WordPress.org
Get WordPress

Make WordPress Core

Opened 12 years ago

Closed 12 years ago

Last modified 12 years ago

#30651 closed enhancement (fixed)

Twenty Fifteen: esc_html_e() for "Published by" string in author-bio.php

Reported by: iamtakashi Owned by: iandstewart
Priority: normal Milestone: 4.1
Component: Bundled Theme Version: 4.1
Severity: normal Keywords: has-patch
Cc: Focuses:

Description

Currently _e is used for the string but I believe it's better to use esc_html_e() instead.

Attachments (1)

30651.diff​ (535 bytes ) - added by iamtakashi 12 years ago.

Download all attachments as: .zip

Change History (5)

@iamtakashi
12 years ago

#1 @iandstewart
12 years ago

  • Owner set to iandstewart
  • Resolution → fixed
  • Status new → closed

In 30805:

Twenty Fifteen: correct escaping.

Props iamtakashi, fixes #30651.

#2 @nacin
12 years ago

_e() is proper here. I'm working on a security audit of Twenty Fifteen so I'll revert this sometime in RC.

#3 @TomasM
12 years ago

Is there anywhere a clear guidance for the theme developers on when to use escaping?

I follow the development of _s and default WP themes to make my themes better and recently in Twenty Fifteen and _s there was escaping promoted. Now, when I applied those changes to my theme I will have to revert :-/

Is there any harm for having escaping in place?

Note: See TracTickets for help on using tickets.