Changeset 60681 for trunk/src/wp-admin/customize.php

Timestamp:

08/27/2025 10:32:57 AM (8 months ago)

Author:

jonsurrell

Message:

Scripts: Use appropriate JSON encoding flags for script tags.

wp_json_encode() with default arguments is insufficient to safely escape JSON for script tags. Use JSON_HEX_TAG | JSON_UNESCAPED_SLASHES flags.

Developed in ​https://github.com/WordPress/wordpress-develop/pull/9557.

Props devasheeshkaul, jonsurrell, siliconforks.
Fixes #63851.

File:

• trunk/src/wp-admin/customize.php (modified) (2 diffs)

trunk/src/wp-admin/customize.php

@@ -63 +63 @@
         <?php wp_print_scripts( array( 'wp-util' ) ); ?>
         <script>
-            wp.ajax.post( 'customize_save', <?php echo wp_json_encode( $request_args ); ?> );
+            wp.ajax.post( 'customize_save', <?php echo wp_json_encode( $request_args, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ); ?> );
         </script>
         <?php
@@ -159 +159 @@
 
 <script type="text/javascript">
-var ajaxurl = <?php echo wp_json_encode( admin_url( 'admin-ajax.php', 'relative' ) ); ?>,
+var ajaxurl = <?php echo wp_json_encode( admin_url( 'admin-ajax.php', 'relative' ), JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ); ?>,
     pagenow = 'customize';
 </script>