Make WordPress Core

Opened 8 years ago

Closed 8 years ago

Last modified 7 months ago

#24300 closed defect (bug) (fixed)

Escaping of "_format_image" textarea

Reported by: tollmanz Owned by: SergeyBiryukov
Milestone: 3.6 Priority: normal
Severity: normal Version: 3.6
Component: Post Formats Keywords: has-patch
Focuses: Cc:


I am seeing an issue with the escaping of the "_format_image" textarea in wp-admin/includes/post-formats.php on line 56 as of r24227. esc_html should be used instead of esc_html_e, which is meant for translatable strings.

Attachments (2)

24300.diff (919 bytes) - added by tollmanz 8 years ago.
24300.2.diff (2.0 KB) - added by SergeyBiryukov 8 years ago.

Download all attachments as: .zip

Change History (9)

8 years ago

#1 @SergeyBiryukov
8 years ago

  • Keywords has-patch added
  • Milestone changed from Awaiting Review to 3.6
  • Version set to trunk

Introduced in [23843] for audio and video, in [24006] for image.

#2 @SergeyBiryukov
8 years ago

  • Owner set to SergeyBiryukov
  • Resolution set to fixed
  • Status changed from new to closed

In 24228:

Use correct escaping function. props tollmanz. fixes #24300.

#3 follow-up: @johnbillion
8 years ago

Shouldn't this be esc_textarea()?

#4 in reply to: ↑ 3 @SergeyBiryukov
8 years ago

  • Resolution fixed deleted
  • Status changed from closed to reopened

Replying to johnbillion:

Shouldn't this be esc_textarea()?

Good call, thanks.

#5 @SergeyBiryukov
8 years ago

  • Resolution set to fixed
  • Status changed from reopened to closed

In 24230:

Use esc_textarea(), not esc_html(), for escaping textarea content. props johnbillion. fixes #24300.

#6 @tollmanz
8 years ago

Nice catch @johnbillion! I was so focused on the e that I missed the bigger picture.

This ticket was mentioned in Slack in #core-editor by mcsf. View the logs.

7 months ago

Note: See TracTickets for help on using tickets.