![(please configure the [header_logo] section in trac.ini)](/chrome/site/your_project_logo.png){kind=logo}
#62118 closed enhancement (fixed)
Code Improvement Suggestion
| Reported by: | ramswarup | Owned by: | SergeyBiryukov |
|---|---|---|---|
| Priority: | low | Milestone: | 6.7 |
| Component: | Administration | Version: | 6.6.2 |
| Severity: | minor | Keywords: | close |
| Cc: | Focuses: |
Description (last modified by )
Code Improvement Suggestion for admin footer \wp-admin\admin-footer.php line No. 35
$text = sprintf( /* translators: %s: https://wordpress.org/ */ __( 'Thank you for creating with <a href="%s">WordPress</a>.' ), __( 'https://wordpress.org/' ) );
Should we use esc_url() here instead of __ (underscore) to ensure that the URL is valid and protected from cross-site scripting?
$text = sprintf( /* translators: %s: https://wordpress.org/ */ __('Thank you for creating with <a href="%s">WordPress</a>.'), esc_url( 'https://wordpress.org/' ) );
Thanks!
Change History (8)
This ticket was mentioned in Slack in #core by ramswarup. View the logs.
22 months ago
#2
@
22 months ago
- Component General → Administration
- Description modified (diff)
- Focuses coding-standards removed
- Keywords needs-testing changes-requested removed
- Priority normal → low
- Severity normal → minor
- Type feature request → enhancement
This ticket was mentioned in PR #7442 on WordPress/wordpress-develop by @narenin.
22 months ago
#3
- Keywords has-patch added
Trac ticket: https://core.trac.wordpress.org/ticket/62118
#5
@
22 months ago
- Milestone Awaiting Review → 6.7
- Owner set to
- Status new → reviewing
Hi there, thanks for the ticket!
It appears that we do escape WordPress.org URLs most of the time, so this brings some more consistency.
@SergeyBiryukov commented on PR #7442:
22 months ago
#7
Thanks for the PR! Merged in r59096.
Note:
See TracTickets
for help on using tickets.
Hi there and welcome to Trac!
Definitely not instead of.
__()is important as it allows for the URL to be translated.To be honest we're pretty inconsistent in core with escaping the URLs in cases like this. On one hand we do trust translations to be correct, on the other hand it can't hurt to add it.