WordPress.org

Make WordPress Core

Opened 15 months ago

Last modified 6 months ago

#44916 assigned defect (bug)

Add escape in walker nav menu title

Reported by: harshall Owned by: welcher
Milestone: Awaiting Review Priority: normal
Severity: normal Version:
Component: Menus Keywords: has-patch needs-unit-tests close
Focuses: Cc:
PR Number:

Description

Escape walker nav menu title after applying filter

Attachments (2)

44916.diff (647 bytes) - added by harshall 15 months ago.
44916.2.diff (573 bytes) - added by welcher 8 months ago.
Adds late escaping

Download all attachments as: .zip

Change History (7)

@harshall
15 months ago

#1 @mukesh27
15 months ago

  • Keywords 2nd-opinion added
  • Summary changed from Escape walker nav menu title to Add escape in walker nav menu title

Hi @harshall, welcome to WordPress Trac! Thanks for the ticket.

i have check other instance of menu title but escape is not added in menu title.

#2 @Hareesh Pillai
11 months ago

This is a good check to add, as the filter response may return invalid output.

@welcher
8 months ago

Adds late escaping

#3 @welcher
8 months ago

  • Keywords needs-unit-tests added; 2nd-opinion removed
  • Owner set to welcher
  • Status changed from new to assigned

@harshall I've updated the patch against latest trunk and modified it to use late escaping as well.

It can probably do with some unit tests.

#4 @welcher
6 months ago

  • Milestone changed from Awaiting Review to 5.2.2

#5 @SergeyBiryukov
6 months ago

  • Keywords close added
  • Milestone changed from 5.2.2 to Awaiting Review

Historically, HTML is allowed in titles, see discussions in #4789, #14361, #22436.

Markup is allowed in post titles and it gets sanitized by KSES, meaning users without the unfiltered_html capability are limited to tags such as <strong>, <em>, and a few others.

If we do decide to reconsider this, there are multiple places where titles are not escaped, but at least Walker_Page should be updated for consistency.

Note: See TracTickets for help on using tickets.