WordPress.org
Get WordPress

Make WordPress Core

Opened 4 years ago

Last modified 8 weeks ago

#57268 new defect (bug)

Add Escaping properly in Class Custom background Page

Reported by: shailu25 Owned by:
Priority: normal Milestone: Awaiting Review
Component: Administration Version:
Severity: normal Keywords: has-patch has-unit-tests
Cc: Focuses: administration

Description

In the class-custom-background.php , I noticed there are some missing escaping. I think these should be escaped properly.

Example: 

<?php echo $input['label']; ?>

Attachments (2)

57268.diff​ (845 bytes ) - added by shailu25 4 years ago.
Patch Added
57268.2.diff​ (1.8 KB ) - added by shailu25 4 years ago.
Updated Patch

Download all attachments as: .zip

Change History (7)

@shailu25
4 years ago

Patch Added

#1 @shailu25
4 years ago

  • Keywords has-patch added

#2 @costdev
4 years ago

  • Version trunk

There is another instance of this on Line 101 in:
wp-includes/customize/class-wp-customize-background-position-control.php

@shailu25
4 years ago

Updated Patch

#3 @shailu25
4 years ago

@costdev

I have added escape for wp-includes/customize/class-wp-customize-background-position-control.php file's Instance.(Line no 101)

Last edited 4 years ago by shailu25 (previous) (diff)

This ticket was mentioned in ​PR #12000 on ​WordPress/wordpress-develop by ​@arkaprabhachowdhury.
5 months ago #4

  • Keywords has-unit-tests added

## Summary

  • escape the Custom Background admin page's inline style output and remaining dynamic text labels
  • escape the Customizer link and default color attribute output on the screen
  • add a regression test proving a malformed theme-mod value cannot break out into a separate HTML attribute

## Testing

  • php -l src/wp-admin/includes/class-custom-background.phpn- php -l tests/phpunit/tests/admin/customBackground.phpn- endor/bin/phpcbf --standard=phpcs.xml.dist src/wp-admin/includes/class-custom-background.php tests/phpunit/tests/admin/customBackground.phpn- endor/bin/phpcs --standard=phpcs.xml.dist src/wp-admin/includes/class-custom-background.php tests/phpunit/tests/admin/customBackground.phpn-

ode tools/local-env/scripts/docker.js run --rm php ./vendor/bin/phpunit tests/phpunit/tests/admin/customBackground.php`n

#5 @arkaprabhachowdhury
8 weeks ago

Opened [PR #12000](​https://github.com/WordPress/wordpress-develop/pull/12000) to address this ticket. Summary - escape the Custom Background admin page's inline style output and remaining dynamic text labels - escape the Customizer link and default color attribute output on the screen - add a regression test proving a malformed theme-mod value cannot break out into a separate HTML attribute Testing - php -l src/wp-admin/includes/class-custom-background.phpn- php -l tests/phpunit/tests/admin/customBackground.phpn- endor/bin/phpcbf --standard=phpcs.xml.dist src/wp-admin/includes/class-custom-bac The PR includes focused regression coverage, and its validation details are recorded in the PR description.

I picked this up because the ticket describes a concrete core behavior or edge case that remains relevant in current WordPress. The proposed change is intentionally scoped to the ticket and is submitted here for code review, with the technical discussion remaining on this ticket.

Note: See TracTickets for help on using tickets.