Make WordPress Core


Ignore:
Timestamp:
08/30/2022 03:54:51 PM (2 years ago)
Author:
SergeyBiryukov
Message:

Grouped backports to the 3.9 branch.

  • Posts, Post Types: Escape output within the_meta().
  • General: Ensure bookmark query limits are numeric.
  • Plugins: Escape output in error messages.

Merges [53958-53960] to the 3.9 branch.
Props tykoted, martinkrcho, xknown, dd32, peterwilsoncc, paulkevan, timothyblynjacobs.

Location:
branches/3.9
Files:
2 edited

Legend:

Unmodified
Added
Removed
  • branches/3.9

  • branches/3.9/src/wp-admin/plugins.php

    r41449 r53984  
    377377if ( !empty($invalid) )
    378378    foreach ( $invalid as $plugin_file => $error )
    379         echo '<div id="message" class="error"><p>' . sprintf(__('The plugin <code>%s</code> has been <strong>deactivated</strong> due to an error: %s'), esc_html($plugin_file), $error->get_error_message()) . '</p></div>';
     379        echo '<div id="message" class="error"><p>' . sprintf(__('The plugin <code>%s</code> has been <strong>deactivated</strong> due to an error: %s'), esc_html($plugin_file), esc_html( $error->get_error_message() ) ) . '</p></div>';
    380380?>
    381381
     
    403403
    404404        if ( is_wp_error($delete_result) ) : ?>
    405         <div id="message" class="updated"><p><?php printf( __('Plugin could not be deleted due to an error: %s'), $delete_result->get_error_message() ); ?></p></div>
     405        <div id="message" class="updated"><p><?php printf( __('Plugin could not be deleted due to an error: %s'), esc_html( $delete_result->get_error_message() ) ); ?></p></div>
    406406        <?php else : ?>
    407407        <div id="message" class="updated"><p><?php _e('The selected plugins have been <strong>deleted</strong>.'); ?></p></div>
Note: See TracChangeset for help on using the changeset viewer.