WordPress.org
Get WordPress

Make WordPress Core

Opened 22 months ago

Closed 22 months ago

Last modified 22 months ago

#62409 closed defect (bug) (duplicate)

WordPress 6.7 Missing Escaping functionality for theme.php Some Variable

Reported by: patelketan Owned by:
Priority: normal Milestone:
Component: General Version: 3.8
Severity: normal Keywords: has-patch
Cc: Focuses: administration, coding-standards

Description

WordPress Version 6.7 missing Escaping functionality theme.php file... missing Escaping functionality is $themeactionsactivate and $themeactionscustomize.

File Location:- .../wp-admin/themes.php file line number 610, 617, 624...

I have shared the below screenshot...

Change History (5)

This ticket was mentioned in ​PR #7790 on ​WordPress/wordpress-develop by ​@abcd95.
22 months ago #1

  • Keywords has-patch added

Trac ticket: Core - 62409

This PR adds proper escaping for theme names, URLs, and attributes in the themes.php file to prevent potential vulnerabilities.

### Changes Made:

  • Added esc_html() escaping for theme name outputs
  • Added esc_url() escaping for theme action URLs:
    • Customize action URLs
    • Activate action URLs

​@desrosj commented on ​PR #7790:
22 months ago #2

Hi @himanshupathak95,

Did you mean to close this out?

​@abcd95 commented on ​PR #7790:
22 months ago #3

Hey @desrosj, Thanks for asking!

I did mean to close this. The moment is created this PR, another PR for the same issue was created and merged ( since the issue addressed security concerns ). Then since the issue was solved, I had to close the PR.

#4 @desrosj
22 months ago

  • Milestone Awaiting Review
  • Resolution → duplicate
  • Status new → closed
  • Version 6.7 → 3.8

Duplicate of #62405.

​@desrosj commented on ​PR #7790:
22 months ago #5

Ah ha! Thanks, I see that duplicate ticket now. Appreciate the attempt to fix this.

Note: See TracTickets for help on using tickets.