WordPress.org
Get WordPress

Make WordPress Core

Opened 5 years ago

Closed 5 years ago

Last modified 5 years ago

#54295 closed enhancement (fixed)

Unnecessarily escaped values in various customizer control in wp-includes/cusstomizer

Reported by: sabbirshouvo Owned by:
Priority: normal Milestone: 5.9
Component: Customize Version:
Severity: normal Keywords: has-patch
Cc: Focuses: coding-standards

Description

In most cases data.description is not needed to escape but escaped in multiple controls. Also in wp-includes/class-wp-customize-control.php some labels and ids are not properly escaped.

Attachments (1)

54295.diff​ (4.2 KB ) - added by sabbirshouvo 5 years ago.

Download all attachments as: .zip

Change History (6)

@sabbirshouvo
5 years ago

#1 @SergeyBiryukov
5 years ago

  • Milestone Awaiting Review → 5.9

#2 @SergeyBiryukov
5 years ago

In 51927:

Coding Standards: Escape id attributes in WP_Customize_Control::render_content() and ::print_template().

Follow-up to [30014], [38906].

Props sabbirshouvo.
See #54295.

This ticket was mentioned in ​Slack in #core by sergey. ​View the logs.
5 years ago

#4 @hellofromTonya
5 years ago

  • Resolution → fixed
  • Status assigned → closed

Closing as the patch is committed and will ship in 5.9.

#5 @SergeyBiryukov
5 years ago

Just noting that only the first part of the patch was committed, which adds some missing esc_attr() calls.

I did not touch the (presumably) unnecessarily escaped values, as that required more investigation and I don't see any harm in leaving them as is for now. If anyone thinks that part should be addressed as well, feel free to reopen.

Note: See TracTickets for help on using tickets.