Changeset 57175 for trunk/src/wp-admin/includes/ms.php

Timestamp:

12/08/2023 09:24:26 PM (12 months ago)

Author:

SergeyBiryukov

Message:

Upload: Add missing escaping in upload_space_setting().

Follow-up to ​mu:1088, ​mu:1095, [12603].

Props utsav72640.
Fixes #58514.

File:

• trunk/src/wp-admin/includes/ms.php (modified) (1 diff)

trunk/src/wp-admin/includes/ms.php

@@ -306 +306 @@
         <th><label for="blog-upload-space-number"><?php _e( 'Site Upload Space Quota' ); ?></label></th>
         <td>
-            <input type="number" step="1" min="0" style="width: 100px" name="option[blog_upload_space]" id="blog-upload-space-number" aria-describedby="blog-upload-space-desc" value="<?php echo $quota; ?>" />
+            <input type="number" step="1" min="0" style="width: 100px"
+                name="option[blog_upload_space]" id="blog-upload-space-number"
+                aria-describedby="blog-upload-space-desc" value="<?php echo esc_attr( $quota ); ?>" />
             <span id="blog-upload-space-desc"><span class="screen-reader-text">
                 <?php