Changeset 64874

Timestamp:

10/28/2026 01:27:32 PM (35 hours ago)

Author:

jeremyfelt

Message:

Privacy: Harden column_email() output escaping in request list tables

Props xknown, westonruter, jeremyfelt.

Location:

trunk/src/wp-admin/includes

Files:

• class-wp-privacy-data-export-requests-list-table.php (modified) (1 diff)
• class-wp-privacy-data-removal-requests-list-table.php (modified) (1 diff)
• class-wp-privacy-requests-table.php (modified) (2 diffs)

trunk/src/wp-admin/includes/class-wp-privacy-data-export-requests-list-table.php

@@ -99 +99 @@
                 }
 
-                return sprintf( '<a href="%1$s">%2$s</a> %3$s', esc_url( 'mailto:' . $item->email ), $item->email, $this->row_actions( $row_actions ) );
+                return sprintf( '<a href="%1$s">%2$s</a> %3$s', esc_url( 'mailto:' . $item->email ), esc_html( $item->email ), $this->row_actions( $row_actions ) );
         }
 

trunk/src/wp-admin/includes/class-wp-privacy-data-removal-requests-list-table.php

@@ -105 +105 @@
                 }
 
-                return sprintf( '<a href="%1$s">%2$s</a> %3$s', esc_url( 'mailto:' . $item->email ), $item->email, $this->row_actions( $row_actions ) );
+                return sprintf( '<a href="%1$s">%2$s</a> %3$s', esc_url( 'mailto:' . $item->email ), esc_html( $item->email ), $this->row_actions( $row_actions ) );
         }
 

trunk/src/wp-admin/includes/class-wp-privacy-requests-table.php

@@ -426 +426 @@
                         esc_attr( $item->ID ),
                         /* translators: Hidden accessibility text. %s: Email address. */
-                        sprintf( __( 'Select %s' ), $item->email )
+                        sprintf( __( 'Select %s' ), esc_html( $item->email ) )
                 );
         }
@@ -552 +552 @@
          */
         public function column_email( $item ) {
-                return sprintf( '<a href="%1$s">%2$s</a> %3$s', esc_url( 'mailto:' . $item->email ), $item->email, $this->row_actions( array() ) );
+                return sprintf( '<a href="%1$s">%2$s</a> %3$s', esc_url( 'mailto:' . $item->email ), esc_html( $item->email ), $this->row_actions( array() ) );
         }