Opened 13 years ago
Closed 13 years ago
#24418 closed defect (bug) (invalid)
$meta['quote_source_name'] in get_the_post_format_quote() needs to be escaped
| Reported by: | tollmanz | Owned by: | |
|---|---|---|---|
| Priority: | normal | Milestone: | |
| Component: | Post Formats | Version: | 3.6 |
| Severity: | normal | Keywords: | has-patch |
| Cc: | Focuses: |
Description
HTML in $meta['quote_source_name'] should be escaped when accessed via get_the_post_format_quote(). Adding certain HTML to the source name can break the layout.
For instance:
This can be recreated by doing the following:
- Add a new quote post
- Give it a title and some text
- In the "Quote Source" field, add </div>
Attachments (1)
Change History (4)
Note:
See TracTickets
for help on using tickets.
![(please configure the [header_logo] section in trac.ini)](/chrome/site/your_project_logo.png)

24418.patch escapes the data with
esc_html().