WordPress.org
Get WordPress

Make WordPress Core

Opened 12 years ago

Closed 12 years ago

#25322 closed defect (bug) (fixed)

Escape title in HTML5 search form field

Reported by: obenland's profile obenland Owned by: sergeybiryukov's profile SergeyBiryukov
Milestone: 3.7 Priority: normal
Severity: normal Version: 3.6
Component: Template Keywords: has-patch commit
Focuses: Cc:

Description

The title attribute in the search input of the HTML5 search form is not escaped. Not sure if a title is necessary there in the first place, but it should be properly escaped if it is.

Attachments (4)

25322.diff​ (1000 bytes) - added by obenland 12 years ago.
general-template.patch​ (771 bytes) - added by joostdevalk 12 years ago.
Updated patch
25322.2.diff​ (1.0 KB) - added by scottsweb 12 years ago.
25322.3.diff​ (1000 bytes) - added by obenland 12 years ago.

Download all attachments as: .zip

Change History (13)

@obenland
12 years ago

#1 @gizburdt
12 years ago

You're right. I don't see a reason why this shouldn't be commited.

#2 follow-up: @joostdevalk
12 years ago

  • Resolution set to fixed
  • Status changed from new to closed

This seems to be fixed in trunk, closing.

#3 in reply to: ↑ 2 @obenland
12 years ago

  • Resolution fixed deleted
  • Status changed from closed to reopened

Replying to joostdevalk:

This seems to be fixed in trunk, closing.

I don't think it is: ​http://core.trac.wordpress.org/browser/trunk/src/wp-includes/general-template.php#L175

@joostdevalk
12 years ago

Updated patch

#4 @joostdevalk
12 years ago

  • Keywords commit added

Ah so the patch was in fact out of date :) Just updated it. Seems ready for commit to me.

@scottsweb
12 years ago

#5 @scottsweb
12 years ago

Updated the patch by joostdevalk to use the correct function (esc_attr_x) - probably just a typo

#6 @johnbillion
12 years ago

  • Milestone changed from 3.6.2 to 3.7

25322.2.diff​ is good to go.

Last edited 12 years ago by johnbillion (previous) (diff)

#7 @SergeyBiryukov
12 years ago

It's the title attribute in line 175 that should be escaped, not the instance in <label> tag.

@obenland
12 years ago

#8 @obenland
12 years ago

Thanks Sergey, I updated the patch.

#9 @SergeyBiryukov
12 years ago

  • Owner set to SergeyBiryukov
  • Resolution set to fixed
  • Status changed from reopened to closed

In 25710:

Escape title in HTML5 search form. props obenland, joostdevalk, scottsweb. fixes #25322.

Note: See TracTickets for help on using tickets.