.php (modified) (1 diff)

trunk/src/wp-admin/plugin-editor.php

@@ -168 +168 @@
     if ( ! empty( $functions ) ) {
         $docs_select  = '<select name="docs-list" id="docs-list">';
-        $docs_select .= '<option value="">' . __( 'Function Name&hellip;' ) . '</option>';
+        $docs_select .= '<option value="">' . esc_html__( 'Function Name&hellip;' ) . '</option>';
+
         foreach ( $functions as $function ) {
             $docs_select .= '<option value="' . esc_attr( $function ) . '">' . esc_html( $function ) . '()</option>';
         }
+
         $docs_select .= '</select>';
     }