WordPress.org

Make WordPress Core

Opened 3 months ago

Closed 3 months ago

#40216 closed defect (bug) (fixed)

Twenty Seventeen: Some parts do not escape html attributes

Reported by: bor0 Owned by: SergeyBiryukov
Milestone: 4.7.4 Priority: normal
Severity: normal Version: 4.7
Component: Bundled Theme Keywords: has-patch fixed-major
Focuses: Cc:

Description

There are appearances like:
https://core.trac.wordpress.org/browser/trunk/src/wp-content/themes/twentyseventeen/footer.php#L25
https://core.trac.wordpress.org/browser/trunk/src/wp-content/themes/twentyseventeen/template-parts/navigation/navigation-top.php#L12

_e() in these cases should actually be esc_attr_e() to ensure the translated string gets escaped for an HTML attribute context, because the translated string from another language could potentially have a character that would need to be escaped.

Attachments (1)

40216.diff (1.5 KB) - added by bor0 3 months ago.

Download all attachments as: .zip

Change History (7)

@bor0
3 months ago

#1 @bor0
3 months ago

  • Keywords has-patch added

#2 @SergeyBiryukov
3 months ago

  • Component changed from Security to Bundled Theme
  • Milestone changed from Awaiting Review to 4.8
  • Summary changed from Some parts of Twentyseventeen do not esc html attr to Twenty Seventeen: Some parts do not escape html attributes

#3 @iandunn
3 months ago

Here are future-proof links to the lines in question:

( linking to trunk is problematic, because those line numbers will invariably change in the future, and anyone who wants to look at the links will have to spend extra time to find the original ones )

#4 @SergeyBiryukov
3 months ago

  • Owner set to SergeyBiryukov
  • Resolution set to fixed
  • Status changed from new to closed

In 40311:

Twenty Seventeen: Use esc_attr_e() for translatable strings in HTML attributes.

Props bor0.
Fixes #40216.

#5 @SergeyBiryukov
3 months ago

  • Keywords fixed-major added
  • Milestone changed from 4.8 to 4.7.4
  • Resolution fixed deleted
  • Status changed from closed to reopened

Reopening for 4.7.4 consideration.

#6 @swissspidy
3 months ago

  • Resolution set to fixed
  • Status changed from reopened to closed

In 40374:

Twenty Seventeen: Use esc_attr_e() for translatable strings in HTML attributes.

Props bor0.
Fixes #40216.

Merges [40311] to the 4.7 branch.

Note: See TracTickets for help on using tickets.