Make WordPress Core

Opened 8 years ago

Closed 8 years ago

#44274 closed defect (bug) (fixed)

htmlspecialchars call in template.php needs to be update

Reported by: khaihong Owned by: johnbillion
Priority: normal Milestone: 4.9.7
Component: Options, Meta APIs Version:
Severity: normal Keywords: has-patch fixed-major
Cc: Focuses:

Description

Under wp-admin/includes/, the call needs to be changed from
htmlspecialchars($context))
to
htmlspecialchars($context, $flags=NULL, $encoding='UTF-8'))

Otherwise, there are constant debug warnings:
htmlspecialchars(): charset not supported, assuming utf-8

I've had those warnings for themes twenty-fourteen and twenty-seventeen, using only 2 active plugins Query Monitor and Really Simple SSL.

Attachments (6)

44274 (740 bytes ) - added by abdullahramzan 8 years ago.
44274.1.diff (740 bytes ) - added by abdullahramzan 8 years ago.
Please consider this one.
template.php.patch (631 bytes ) - added by leanderiversen 8 years ago.
template.diff (758 bytes ) - added by aryamaaru 8 years ago.
44274.2.diff (766 bytes ) - added by lbenicio 8 years ago.
44274.3.diff (1.4 KB ) - added by palmiak 8 years ago.

Download all attachments as: .zip

Change History (13)

#1 @johnbillion
8 years ago

  • Keywords needs-patch good-first-bug added
  • Milestone Awaiting ReviewFuture Release

Thanks for the report, @khaihong! Welcome to WordPress Trac.

It looks like this warning is coming from the do_meta_boxes() function. The $context parameter should be escaped with esc_attr() instead of htmlspecialchars().

@abdullahramzan
8 years ago

@abdullahramzan
8 years ago

Please consider this one.

#2 @SergeyBiryukov
8 years ago

  • Component GeneralOptions, Meta APIs
  • Milestone Future Release5.0

esc_attr() accepts 1 parameter, not 3.

@aryamaaru
8 years ago

@lbenicio
8 years ago

#3 @leanderiversen
8 years ago

Like @SergeyBiryukov mentioned, esc_attr() only accepts 1 parameter.

@palmiak
8 years ago

#4 @johnbillion
8 years ago

  • Keywords has-patch added; needs-patch good-first-bug removed
  • Milestone 5.04.9.7
  • Owner set to johnbillion
  • Status newreviewing

#5 @johnbillion
8 years ago

  • Resolutionfixed
  • Status reviewingclosed

In 43365:

Options, Meta APIs: Use the correct escaping function when outputting the meta box context.

Props khaihong, abdullahramzan, leanderiversen, aryamaaru, lbenicio, palmiak

Fixes #44274

#6 @johnbillion
8 years ago

  • Keywords fixed-major added
  • Resolution fixed
  • Status closedreopened

#7 @johnbillion
8 years ago

  • Resolutionfixed
  • Status reopenedclosed

In 43366:

Options, Meta APIs: Use the correct escaping function when outputting the meta box context.

Props khaihong, abdullahramzan, leanderiversen, aryamaaru, lbenicio, palmiak

Fixes #44274

Merges [43365] to the 4.9 branch.

Note: See TracTickets for help on using tickets.