Changeset 53758 for trunk/src/wp-admin/theme-editor.php

Timestamp:

07/22/2022 11:31:27 AM (4 years ago)

Author:

SergeyBiryukov

Message:

Administration: Correct the escaping in documentation lookup for plugin and theme editor.

This brings consistency to similar code fragments that evolved in slightly different ways over the years:

• A check that the list of functions is not empty now exists in both editors.
• "Function Name..." is an option label, not an attribute, so esc_html__() is the correct function here.
• esc_attr( urlencode( $function ) ) in the theme editor is replaced with esc_attr( $function ).
• htmlspecialchars( $function ) in the theme editor is replaced with esc_html( $function ).

Follow-up to [10607], [10879], [11110], [11173], [11204], [11671], [14989].

Props aristath, justinahinon, poena, audrasjb, pratiweb, SergeyBiryukov.
Fixes #56007.

File:

• trunk/src/wp-admin/theme-editor.php (modified) (1 diff)

trunk/src/wp-admin/theme-editor.php

@@ -165 +165 @@
                 $functions = wp_doc_link_parse( $content );
 
-                $docs_select  = '<select name="docs-list" id="docs-list">';
-                $docs_select .= '<option value="">' . esc_attr__( 'Function Name&hellip;' ) . '</option>';
-                foreach ( $functions as $function ) {
-                        $docs_select .= '<option value="' . esc_attr( urlencode( $function ) ) . '">' . htmlspecialchars( $function ) . '()</option>';
+                if ( ! empty( $functions ) ) {
+                        $docs_select  = '<select name="docs-list" id="docs-list">';
+                        $docs_select .= '<option value="">' . esc_html__( 'Function Name&hellip;' ) . '</option>';
+
+                        foreach ( $functions as $function ) {
+                                $docs_select .= '<option value="' . esc_attr( $function ) . '">' . esc_html( $function ) . '()</option>';
+                        }
+
+                        $docs_select .= '</select>';
                 }
-                $docs_select .= '</select>';
         }