Context Navigation

← Previous Ticket
Next Ticket →

#56717 closed defect (bug) (fixed)

Twenty Eleven: Correctly escape template directory uri

Reported by:	Alberuni Azad.	Owned by:	desrosj
Priority:	normal	Milestone:	6.1
Component:	Bundled Theme	Version:	5.8
Severity:	normal	Keywords:	has-patch
Cc:		Focuses:

Description

In wp-content/themes/twentyeleven/inc/block-patterns.php file, I've found that the get_template_directory_uri() is called without escaping which I think should be escaped.

I've checked other latest themes where the escaping is used. Link mentioned below

https://github.com/WordPress/wordpress-develop/blob/389a78ecc453036f144b6d510cc2423f41bc9dd1/src/wp-content/themes/twentytwentytwo/inc/patterns/general-divider-dark.php#L10

https://github.com/WordPress/wordpress-develop/blob/389a78ecc453036f144b6d510cc2423f41bc9dd1/src/wp-content/themes/twentytwentyone/inc/block-patterns.php#L76

https://github.com/WordPress/wordpress-develop/blob/389a78ecc453036f144b6d510cc2423f41bc9dd1/src/wp-content/themes/twentytwenty/inc/block-patterns.php#L151

Attachments (1)

56717.diff (2.3 KB ) - added by Alberuni Azad. 4 years ago.: Created patch

Download all attachments as: .zip

Change History (4)

@Alberuni Azad.
4 years ago

Attachment 56717.diff added

Created patch

#1 @bhrugesh12
4 years ago

Keywords has-patch added

#2 @desrosj
4 years ago

Milestone Awaiting Review → 6.1
Owner set to desrosj
Status new → reviewing

Related: #56696.

#3 @desrosj
4 years ago

Resolution → fixed
Status reviewing → closed

In 54404:

Twenty Eleven: Pass template directory URLs through esc_url().

Props alberuni-azad, sabernhardt, costdev.
Fixes #56717. See #56696.

Note: See TracTickets for help on using tickets.

Download in other formats:

Make WordPress Core