Make WordPress Core

Context Navigation

← Previous Ticket
Next Ticket →

Opened 20 months ago

Closed 19 months ago

Last modified 18 months ago

#62434 closed defect (bug) (fixed)

Missing Escaping functionality for async-upload.php Some Variable

Reported by:	shyamkariya	Owned by:	SergeyBiryukov
Priority:	normal	Milestone:	6.7.2
Component:	Upload	Version:	6.6
Severity:	normal	Keywords:	has-patch fixed-major
Cc:		Focuses:	administration, coding-standards

Description

Missing Escaping functionality async-upload.php file... missing Escaping functionality is $file_url.

File Location:- ...\wp-admin\async-upload.php file line number 77.

I have shared the screenshot below...

Attachments (2)

variable-missing.png (79.0 KB ) - added by shyamkariya 20 months ago.
62434.patch (806 bytes ) - added by pitamdey 20 months ago.: Patch for this issue

Download all attachments as: .zip

Change History (11)

@shyamkariya
20 months ago

Attachment variable-missing.png added

@pitamdey
20 months ago

Attachment 62434.patch added

Patch for this issue

#1 @nareshbheda
20 months ago

Keywords has-patch added

#2 @ketanniruke
20 months ago

Declare this $file_url = esc_url($file_url); and check. It will work

This ticket was mentioned in Slack in #core by desrosj. View the logs.

20 months ago

#4 @desrosj
20 months ago

Milestone Awaiting Review → 6.7.2

Introduced in 6.6 through [58279].

#5 @SergeyBiryukov
20 months ago

Owner set to SergeyBiryukov
Resolution → fixed
Status new → closed

Coding Standards: Escape attachment URL in wp-admin/async-upload.php.

Follow-up to [58279].

Props shyamkariya, pitamdey, nareshbheda, ketanniruke, desrosj.
Fixes #62434.

#6 @SergeyBiryukov
20 months ago

Keywords fixed-major added
Resolution fixed
Status closed → reopened

Thanks for the ticket! Reopening for 6.7.x consideration.

#7 @desrosj
20 months ago

Version 6.7 → 6.6

This ticket was mentioned in Slack in #core by jorbin. View the logs.

19 months ago

#9 @jorbin
19 months ago

Resolution → fixed
Status reopened → closed

Coding Standards: Escape attachment URL in wp-admin/async-upload.php.

Follow-up to [58279].

Reviewed by jorbin.
Merges [59407] to the 6.7 branch.

Props shyamkariya, pitamdey, nareshbheda, ketanniruke, desrosj, SergeyBiryukov .
Fixes #62434.

Note: See TracTickets for help on using tickets.

Download in other formats: