Changeset 8499

Timestamp:

07/30/2008 06:38:40 AM (17 years ago)

Author:

westi

Message:

Avoid possible XSS when displaying the list of invalid plugins fixes #6871 for trunk props xknown.

File:

• trunk/wp-admin/plugins.php (modified) (1 diff)

trunk/wp-admin/plugins.php

@@ -169 +169 @@
 if( !empty($invalid) )
     foreach($invalid as $plugin_file => $error)
-        echo '<div id="message" class="error"><p>' . sprintf(__('The plugin <code>%s</code> has been <strong>deactivated</strong> due to an error: %s'), $plugin_file, $error->get_error_message()) . '</p></div>';
+        echo '<div id="message" class="error"><p>' . sprintf(__('The plugin <code>%s</code> has been <strong>deactivated</strong> due to an error: %s'), wp_specialchars($plugin_file), $error->get_error_message()) . '</p></div>';
 ?>