Changeset 62006 for branches/4.7/src/wp-admin/includes/class-walker-nav-menu-edit.php

Timestamp:

03/13/2026 01:05:42 PM (7 months ago)

Author:

johnbillion

Message:

Grouped backports for the 4.7 branch.

• XML-RPC: Switch to wp_safe_remote() when fetching a pingback URL.
• HTML API: Prevent WP_HTML_Tag_Processor instances being unserialized and add some extra logic for validating pattern and template file paths.
• KSES: Optimize PCRE pattern detecting numeric character references.
• Customize: Improve escaping approach used for nav menu attributes.
• Media: Ensure the attachment parent is accessible to the user before showing a link to it in the media manager.
• Administration: Ensure client-side templates are only detected when they're correctly associated with a script tag.
• Filesystem API: Don't attempt to extract invalid files from a zip when using the PclZip library.

Merges [61879-61884,61886-61887,61890,61913] to the 4.7 branch.

Props johnbillion, xknown, dmsnell, jorbin, peterwilson, desrosj, westonruter, jonsurrell, audrasjb.

Location:

branches/4.7

Files:

• . (modified) (1 prop)
• src/wp-admin/includes/class-walker-nav-menu-edit.php (modified) (4 diffs)

branches/4.7/src/wp-admin/includes/class-walker-nav-menu-edit.php

@@ -163 +163 @@
                                         <label for="edit-menu-item-title-<?php echo $item_id; ?>">
                                                 <?php _e( 'Navigation Label' ); ?><br />
-                                                <input type="text" id="edit-menu-item-title-<?php echo $item_id; ?>" class="widefat edit-menu-item-title" name="menu-item-title[<?php echo $item_id; ?>]" value="<?php echo esc_attr( $item->title ); ?>" />
+                                                <input type="text" id="edit-menu-item-title-<?php echo $item_id; ?>" class="widefat edit-menu-item-title" name="menu-item-title[<?php echo $item_id; ?>]" value="<?php echo htmlspecialchars( $item->title, ENT_QUOTES ); ?>" />
                                         </label>
                                 </p>
@@ -169 +169 @@
                                         <label for="edit-menu-item-attr-title-<?php echo $item_id; ?>">
                                                 <?php _e( 'Title Attribute' ); ?><br />
-                                                <input type="text" id="edit-menu-item-attr-title-<?php echo $item_id; ?>" class="widefat edit-menu-item-attr-title" name="menu-item-attr-title[<?php echo $item_id; ?>]" value="<?php echo esc_attr( $item->post_excerpt ); ?>" />
+                                                <input type="text" id="edit-menu-item-attr-title-<?php echo $item_id; ?>" class="widefat edit-menu-item-attr-title" name="menu-item-attr-title[<?php echo $item_id; ?>]" value="<?php echo htmlspecialchars( $item->post_excerpt, ENT_QUOTES ); ?>" />
                                         </label>
                                 </p>
@@ -181 +181 @@
                                         <label for="edit-menu-item-classes-<?php echo $item_id; ?>">
                                                 <?php _e( 'CSS Classes (optional)' ); ?><br />
-                                                <input type="text" id="edit-menu-item-classes-<?php echo $item_id; ?>" class="widefat code edit-menu-item-classes" name="menu-item-classes[<?php echo $item_id; ?>]" value="<?php echo esc_attr( implode(' ', $item->classes ) ); ?>" />
+                                                <input type="text" id="edit-menu-item-classes-<?php echo $item_id; ?>" class="widefat code edit-menu-item-classes" name="menu-item-classes[<?php echo $item_id; ?>]" value="<?php echo htmlspecialchars( implode( ' ', $item->classes ), ENT_QUOTES ); ?>" />
                                         </label>
                                 </p>
@@ -187 +187 @@
                                         <label for="edit-menu-item-xfn-<?php echo $item_id; ?>">
                                                 <?php _e( 'Link Relationship (XFN)' ); ?><br />
-                                                <input type="text" id="edit-menu-item-xfn-<?php echo $item_id; ?>" class="widefat code edit-menu-item-xfn" name="menu-item-xfn[<?php echo $item_id; ?>]" value="<?php echo esc_attr( $item->xfn ); ?>" />
+                                                <input type="text" id="edit-menu-item-xfn-<?php echo $item_id; ?>" class="widefat code edit-menu-item-xfn" name="menu-item-xfn[<?php echo $item_id; ?>]" value="<?php echo htmlspecialchars( $item->xfn, ENT_QUOTES ); ?>" />
                                         </label>
                                 </p>