Make WordPress Core

Opened 11 years ago

Closed 11 years ago

#13025 closed defect (bug) (wontfix)

Post titles are not escaped properly

Reported by: singpolyma Owned by:
Milestone: Priority: normal
Severity: normal Version: 2.9.2
Component: General Keywords: close
Focuses: Cc:


Post titles are supposed to be treated as plain text, but on https://singpolyma.net/2010/04/html5-doesnt-support/ it seems that entities in the post title are output unescaped? This breaks my site...

Change History (6)

#1 @solarissmoke
11 years ago

  • Keywords reporter-feedback added

I can't reproduce this - entities are escaped just fine when I try it on WP 2.9.2

Looking at wp-includes/default-filters.php, there is an esc_html action on wp_title (line 86) which ensures that the title is properly escaped.

I think that the problem is being caused by your theme.

#2 @solarissmoke
11 years ago

  • Keywords close added

#3 @solarissmoke
11 years ago

  • Keywords close removed

On further testing, I realised that it ignores known entities (of which ™ is one, and then escapes anything else. It seems that this behaviour is by design, in which case post titles are not treated as plain text, and you would have to manually escape such things.

#4 @solarissmoke
11 years ago

  • Keywords reporter-feedback removed

#5 @nacin
11 years ago

  • Keywords close added
  • Severity changed from critical to normal

#6 @dd32
11 years ago

  • Milestone Awaiting Review deleted
  • Resolution set to wontfix
  • Status changed from new to closed

As above, this is by design.

Users who do not have the unfiltered_html capability will have their titles escaped.

Note: See TracTickets for help on using tickets.