WordPress.org
Get WordPress

Make WordPress Core

Opened 13 years ago

Closed 13 years ago

Last modified 6 years ago

#24300 closed defect (bug) (fixed)

Escaping of "_format_image" textarea

Reported by: tollmanz Owned by: SergeyBiryukov
Priority: normal Milestone: 3.6
Component: Post Formats Version: 3.6
Severity: normal Keywords: has-patch
Cc: Focuses:

Description

I am seeing an issue with the escaping of the "_format_image" textarea in wp-admin/includes/post-formats.php on line 56 as of r24227. esc_html should be used instead of esc_html_e, which is meant for translatable strings.

Attachments (2)

24300.diff​ (919 bytes ) - added by tollmanz 13 years ago.
24300.2.diff​ (2.0 KB ) - added by SergeyBiryukov 13 years ago.

Download all attachments as: .zip

Change History (9)

@tollmanz
13 years ago

@SergeyBiryukov
13 years ago

#1 @SergeyBiryukov
13 years ago

  • Keywords has-patch added
  • Milestone Awaiting Review → 3.6
  • Version → trunk

Introduced in [23843] for audio and video, in [24006] for image.

#2 @SergeyBiryukov
13 years ago

  • Owner set to SergeyBiryukov
  • Resolution → fixed
  • Status new → closed

In 24228:

Use correct escaping function. props tollmanz. fixes #24300.

#3 follow-up: @johnbillion
13 years ago

Shouldn't this be esc_textarea()?

#4 in reply to: ↑ 3 @SergeyBiryukov
13 years ago

  • Resolution fixed
  • Status closed → reopened

Replying to johnbillion:

Shouldn't this be esc_textarea()?

Good call, thanks.

#5 @SergeyBiryukov
13 years ago

  • Resolution → fixed
  • Status reopened → closed

In 24230:

Use esc_textarea(), not esc_html(), for escaping textarea content. props johnbillion. fixes #24300.

#6 @tollmanz
13 years ago

Nice catch @johnbillion! I was so focused on the e that I missed the bigger picture.

This ticket was mentioned in ​Slack in #core-editor by mcsf. ​View the logs.
6 years ago

Note: See TracTickets for help on using tickets.