WordPress.org
Get WordPress

Make WordPress Core

Opened 18 months ago

Closed 18 months ago

Last modified 18 months ago

#56064 closed enhancement (fixed)

PHPCS issue in wp-admin/include/media.php .

Reported by: smit08's profile smit08 Owned by: sergeybiryukov's profile SergeyBiryukov
Milestone: 6.1 Priority: normal
Severity: normal Version:
Component: Media Keywords: has-patch commit
Focuses: coding-standards Cc:

Description

Used escaping function esc_attr instead of esc_url. 

$html = '<a href="' . esc_attr( $url ) . '"' . $rel . '>' . $html . '</a>';

Attachments (1)

56064.patch​ (1.2 KB) - added by smit08 18 months ago.

Download all attachments as: .zip

Change History (6)

@smit08
18 months ago

#1 @mukesh27
18 months ago

  • Focuses coding-standards added
  • Keywords has-patch commit added; needs-patch removed

Hi there!

Thanks for the ticket and patch. The 56064.patch​ patch makes sense to me and it's better to check the correct escape function for URL's enhancement.

commit keyword added.

#2 @mukesh27
18 months ago

  • Milestone changed from Awaiting Review to 6.1

#3 @SergeyBiryukov
18 months ago

Hi there, thanks for the patch!

It looks like esc_attr() was used here as of [12051] / #10252, since esc_url() did not work correctly with some accented characters at the time, see #10859.

Since #10859 was fixed in [12199], and esc_url() no longer returns an empty string for the URL listed there in my testing, I think we should indeed be able to use esc_url() here.

Last edited 18 months ago by SergeyBiryukov (previous) (diff)

#4 @SergeyBiryukov
18 months ago

  • Owner set to SergeyBiryukov
  • Resolution set to fixed
  • Status changed from new to closed

In 53570:

Media: Use correct escaping function for URLs in some legacy media functions.

This affects:

  • get_image_send_to_editor()
  • image_link_input_fields()

Follow-up to [7092], [7874], [8653], [11109], [11204], [11383], [12051], [12199], [19982].

Props smit08, mukesh27.
Fixes #56064.

#5 @SergeyBiryukov
18 months ago

#56125 was marked as a duplicate.

Note: See TracTickets for help on using tickets.