Escaping function is missing in $post_edit_link

[nidhidhandhukiya]

Escaping function missing which is use $post_edit_link function.

[Presskopp]

Hello @nidhidhandhukiya, it would be helpful if you could elaborate more what issue you are describing, what is missing and why and how it can be resolved. Thank you.

[Presskopp]

Ah, I was writing while you were posting so you have (partly) answered my question now. Sorry.

[mukesh27]

Thanks @nidhidhandhukiya for ticket and patch.

@Presskopp It's better to escape the output of get_edit_post_link.

Patch works fine in my test. @costdev you could commit you first one 😉

[rajinsharwar]

Maybe we can escape the _draft_or_post_title() as well.

[Presskopp]

I think escaping is not needed here because get_edit_post_link() already returns safe links.

[Presskopp]

Also _draft_or_post_title is already escaping the return value: return esc_html( $title );

[mukesh27]

Agree with @Presskopp.

[costdev]

Thanks for the ping @mukesh27!

As noted above, _draft_or_post_title() is already escaped.

However, get_edit_post_link() is not escaped, and also returns the result of the get_edit_post_link filter. There may have been some confusion with edit_post_link(), which does escape the link before output.

59141.patch looks good to me, thanks @nidhidhandhukiya! 🙂

---

I'm not fully onboarded as a committer yet, sorry Mukesh! 😅 Adding for final review and commit by another committer.

[viralsampat]

I have checked above mentioned issue and I have added my updated patch.

[audrasjb]

In 56437:

Revisions: Add missing escaping function for $post_edit_link in wp-admin/revision.php.

Props nidhidhandhukiya, Presskopp, mukesh27, rajinsharwar, costdev.
Fixes #59141.