![(please configure the [header_logo] section in trac.ini)](/chrome/site/your_project_logo.png){kind=logo}
Opened 13 years ago
Closed 22 months ago
#24907 closed defect (bug) (fixed)
Escape admin_url() when used for ajax_url in admin header
| Reported by: | jeremyfelt | Owned by: | |
|---|---|---|---|
| Priority: | normal | Milestone: | 5.5 |
| Component: | Security | Version: | 2.7 |
| Severity: | normal | Keywords: | has-patch needs-testing |
| Cc: | Focuses: |
Description
As admin_url() is filtered right before returning, it should be escaped when output for use as the ajax_url in the admin.
Attachments (3)
Change History (11)
#1
@
13 years ago
Version 0, edited 13 years ago by
(next)
#2
@
13 years ago
esc_url() isn't right, as it encodes ampersands for display. At most you'd want esc_url_raw() — but really, we're just looking to avoid issues with escaping data for a JS string.
#4
@
13 years ago
esc_js() would work but is intended for escaping of inline JS. The _wp_specialchars() used there could break it. Don't think we have a suitable esc_* function when we echo arbitrary PHP strings inside a <script> tag.
Note:
See TracTickets
for help on using tickets.
I think we should be json encoding PHP string variables when outputting to javascript. This eliminates the need for escaping and surrounding with quotes.