wp-admin/includes/media.php: edit_form_image_editor() missing esc_textarea() on Caption textarea.

[AlexanderOMara]

In wp-admin/includes/media.php, the funciton edit_form_image_editor() directly prints the raw post_excerpt into the description textarea. This means that if the user inputs HTML tags, the HTML when returning to edit it is invalid or potentially broken.

This:
<textarea class="widefat" name="excerpt" id="attachment_caption"><?php echo $post->post_excerpt; ?></textarea>

Should be:
<textarea class="widefat" name="excerpt" id="attachment_caption"><?php echo esc_attr( $post->post_excerpt ); ?></textarea>

[toscho]

That should be esc_textarea( $post->post_excerpt ).

[helen]

I believe $post->post_excerpt is returned already escaped. It's not further escaped in the post_excerpt_meta_box() function, either.

[AlexanderOMara]

media.php diff

[AlexanderOMara]

Thanks toscho! This is the function I had intended to use, but somehow managed to type the wrong thing. I have replaced the diff file with the correct version and corrected the title, though a feature to correct the description eludes me.

helem, $post->post_excerpt isn't escaped for me on a clean install of the latest trunk version. Entering </textarea><textarea> in the description field for an attachment results in a second textarea appearing.

[nacin]

Fixed via #24611.