From 2a5f7a89016d522239838779e48340fb14e5a160 Mon Sep 17 00:00:00 2001 From: Mike Schroder Date: Sat, 20 May 2017 02:23:00 +0000 Subject: [PATCH] Media: Decode HTML entities in `author_name` before sending to JS. In `wp_prepare_attachment_for_js()`: - Normalize behavior when author does not exist by returning '(no author)' for `authorName` in these cases. - Decode HTML entities in `author_name`. - Add tests for both of the above. Props arshidkv12, ocean90, sloisel, mikeschroder. Fixes #39955. git-svn-id: https://develop.svn.wordpress.org/trunk@40809 602fd350-edb4-49c9-b593-d223f7449a82 --- src/wp-includes/media.php | 6 +++++- tests/phpunit/tests/media.php | 12 ++++++++++++ 2 files changed, 17 insertions(+), 1 deletion(-) diff --git a/src/wp-includes/media.php b/src/wp-includes/media.php index 6843c61b21..19eba00a6a 100644 --- a/src/wp-includes/media.php +++ b/src/wp-includes/media.php @@ -3098,7 +3098,11 @@ function wp_prepare_attachment_for_js( $attachment ) { ); $author = new WP_User( $attachment->post_author ); - $response['authorName'] = $author->display_name; + if ( $author->exists() ) { + $response['authorName'] = html_entity_decode( $author->display_name, ENT_QUOTES, get_bloginfo( 'charset' ) ); + } else { + $response['authorName'] = __( '(no author)' ); + } if ( $attachment->post_parent ) { $post_parent = get_post( $attachment->post_parent ); diff --git a/tests/phpunit/tests/media.php b/tests/phpunit/tests/media.php index 6b1ec96613..bccab12d3e 100644 --- a/tests/phpunit/tests/media.php +++ b/tests/phpunit/tests/media.php @@ -267,6 +267,18 @@ https://w.org' $this->assertEquals( 'image', $prepped['mime'] ); $this->assertEquals( 'image', $prepped['type'] ); $this->assertEquals( '', $prepped['subtype'] ); + + // Test that if author is not found, we return "(no author)" as `display_name`. + // The previously used test post contains no author, so we can reuse it. + $this->assertEquals( '(no author)', $prepped['authorName'] ); + + // Test that if author has HTML entities in display_name, they're decoded correctly. + $html_entity_author = self::factory()->user->create( array( + 'display_name' => 'You & Me', + ) ); + $post->post_author = $html_entity_author; + $prepped = wp_prepare_attachment_for_js( $post ); + $this->assertEquals( 'You & Me', $prepped['authorName'] ); } /**