WordPress.org
Get WordPress

Make WordPress Core

Opened 3 years ago

Closed 3 years ago

#56717 closed defect (bug) (fixed)

Twenty Eleven: Correctly escape template directory uri

Reported by: alberuni-azad's profile Alberuni Azad. Owned by: desrosj's profile desrosj
Milestone: 6.1 Priority: normal
Severity: normal Version: 5.8
Component: Bundled Theme Keywords: has-patch
Focuses: Cc:

Description

In wp-content/themes/twentyeleven/inc/block-patterns.php file, I've found that the get_template_directory_uri() is called without escaping which I think should be escaped.

I've checked other latest themes where the escaping is used. Link mentioned below

​https://github.com/WordPress/wordpress-develop/blob/389a78ecc453036f144b6d510cc2423f41bc9dd1/src/wp-content/themes/twentytwentytwo/inc/patterns/general-divider-dark.php#L10

​https://github.com/WordPress/wordpress-develop/blob/389a78ecc453036f144b6d510cc2423f41bc9dd1/src/wp-content/themes/twentytwentyone/inc/block-patterns.php#L76

​https://github.com/WordPress/wordpress-develop/blob/389a78ecc453036f144b6d510cc2423f41bc9dd1/src/wp-content/themes/twentytwenty/inc/block-patterns.php#L151

Attachments (1)

56717.diff​ (2.3 KB) - added by Alberuni Azad. 3 years ago.
Created patch

Download all attachments as: .zip

Change History (4)

@Alberuni Azad.
3 years ago

Created patch

#1 @bhrugesh12
3 years ago

  • Keywords has-patch added

#2 @desrosj
3 years ago

  • Milestone changed from Awaiting Review to 6.1
  • Owner set to desrosj
  • Status changed from new to reviewing

Related: #56696.

#3 @desrosj
3 years ago

  • Resolution set to fixed
  • Status changed from reviewing to closed

In 54404:

Twenty Eleven: Pass template directory URLs through esc_url().

Props alberuni-azad, sabernhardt, costdev.
Fixes #56717. See #56696.

Note: See TracTickets for help on using tickets.