IntenseWebs/WordPress
3
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

General: Add missing URL-encoding and add extra hardening to plugin and template names when they're displayed in the admin area.

Browse Source 
Props kawauso, Mte90 for initial patches

Fixes #13377

Built from https://develop.svn.wordpress.org/trunk@41399


git-svn-id: http://core.svn.wordpress.org/trunk@41232 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This commit is contained in:
John Blackbourn
2017-09-19 10:11:43 +00:00
parent 9041e7a071
commit e088205014
6 changed files with 34 additions and 32 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
wp-admin/includes/template.php
View File

@@ -772,7 +772,7 @@ function page_template_dropdown( $default = '', $post_type = 'page' ) {
ksort( $templates );
foreach ( array_keys( $templates ) as $template ) {
$selected = selected( $default, $templates[ $template ], false );
echo "\n\t<option value='" . $templates[ $template ] . "' $selected>$template</option>";
echo "\n\t<option value='" . esc_attr( $templates[ $template ] ) . "' $selected>" . esc_html( $template ) . "</option>";
}
}