WordPress.org
Get WordPress

Make WordPress Core

Opened 6 weeks ago

Closed 11 days ago

Last modified 11 days ago

#62951 closed defect (bug) (fixed)

Missing Escaping functionality for Some Variable

Reported by: shyamkariya's profile shyamkariya Owned by: sergeybiryukov's profile SergeyBiryukov
Milestone: 6.8 Priority: normal
Severity: normal Version:
Component: Media Keywords: has-patch
Focuses: coding-standards Cc:

Description

The image-edit.php file and $thumbURL? are missing escaping functionality.

File Location:- ...\wp-admin\includes\image-edit.php file line number 296.

I have shared the screenshot below...

Attachments (1)

image-edit-esc.png​ (22.9 KB) - added by shyamkariya 6 weeks ago.
Missing Escaping functionality for image-edit.php Some Variable

Download all attachments as: .zip

Change History (6)

@shyamkariya
6 weeks ago

Missing Escaping functionality for image-edit.php Some Variable

#1 @audrasjb
6 weeks ago

  • Focuses administration removed
  • Keywords needs-patch added; has-patch removed
  • Type changed from enhancement to defect (bug)
  • Version 6.7.2 deleted

Hello and thanks for the ticket,

Yes, that's kinda minor but we could have an esc_url here, and esc_attr for the other sibling attributes.

This ticket was mentioned in ​PR #8305 on ​WordPress/wordpress-develop by ​@benazeer.
6 weeks ago #2

  • Keywords has-patch added; needs-patch removed

Trac ticket: [](https://core.trac.wordpress.org/ticket/62951)

​@benazeer commented on ​PR #8305:
6 weeks ago #3

Hi @sabernhardt , thanks for the review.

The $post_id variable must be an integer, which should not require any escaping. Both wp_ajax_image_editor() and edit_form_image_editor() cast their attachment IDs to (int) type.

Just confirming, So I can remove it from all places where using $post_id in this file.

Applying that changes in next commit.

#4 @SergeyBiryukov
11 days ago

  • Owner set to SergeyBiryukov
  • Resolution set to fixed
  • Status changed from new to closed

In 59990:

Coding Standards: Escape thumbnail URL and attributes in wp_image_editor().

Follow-up to [11965].

Props benazeer, dhruvang21, sabernhardt.
Fixes #62951.

#5 @SergeyBiryukov
11 days ago

  • Milestone changed from Awaiting Review to 6.8

Looks like I missed the props for shyamkariya and audrasjb here. Sorry for that! I have updated the props list for [59990] in the Core Props tool on make/core to correct that.

Note: See TracTickets for help on using tickets.