WordPress.org
Get WordPress

Make WordPress Core

Opened 7 years ago

Closed 7 years ago

#40216 closed defect (bug) (fixed)

Twenty Seventeen: Some parts do not escape html attributes

Reported by: bor0's profile bor0 Owned by: sergeybiryukov's profile SergeyBiryukov
Milestone: 4.7.4 Priority: normal
Severity: normal Version: 4.7
Component: Bundled Theme Keywords: has-patch fixed-major
Focuses: Cc:

Description

There are appearances like:
https://core.trac.wordpress.org/browser/trunk/src/wp-content/themes/twentyseventeen/footer.php#L25
https://core.trac.wordpress.org/browser/trunk/src/wp-content/themes/twentyseventeen/template-parts/navigation/navigation-top.php#L12

_e() in these cases should actually be esc_attr_e() to ensure the translated string gets escaped for an HTML attribute context, because the translated string from another language could potentially have a character that would need to be escaped.

Attachments (1)

40216.diff​ (1.5 KB) - added by bor0 7 years ago.

Download all attachments as: .zip

Change History (7)

@bor0
7 years ago

#1 @bor0
7 years ago

  • Keywords has-patch added

#2 @SergeyBiryukov
7 years ago

  • Component changed from Security to Bundled Theme
  • Milestone changed from Awaiting Review to 4.8
  • Summary changed from Some parts of Twentyseventeen do not esc html attr to Twenty Seventeen: Some parts do not escape html attributes

#3 @iandunn
7 years ago

Here are future-proof links to the lines in question:

( linking to trunk is problematic, because those line numbers will invariably change in the future, and anyone who wants to look at the links will have to spend extra time to find the original ones )

#4 @SergeyBiryukov
7 years ago

  • Owner set to SergeyBiryukov
  • Resolution set to fixed
  • Status changed from new to closed

In 40311:

Twenty Seventeen: Use esc_attr_e() for translatable strings in HTML attributes.

Props bor0.
Fixes #40216.

#5 @SergeyBiryukov
7 years ago

  • Keywords fixed-major added
  • Milestone changed from 4.8 to 4.7.4
  • Resolution fixed deleted
  • Status changed from closed to reopened

Reopening for 4.7.4 consideration.

#6 @swissspidy
7 years ago

  • Resolution set to fixed
  • Status changed from reopened to closed

In 40374:

Twenty Seventeen: Use esc_attr_e() for translatable strings in HTML attributes.

Props bor0.
Fixes #40216.

Merges [40311] to the 4.7 branch.

Note: See TracTickets for help on using tickets.