From 8a7f8602b3f2c58adad9d2bcaefd86d616c19a03 Mon Sep 17 00:00:00 2001 From: John Blackbourn Date: Thu, 8 Oct 2015 23:13:00 +0000 Subject: [PATCH] Remove HTML escaping for the plugin name and author fields that are displayed when deleting a plugin. While it might seem counter-intuitive to remove HTML escaping, these fields are already safe (they originate in `_get_plugin_data_markup_translate()` which handles sanitization and escaping), and the AuthorName field actually allows some HTML. This change prevents escaped HTML from appearing here. Fixes #25422 git-svn-id: https://develop.svn.wordpress.org/trunk@34973 602fd350-edb4-49c9-b593-d223f7449a82 --- src/wp-admin/plugins.php | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/wp-admin/plugins.php b/src/wp-admin/plugins.php index 4178c46e89..5c549f80ef 100644 --- a/src/wp-admin/plugins.php +++ b/src/wp-admin/plugins.php @@ -321,11 +321,11 @@ if ( $action ) { foreach ( $plugin_info as $plugin ) { if ( $plugin['is_uninstallable'] ) { /* translators: 1: plugin name, 2: plugin author */ - echo '
  • ', sprintf( __( '%1$s by %2$s (will also delete its data)' ), esc_html($plugin['Name']), esc_html($plugin['AuthorName']) ), '
  • '; + echo '
  • ', sprintf( __( '%1$s by %2$s (will also delete its data)' ), $plugin['Name'], $plugin['AuthorName'] ), '
  • '; $data_to_delete = true; } else { /* translators: 1: plugin name, 2: plugin author */ - echo '
  • ', sprintf( __('%1$s by %2$s' ), esc_html($plugin['Name']), esc_html($plugin['AuthorName']) ), '
  • '; + echo '
  • ', sprintf( __('%1$s by %2$s' ), $plugin['Name'], $plugin['AuthorName'] ), '
  • '; } } ?>