Changeset 8853

Timestamp:

09/09/2008 07:08:22 PM (16 years ago)

Author:

markjaquith

Message:

Put aria-required in the proper place, and use htmlspecialchars for sanitizing textarea output. Props Mike Schinkel

File:

• trunk/wp-admin/includes/media.php (modified) (1 diff)

trunk/wp-admin/includes/media.php

@@ -879 +879 @@
             $item .= $field[$field['input']];
         elseif ( $field['input'] == 'textarea' ) {
-            $item .= "<textarea type='text' id='$name' name='$name'>" . attribute_escape( $field['value'] ) . $aria_required . "</textarea>";
+            $item .= "<textarea type='text' id='$name' name='$name'" . $aria_required . ">" . htmlspecialchars( $field['value'] ) . "</textarea>";
         } else {
             $item .= "<input type='text' id='$name' name='$name' value='" . attribute_escape( $field['value'] ) . "'" . $aria_required . "/>";