Changeset 54834

Timestamp:

11/14/2022 11:48:18 AM (2 years ago)

Author:

SergeyBiryukov

Message:

Administration: Add missing escaping for a few strings used as HTML attributes.

Follow-up to [47209], [50997], [51006].

Props kowsar89, riccardodicurti, audrasjb, krupalpanchal, SergeyBiryukov.
Fixes #57093.

Location:

trunk/src/wp-admin

Files:

• includes/nav-menu.php (modified) (1 diff)
• nav-menus.php (modified) (1 diff)
• widgets-form.php (modified) (1 diff)

trunk/src/wp-admin/includes/nav-menu.php

@@ -525 +525 @@
         </ul><!-- .posttype-tabs -->
 
-        <div id="tabs-panel-posttype-<?php echo $post_type_name; ?>-most-recent" class="tabs-panel <?php echo ( 'most-recent' === $current_tab ? 'tabs-panel-active' : 'tabs-panel-inactive' ); ?>" role="region" aria-label="<?php _e( 'Most Recent' ); ?>" tabindex="0">
+        <div id="tabs-panel-posttype-<?php echo $post_type_name; ?>-most-recent" class="tabs-panel <?php echo ( 'most-recent' === $current_tab ? 'tabs-panel-active' : 'tabs-panel-inactive' ); ?>" role="region" aria-label="<?php esc_attr_e( 'Most Recent' ); ?>" tabindex="0">
             <ul id="<?php echo $post_type_name; ?>checklist-most-recent" class="categorychecklist form-no-clear">
                 <?php

trunk/src/wp-admin/nav-menus.php

@@ -1041 +1041 @@
                                         <span class="bulk-select-button-label"><?php _e( 'Bulk Select' ); ?></span>
                                     </label>
-                                    <input type="button" class="deletion menu-items-delete disabled" value="<?php _e( 'Remove Selected Items' ); ?>">
+                                    <input type="button" class="deletion menu-items-delete disabled" value="<?php esc_attr_e( 'Remove Selected Items' ); ?>">
                                     <div id="pending-menu-items-to-delete">
                                         <p><?php _e( 'List of menu items selected for deletion:' ); ?></p>

trunk/src/wp-admin/widgets-form.php

@@ -333 +333 @@
         <div class="alignleft">
             <?php if ( ! isset( $_GET['addnew'] ) ) : ?>
-                <input type="submit" name="removewidget" id="removewidget" class="button-link button-link-delete widget-control-remove" value="<?php _e( 'Delete' ); ?>" />
+                <input type="submit" name="removewidget" id="removewidget" class="button-link button-link-delete widget-control-remove" value="<?php esc_attr_e( 'Delete' ); ?>" />
                 <span class="widget-control-close-wrapper">
                     | <a href="widgets.php" class="button-link widget-control-close"><?php _e( 'Cancel' ); ?></a>