Make WordPress Core

Opened 13 years ago

Closed 13 years ago

#20106 closed defect (bug) (fixed)

Escape links in get_the_term_list function

Reported by: alex-ye's profile alex-ye Owned by: ryan's profile ryan
Milestone: 3.4 Priority: normal
Severity: normal Version: 3.3.1
Component: Taxonomy Keywords: has-patch commit
Focuses: Cc:

Description

When I was working in my new website , I create a copy function to get_the_term_list() just to escape the links in it , because there is no filters to do that and I was wondering WHY YOU ARE NOT ESCAPE THE LINKS ?

Attachments (2)

20106.diff (586 bytes) - added by solarissmoke 13 years ago.
add esc_url
20106.2.patch (5.1 KB) - added by SergeyBiryukov 13 years ago.

Download all attachments as: .zip

Change History (8)

@solarissmoke
13 years ago

add esc_url

#1 @solarissmoke
13 years ago

  • Keywords has-patch added; needs-patch removed

Yup, should be escaping those links.

#2 @SergeyBiryukov
13 years ago

  • Milestone changed from Awaiting Review to 3.4

#3 in reply to: ↑ description ; follow-up: @SergeyBiryukov
13 years ago

Replying to alex-ye:

I create a copy function to get_the_term_list() just to escape the links in it , because there is no filters to do that

Well, there is "term_links-$taxonomy", though I guess using it to escape the links would require preg_replace().

There are more unescaped links in wp-includes/category-template.php. Not sure if all of them should be escaped, but most of them are returned by get_term_link() as well, and it probably makes sense to be consistent. Made the patch just in case.

#4 in reply to: ↑ 3 @alex-ye
13 years ago

Replying to SergeyBiryukov:

Well, there is "term_links-$taxonomy", though I guess using it to escape the links would require preg_replace().

As you know using preg_replace() to do that it is not good to performance , If you know some cases that don't need to escape we can add a option ( Function Var ) .

#5 @nacin
13 years ago

  • Keywords commit added

#6 @ryan
13 years ago

  • Owner set to ryan
  • Resolution set to fixed
  • Status changed from new to closed

In [20656]:

Escape term links output in category-template.php functions. Props SergeyBiryukov, solarissmoke, alex-ye. fixes #20106

Note: See TracTickets for help on using tickets.