Changeset 60681 for trunk/src/wp-admin/includes/media.php

Timestamp:

08/27/2025 10:32:57 AM (8 months ago)

Author:

jonsurrell

Message:

Scripts: Use appropriate JSON encoding flags for script tags.

wp_json_encode() with default arguments is insufficient to safely escape JSON for script tags. Use JSON_HEX_TAG | JSON_UNESCAPED_SLASHES flags.

Developed in ​https://github.com/WordPress/wordpress-develop/pull/9557.

Props devasheeshkaul, jonsurrell, siliconforks.
Fixes #63851.

File:

• trunk/src/wp-admin/includes/media.php (modified) (2 diffs)

trunk/src/wp-admin/includes/media.php

@@ -275 +275 @@
     <script type="text/javascript">
     var win = window.dialogArguments || opener || parent || top;
-    win.send_to_editor( <?php echo wp_json_encode( $html ); ?> );
+    win.send_to_editor( <?php echo wp_json_encode( $html, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ); ?> );
     </script>
     <?php
@@ -2237 +2237 @@
     ?>
     var resize_height = <?php echo $large_size_h; ?>, resize_width = <?php echo $large_size_w; ?>,
-    wpUploaderInit = <?php echo wp_json_encode( $plupload_init ); ?>;
+    wpUploaderInit = <?php echo wp_json_encode( $plupload_init, JSON_HEX_TAG | JSON_UNESCAPED_SLASHES ); ?>;
     </script>