![(please configure the [header_logo] section in trac.ini)](/chrome/site/your_project_logo.png){kind=logo}
Opened 4 years ago
Last modified 7 weeks ago
#57268 new defect (bug)
Add Escaping properly in Class Custom background Page
| Reported by: | shailu25 | Owned by: | |
|---|---|---|---|
| Priority: | normal | Milestone: | Awaiting Review |
| Component: | Administration | Version: | |
| Severity: | normal | Keywords: | has-patch has-unit-tests |
| Cc: | Focuses: | administration |
Description
In the class-custom-background.php , I noticed there are some missing escaping. I think these should be escaped properly.
Example:
<?php echo $input['label']; ?>
Attachments (2)
Change History (6)
#2
@
4 years ago
- Version trunk
There is another instance of this on Line 101 in:
wp-includes/customize/class-wp-customize-background-position-control.php
#3
@
4 years ago
@costdev
I have added escape for wp-includes/customize/class-wp-customize-background-position-control.php file's Instance.(Line no 101)
This ticket was mentioned in PR #12000 on WordPress/wordpress-develop by @arkaprabhachowdhury.
7 weeks ago
#4
- Keywords has-unit-tests added
## Summary
- escape the Custom Background admin page's inline style output and remaining dynamic text labels
- escape the Customizer link and default color attribute output on the screen
- add a regression test proving a malformed theme-mod value cannot break out into a separate HTML attribute
## Testing
- php -l src/wp-admin/includes/class-custom-background.php
n- php -l tests/phpunit/tests/admin/customBackground.phpn- endor/bin/phpcbf --standard=phpcs.xml.dist src/wp-admin/includes/class-custom-background.php tests/phpunit/tests/admin/customBackground.phpn- endor/bin/phpcs --standard=phpcs.xml.dist src/wp-admin/includes/class-custom-background.php tests/phpunit/tests/admin/customBackground.phpn-
ode tools/local-env/scripts/docker.js run --rm php ./vendor/bin/phpunit tests/phpunit/tests/admin/customBackground.php`n
Note:
See TracTickets
for help on using tickets.
Patch Added