Changeset 63067

Timestamp:

08/06/2026 03:44:18 PM (2 months ago)

Author:

johnbillion

Message:

Users: Prevent usernames from mangling HTML.

Props peterwilsoncc, westonruter, batmoo, xknown, jeremyfelt, lancewillett, lucasbustamante, johnbillion, jorbin, dmsnell.

Location:

trunk/src

Files:

• wp-includes/user.php (modified) (5 diffs)
• wp-login.php (modified) (2 diffs)

trunk/src/wp-includes/user.php

@@ -187 +187 @@
                                 /* translators: %s: User name. */
                                 __( '<strong>Error:</strong> The username <strong>%s</strong> is not registered on this site. If you are unsure of your username, try your email address instead.' ),
-                                $username
+                                esc_html( $username )
                         )
                 );
@@ -214 +214 @@
                                 /* translators: %s: User name. */
                                 __( '<strong>Error:</strong> The password you entered for the username %s is incorrect.' ),
-                                '<strong>' . $username . '</strong>'
+                                '<strong>' . esc_html( $username ) . '</strong>'
                         ) .
                         ' <a href="' . wp_lostpassword_url() . '">' .
@@ -297 +297 @@
                                 /* translators: %s: Email address. */
                                 __( '<strong>Error:</strong> The password you entered for the email address %s is incorrect.' ),
-                                '<strong>' . $email . '</strong>'
+                                '<strong>' . esc_html( $email ) . '</strong>'
                         ) .
                         ' <a href="' . wp_lostpassword_url() . '">' .
@@ -3588 +3588 @@
                                 /* translators: %s: Link to the login page. */
                                 __( '<strong>Error:</strong> This email address is already registered. <a href="%s">Log in</a> with this address or choose another one.' ),
-                                wp_login_url()
+                                esc_url( wp_login_url() )
                         )
                 );
@@ -3636 +3636 @@
                                 /* translators: %s: Admin email address. */
                                 __( '<strong>Error:</strong> Could not register you&hellip; please contact the <a href="mailto:%s">site admin</a>!' ),
-                                get_option( 'admin_email' )
+                                esc_attr( get_option( 'admin_email' ) )
                         )
                 );

trunk/src/wp-login.php

@@ -1215 +1215 @@
                                         /* translators: %s: Link to the login page. */
                                         __( 'Check your email for the confirmation link, then visit the <a href="%s">login page</a>.' ),
-                                        wp_login_url()
+                                        esc_url( wp_login_url() )
                                 ),
                                 'message'
@@ -1225 +1225 @@
                                         /* translators: %s: Link to the login page. */
                                         __( 'Registration complete. Please check your email, then visit the <a href="%s">login page</a>.' ),
-                                        wp_login_url()
+                                        esc_url( wp_login_url() )
                                 ),
                                 'message'