Changeset 63100 for branches/6.0/src/wp-includes/blocks/post-date.php

Timestamp:

08/06/2026 07:38:52 PM (2 months ago)

Author:

desrosj

Message:

Security: Backport the WordPress 7.0.3 security fixes to the 5.9 branch.

• Users: Ensure a proper email address is used before sending email confirmations.
• Formatting: Prevent stack overflow in safecss_filter_attr.
• Multisite: Enforce the active signup policy for existing users.
• HTTP API: Improve compliance with IPv4 Special-Purpose Address Space.
• Users: Prevent Usernames from mangling HTML
• Canonical: Only redirect for publicly viewable post types.
• Administration: When wp_is_large_user_count(), ensure that the post author is always added to author dropdown.
• Editor: Fix output for post date.

Merges [63060],[63061],[63062],[63063],[63064],[63065],[63067] to the 5.9 branch.

Props xknown, westonruter, jeremyfelt, peterwilsoncc, paulkevan, lucasbustamante, jorbin, desrosj, vortfu, dmsnell, johnbillion, ehtis, batmoo, lancewillett, jonsurrell, isabel_brison, bernhard-reiter, tyxla, aduth.

File:

• branches/6.0/src/wp-includes/blocks/post-date.php (modified) (1 diff)

branches/6.0/src/wp-includes/blocks/post-date.php

@@ -24 +24 @@
         $formatted_date     = get_the_date( empty( $attributes['format'] ) ? '' : $attributes['format'], $post_ID );
         if ( isset( $attributes['isLink'] ) && $attributes['isLink'] ) {
-                $formatted_date = sprintf( '<a href="%1s">%2s</a>', get_the_permalink( $post_ID ), $formatted_date );
+                $formatted_date = sprintf( '<a href="%1$s">%2$s</a>', esc_url( get_the_permalink( $post_ID ) ), esc_html( $formatted_date ) );
+        } else {
+                $formatted_date = esc_html( $formatted_date );
         }