get_theme_mod sprint_f issue

[katielgc]

Hi there,

I have found an issue when using get_theme_mod. If we use a text field in the customizer with a percent % sign within it. it will go through the get_theme_mod function and use the sprintf function within it.

For example, I have 25% off services in the sale field. This is outputted as 25ff services. This is line 922 of wp-includes/theme.php

[joyously]

Theme options should be presentational, not contain content to display.

[davidbaumwald]

@joyously Good point. However, even if theme mods are purely presentational, this might also happen for fields used for something like percentage-based widths. A possible fix, if deemed necessary, is to escape any % characters before a $default string is passed to the sprintf() call in get_theme_mod().

[dlh]

Hi @katielgc, and welcome to WordPress Trac!

This issue sounds similar to the one already already being tracked in #34290. Could you take a look at #34290 to see whether it's the same?

[SergeyBiryukov]

Hi @katielgc, welcome to WordPress Trac!

Thanks for the report, we're already tracking this issue in #34290.

[katielgc]

Replying to joyously:

Theme options should be presentational, not contain content to display.

Thanks for your comment you can use text fields within the customizer and retrieve using get_theme_mod a user may like to have a % in their site title or if having a global banner sale we should be able to use customizer rather than creating a theme specific page for our clients.

[katielgc]

Replying to dlh:

Hi @katielgc, and welcome to WordPress Trac!

This issue sounds similar to the one already already being tracked in #34290. Could you take a look at #34290 to see whether it's the same?

Hi @dlh yes this is the same issue thank you, would a fix to this be released in the next update?

[dlh]

#34290 isn't currently scheduled to be fixed in the next release, but that could change if a patch is submitted and tested. If you're interested, feel free to review that ticket and upload a patch!