Validation fixes - "&" instead of "&"

[simek]

Validation fixes for latest WP revision.

Some "&" signs are replaced with "&" tag in mentioned below files:

• wp-admin\plugin-editor.php
• wp-admin\theme-editor.php
• wp-admin\includes\update.php

Patch file attached into ticket

[simek]

More validation fixes in next patch for mentioned below files:

• wp-admin\import\blogger.php
• wp-admin\includes\dashboard.php

[markjaquith]

Did you do these changes based on finding invalid ampersands, or did you just replace them all? clean_url() does the & entity encoding, so those changes aren't necessary if clean_url() is still functioning properly.

[markjaquith]

And when I say "these changes" I mean "the changes for strings passed through clean_url()"

[Denis-de-Bernardy]

see also #7875

[ryan]

See #9432

[hakre]

Replying to markjaquith:

Did you do these changes based on finding invalid ampersands, or did you just replace them all? clean_url() does the & entity encoding, so those changes aren't necessary if clean_url() is still functioning properly.

I did this by validating the output. So the patched places are locations that I could identify as the source of the invalid output passed through all programm logic before outputted. well, make easy things complicated. short answer is: "by finding invalid ampersands by hand, not by replace all".

[Denis-de-Bernardy]

moving to 2.9, as patch needs to be refreshed

[hakre]

I got myself mixed up with the wrong ticket in my last comment. anyway, I will take a look into the issue to get a more actual patch.

[hakre]

Updated Patch against 2.8 bleeding

[hakre]

The following Functions add & or & automatically and therefore the places did not needed a patch any longer:

• clean_url
• wp_nonce_url

The the wp() function is based on the server request which is an URI that contains &. & / & is only used for XHTML output. This reduces the patch as well.

Some functions aren't using XHTML-Encoded URIs:#

• get_categories

wp-admin/includes/plugin-install.php - already fixed
wp-admin/includes/plugin.php - already fixed
wp-admin/includes/post.php - partially fixed, one script tag left
wp-admin/includes/template.php - already fixed
wp-admin/includes/theme-install.php - alread fixed

for the one script tag left I've created a patch against 2.8 bleeding.

This is only a single fix now. I would suggest to put that into 2.8. I know that it is part of another patch I've put on here: #9432 / ​qcop-r00-ampersand-post.patch.

[Denis-de-Bernardy]

for 9402.patch

[ryan]

(In [11296]) Ampersand validation fix. Props hakre. fixes #9402