Error massage HTML tags escaped

[mako09]

esc_html() is used in the line 821 of wp-admin/includes/file.php. But the default message defined in 3 lines above has HTML tags.

        if ( $error ) {
                $error_string = __('<strong>Error:</strong> There was an error connecting to the server, Please verify the settings are correct.');
                if ( is_wp_error($error) )
                        $error_string = $error->get_error_message();
                echo '<div id="message" class="error"><p>' . esc_html( $error_string ) . '</p></div>';
        }

[SergeyBiryukov]

Since we don't seem to escape error messages in other places, I suppose we don't have to do it here too.

[nacin]

We need to here. It's possible to XSS yourself otherwise (I added this in 3.0.2.) We can just move the esc_html up a line.

[SergeyBiryukov]

Done. Couldn't yet find a description for this specific change. What about other places where get_error_message() is used, like the first instance in wp-admin/includes/media.php?

[nacin]

Only here. The username and password get sent on a long and winding path through wp-admin/includes. You might end up with this string as the error message: Username/Password incorrect for %s, where %s is the username as direct input. The area is nonced and guarded by super admin credentials, though, so it was a minor fix.

[SergeyBiryukov]

Got it, thanks.

[nacin]

(In [17200]) Don't esc_html the default error string. props SergeyBiryukov, fixes #16058.

[anthonycole]

I'm getting this escaped error message with an incorrect password...

<strong>Error:</strong> There was an error connecting to the server, Please verify the settings are correct.

[nacin]

In 3.1?

[dd32]

I've spoken with Anthony, and I believe this was a old version of a file.