Some HTML attributes are missing the esc_attr_e

[kowsar89]

I found two strings inside HTML attributes where escaping is missing. These should be escaped too, since strings inside HTML attributes are escaped everywhere.

wp-admin/nav-menus.php

<input type="button" class="deletion menu-items-delete disabled" value="<?php _e( 'Remove Selected Items' ); ?>">

wp-admin/widgets-form.php:

<input type="submit" name="removewidget" id="removewidget" class="button-link button-link-delete widget-control-remove" value="<?php _e( 'Delete' ); ?>" />

Trac ticket: https://core.trac.wordpress.org/ticket/57093

[riccardodicurti]

Hi, I have checked kowsar89’s code and uploaded the patch file here. I didn't find any other HTML attributes where escaping is missing.

[SergeyBiryukov]

Hi there, welcome back to WordPress Trac! Thanks for the ticket and the patch.

I think you're right, these should be escaped.

I have found one more instance that should be patched, see line 527 in wp-admin/includes/nav-menu.php​.

[audrasjb]

Searching for ="<?php _e in the codebase, I only find 3 occurrences:

• wp-admin/nav-menus.php: one occurrence, already addressed in PR3612
• wp-admin/widget-form.php: one occurrence, already addressed in PR3612
• wp-admin/includes/nav-menu.php: needs to be added to the PR

@riccardodicurti would you like to add a new patch with the missing occurrence? Thanks :)

[kowsar89]

I have updated the PR with the fix in file wp-admin/includes/nav-menu.php

[krupalpanchal]

Yes, there are only 3 occurrences in the codebase. And those are updated in [PR 3612]​https://github.com/WordPress/wordpress-develop/pull/3612/.
PR LGTM

[riccardodicurti]

I also updated the patch here.

[SergeyBiryukov]

In 54834:

Administration: Add missing escaping for a few strings used as HTML attributes.

Follow-up to [47209], [50997], [51006].

Props kowsar89, riccardodicurti, audrasjb, krupalpanchal, SergeyBiryukov.
Fixes #57093.

Thanks for the PR! Merged in r54834.