WordPress.org

Make WordPress Core

Opened 3 months ago

Closed 3 months ago

#53459 closed enhancement (fixed)

Escaping function missing.

Reported by: chintan1896 Owned by: SergeyBiryukov
Milestone: 5.8 Priority: normal
Severity: normal Version:
Component: Administration Keywords: has-patch
Focuses: Cc:

Description

Escaping function missing which is use network_admin_url function.

Attachments (1)

53459.patch (4.5 KB) - added by chintan1896 3 months ago.

Download all attachments as: .zip

Change History (4)

@chintan1896
3 months ago

#1 follow-up: @mukesh27
3 months ago

  • Keywords needs-refresh added
  • Version trunk deleted

Hi there!

Can you please search network_admin_url globally in the WordPress directory and add the remaining file change?

https://github.com/WordPress/WordPress/blob/master/wp-includes/admin-bar.php#L1058
https://github.com/WordPress/WordPress/blob/master/wp-includes/link-template.php#L3738

#2 in reply to: ↑ 1 @SergeyBiryukov
3 months ago

  • Keywords needs-refresh removed
  • Milestone changed from Awaiting Review to 5.8
  • Owner set to SergeyBiryukov
  • Status changed from new to reviewing

Replying to mukesh27:

Can you please search network_admin_url globally in the WordPress directory and add the remaining file change?

https://github.com/WordPress/WordPress/blob/master/wp-includes/admin-bar.php#L1058
https://github.com/WordPress/WordPress/blob/master/wp-includes/link-template.php#L3738

It looks like those instances do not need escaping:

  • Toolbar (admin bar) links are already escaped on output, see WP_Admin_Bar::_render_item().
  • self_admin_url() is used to retrieve the raw value, pretty much like network_admin_url() itself. The value should be escaped on output according to the context, and not in the function itself (see #13051 for a previous discussion).

So the patch seems good as is :)

#3 @SergeyBiryukov
3 months ago

  • Resolution set to fixed
  • Status changed from reviewing to closed

In 51189:

Administration: Consistently escape network_admin_url() links.

Follow-up to [51177].

Props chintan1896, mukesh27.
Fixes #53459.

Note: See TracTickets for help on using tickets.