WordPress.org
Get WordPress

Make WordPress Core

Opened 12 years ago

Closed 12 years ago

#28836 closed enhancement (fixed)

$taxonomy should be escaped in post_categories_meta_box()

Reported by: pbearne Owned by: SergeyBiryukov
Priority: normal Milestone: 4.0
Component: Taxonomy Version: 2.6
Severity: normal Keywords: has-patch commit
Cc: Focuses: administration

Description

Had a version of this code in a VIP theme and got asked to esc_attr the $taxonomy so have patch core as well

Attachments (2)

meta-boxes.php.patch​ (5.3 KB ) - added by pbearne 12 years ago.
patch with escaping added
28836.patch​ (6.2 KB ) - added by SergeyBiryukov 12 years ago.

Download all attachments as: .zip

Change History (6)

@pbearne
12 years ago

patch with escaping added

#1 @pbearne
12 years ago

  • Keywords has-patch added

#2 @DrewAPicture
12 years ago

  • Summary Added esc_attr to post_categories_meta_box() function → $taxonomy should be escaped in post_categories_meta_box()
  • Version trunk → 2.6

@SergeyBiryukov
12 years ago

#3 @SergeyBiryukov
12 years ago

  • Component General → Taxonomy
  • Focuses performance removed
  • Keywords commit added
  • Milestone Awaiting Review → 4.0

28836.patch​ follows the same approach we use in post_tags_meta_box(): $tax_name is an escaped taxonomy name, $taxonomy is a taxonomy object.

#4 @SergeyBiryukov
12 years ago

  • Owner set to SergeyBiryukov
  • Resolution → fixed
  • Status new → closed

In 29099:

Escape taxonomy name when used in attributes in post_categories_meta_box().

props pbearne.
fixes #28836.

Note: See TracTickets for help on using tickets.