Changeset 58476 for branches/6.3/src/wp-includes/blocks/template-part.php

Timestamp:

06/24/2024 03:10:50 PM (13 months ago)

Author:

audrasjb

Message:

Grouped Backports to the 6.3 branch.

• Editor: Fix Path Traversal issue on Windows in Template-Part Block.
• Editor: Sanitize Template Part HTML tag on save.
• HTML API: Run URL attributes through esc_url().

Merges [58470], [58471], [58472] and [58473] to the 6.3 branch.
Props xknown, peterwilsoncc, jorbin, bernhard-reiter, azaozz, dmsnell, gziolo.

File:

• branches/6.3/src/wp-includes/blocks/template-part.php (modified) (1 diff)

branches/6.3/src/wp-includes/blocks/template-part.php

@@ -158 +158 @@
     $content = $wp_embed->autoembed( $content );
 
-    if ( empty( $attributes['tagName'] ) ) {
+    if ( empty( $attributes['tagName'] ) || tag_escape( $attributes['tagName'] ) !== $attributes['tagName'] ) {
         $area_tag = 'div';
         if ( $area_definition && isset( $area_definition['area_tag'] ) ) {