WordPress.org
Get WordPress

Make WordPress Core

Opened 22 months ago

Closed 22 months ago

Last modified 22 months ago

#62405 closed defect (bug) (fixed)

Missing Escaping functionality for theme.php Some Variable

Reported by: patelketan Owned by: SergeyBiryukov
Priority: normal Milestone: 6.8
Component: Themes Version: 3.8
Severity: normal Keywords: has-patch
Cc: Focuses: administration, coding-standards

Description (last modified by SergeyBiryukov)

Missing Escaping functionality theme.php file... missing Escaping functionality is $theme['actions']['activate'] and $theme['actions']['customize'].

File Location:- .../wp-admin/themes.php file line number 610, 617, 624...

I have shared the below screenshot...

Attachments (1)

variable-issue.png​ (116.1 KB ) - added by patelketan 22 months ago.

Download all attachments as: .zip

Change History (6)

@patelketan
22 months ago

This ticket was mentioned in ​PR #7789 on ​WordPress/wordpress-develop by ​@sainathpoojary.
22 months ago #1

  • Keywords has-patch added

Added missing escaping for the href attribute in theme.php.

Trac ticket: #62405

#2 @SergeyBiryukov
22 months ago

  • Component General → Themes
  • Description modified (diff)
  • Milestone Awaiting Review → 6.8
  • Owner set to SergeyBiryukov
  • Status new → reviewing
  • Summary WordPress 6.7 Missing Escaping functionality for theme.php Some Variable → Missing Escaping functionality for theme.php Some Variable
  • Version 6.7 → 3.8

Hi there, welcome to WordPress Trac! Thanks for the ticket.

Adjusting the version reference, this was introduced in [26726] / #25964 for WordPress 3.8.

#3 @SergeyBiryukov
22 months ago

  • Resolution → fixed
  • Status reviewing → closed

In 59400:

Coding Standards: Consistently escape URLs in wp-admin/themes.php.

Includes:

  • Wrapping long lines for better readability.
  • Bringing some consistency to the placement of href and aria-label attributes.
  • Adding missing aria-label attributes for Live Preview links.

Follow-up to [26726], [52020], [51083].

Props patelketan, sainathpoojary, SergeyBiryukov.
Fixes #62405.

​@SergeyBiryukov commented on ​PR #7789:
22 months ago #4

Thanks for the PR! Merged in r59400.

#5 @desrosj
22 months ago

#62409 was marked as a duplicate.

Note: See TracTickets for help on using tickets.