vhad/wordpress-develop
1
0
Fork 0
mirror of https://github.com/gosticks/wordpress-develop.git synced 2026-04-05 05:04:31 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

In a similar vein to [34133], escape the email address and IP address of comment authors to increase defence in depth.

Browse Source 
git-svn-id: https://develop.svn.wordpress.org/trunk@35748 602fd350-edb4-49c9-b593-d223f7449a82
This commit is contained in:
John Blackbourn
2015-11-29 02:40:42 +00:00
parent da2acf666a
commit 6565b3e423
2 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
src/wp-includes/comment-template.php
View File

@@ -184,7 +184,7 @@ function get_comment_author_email_link( $linktext = '', $before = '', $after = '
if ((!empty($email)) && ($email != '@')) {
$display = ($linktext != '') ? $linktext : $email;
$return = $before;
$return .= "<a href='mailto:$email'>$display</a>";
$return .= sprintf( '<a href="%1$s">%2$s</a>', esc_url( 'mailto:' . $email ), esc_html( $display ) );
$return .= $after;
return $return;
} else {
@@ -278,7 +278,7 @@ function get_comment_author_IP( $comment_ID = 0 ) {
* Default current comment.
*/
function comment_author_IP( $comment_ID = 0 ) {
echo get_comment_author_IP( $comment_ID );
echo esc_html( get_comment_author_IP( $comment_ID ) );
}
/**