WordPress.org
Get WordPress

Make WordPress Core

Opened 13 years ago

Closed 13 years ago

#25322 closed defect (bug) (fixed)

Escape title in HTML5 search form field

Reported by: obenland Owned by: SergeyBiryukov
Priority: normal Milestone: 3.7
Component: Template Version: 3.6
Severity: normal Keywords: has-patch commit
Cc: Focuses:

Description

The title attribute in the search input of the HTML5 search form is not escaped. Not sure if a title is necessary there in the first place, but it should be properly escaped if it is.

Attachments (4)

25322.diff​ (1000 bytes ) - added by obenland 13 years ago.
general-template.patch​ (771 bytes ) - added by joostdevalk 13 years ago.
Updated patch
25322.2.diff​ (1.0 KB ) - added by scottsweb 13 years ago.
25322.3.diff​ (1000 bytes ) - added by obenland 13 years ago.

Download all attachments as: .zip

Change History (13)

@obenland
13 years ago

#1 @gizburdt
13 years ago

You're right. I don't see a reason why this shouldn't be commited.

#2 follow-up: @joostdevalk
13 years ago

  • Resolution → fixed
  • Status new → closed

This seems to be fixed in trunk, closing.

#3 in reply to: ↑ 2 @obenland
13 years ago

  • Resolution fixed
  • Status closed → reopened

Replying to joostdevalk:

This seems to be fixed in trunk, closing.

I don't think it is: ​http://core.trac.wordpress.org/browser/trunk/src/wp-includes/general-template.php#L175

@joostdevalk
13 years ago

Updated patch

#4 @joostdevalk
13 years ago

  • Keywords commit added

Ah so the patch was in fact out of date :) Just updated it. Seems ready for commit to me.

@scottsweb
13 years ago

#5 @scottsweb
13 years ago

Updated the patch by joostdevalk to use the correct function (esc_attr_x) - probably just a typo

#6 @johnbillion
13 years ago

  • Milestone 3.6.2 → 3.7

25322.2.diff​ is good to go.

Last edited 13 years ago by johnbillion (previous) (diff)

#7 @SergeyBiryukov
13 years ago

It's the title attribute in line 175 that should be escaped, not the instance in <label> tag.

@obenland
13 years ago

#8 @obenland
13 years ago

Thanks Sergey, I updated the patch.

#9 @SergeyBiryukov
13 years ago

  • Owner set to SergeyBiryukov
  • Resolution → fixed
  • Status reopened → closed

In 25710:

Escape title in HTML5 search form. props obenland, joostdevalk, scottsweb. fixes #25322.

Note: See TracTickets for help on using tickets.