Opened 13 months ago
Closed 13 months ago
#60324 closed defect (bug) (fixed)
Add missing esc_html()
Reported by: |
|
Owned by: |
|
---|---|---|---|
Milestone: | 6.5 | Priority: | normal |
Severity: | normal | Version: | |
Component: | Customize | Keywords: | has-patch commit |
Focuses: | coding-standards | Cc: |
Description
Add missing escaping in wp-includes/class-wp-customize-control.php
.
Attachments (2)
Change History (10)
#5
@
13 months ago
Good catches!
- [20295] added
WP_Customize_Control
without escaping$label
for theoption
element, though the changeset escaped the text used for the input labels. - [32806] added
WP_Customize_Nav_Menu_Location_Control
.
I also found similar <option
elements for bulk actions in WP_List_Table
, but should this ticket remain focused on the Customizer classes instead of searching wp-admin
too?
#6
@
13 months ago
- Keywords changes-requested added
Given similar instances are escaped, these one should be escaped too, at least for better consistency.
Adding changes-requested
to take into account comment:3.
I also found similar <option elements for bulk actions in WP_List_Table, but should this ticket remain focused on the Customizer classes instead of searching wp-admin too?
Yeah I think that's another ticket :)
Note: See
TracTickets for help on using
tickets.
There is another instance of this on Line 80 in wp-includes/customize/class-wp-customize-nav-menu-location-control.php
It should be