WordPress.org

Make WordPress Core

Opened 7 years ago

Closed 7 years ago

#28817 closed defect (bug) (fixed)

WP4.0-beta1 - string concatenation for $page_title in add_submenu_page() is broken

Reported by: harmr Owned by: SergeyBiryukov
Milestone: 4.0 Priority: high
Severity: major Version: 4.0
Component: Administration Keywords: has-patch commit
Focuses: administration Cc:

Description

within my plugin "Maps Marker Pro" I add a object page to show the plugin´s admin pages within the WordPress admin navigation by the following code:

$page = add_object_page('Maps Marker', 'Maps Marker', $capabilities, 'leafletmapsmarker_markers', array(&$this, 'lmm_list_markers'), LEAFLET_PLUGIN_URL . 'inc/img/icon-menu-page' . $mp6_icon . '.png' );

subpages are then added via add_submenu_page:

if ($lmm_options['misc_whitelabel_backend'] == 'enabled') {
	$menu_name = esc_attr__('Maps','lmm');
} else {
	$menu_name = '<span style="font-size:92%;">Maps Marker Pro</span>';
}
...
$page2 = add_submenu_page('leafletmapsmarker_markers', $menu_name . ' - ' . __('List all markers', 'lmm'), '<img src="' . LEAFLET_PLUGIN_URL . 'inc/img/icon-menu-list' . $mp6_icon . '.png"> ' . __('List all markers', 'lmm'), $lmm_options[ 'capabilities_edit' ], 'leafletmapsmarker_markers', array(&$this, 'lmm_list_markers') );
$page3 = add_submenu_page('leafletmapsmarker_markers', $menu_name . ' - ' . __('add/edit marker', 'lmm'), '<img src="' . LEAFLET_PLUGIN_URL . 'inc/img/icon-menu-add' . $mp6_icon . '.png"> ' . __('Add new marker', 'lmm'), $lmm_options[ 'capabilities_edit' ], 'leafletmapsmarker_marker', array(&$this, 'lmm_marker') );
...

Since WP4.0-beta1 string concentation for

$menu_name . ' - ' . __('List all markers', 'lmm')

does not work anymore - within the nav menu, the title is echoed, see attached screenshots for a comparison.

I checked the function add_submenu_page() within /wp-admin/includes/plugin.php but it didnt seem to have changed with WP4.0-beta1, so I am probably missing something here.

working nav submenu in WP 3.9.1:
http://s30.postimg.org/uie85m4u9/working_wordpress391.png

broken nav submenu in WP 4.0-beta1:
http://s18.postimg.org/4du5u83ex/broken_wordpress40beta1.png

Is this a bug with WordPress or is string concatenation as I am doing it here not supported anymore?
thanx for any hint!

Attachments (2)

28817.patch (1.6 KB) - added by SergeyBiryukov 7 years ago.
28817.2.patch (1.9 KB) - added by SergeyBiryukov 7 years ago.

Download all attachments as: .zip

Change History (5)

#1 @SergeyBiryukov
7 years ago

  • Component changed from Menus to Administration
  • Focuses administration added
  • Keywords has-patch commit added
  • Milestone changed from Awaiting Review to 4.0
  • Priority changed from normal to high
  • Severity changed from normal to major

Confirmed, thank you for the report. The code results in broken markup:

<li class="wp-first-item <span style="font-size:92%;">Maps Marker Pro</span> - List all markers">

Introduced in [28778].

  1. Both $item[3] and $sub_item[3] are reserved for page title, see [27151] and add_submenu_page().
  2. We should definitely use sanitize_html_class() there.

See 28817.patch.

Last edited 7 years ago by SergeyBiryukov (previous) (diff)

#2 @SergeyBiryukov
7 years ago

Well, sanitize_html_class() doesn't allow for multiple classes. Let's at least use esc_attr().

#3 @SergeyBiryukov
7 years ago

  • Owner set to SergeyBiryukov
  • Resolution set to fixed
  • Status changed from new to closed

In 29083:

Avoid inadvertently adding admin page titles as classes for admin menu submenu items.

fixes #28817.

Note: See TracTickets for help on using tickets.