vhad/wordpress-develop
1
0
Fork 0
mirror of https://github.com/gosticks/wordpress-develop.git synced 2026-04-14 01:24:27 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

General: Add missing URL-encoding and add extra hardening to plugin and template names when they're displayed in the admin area.

Browse Source 
Props kawauso, Mte90 for initial patches

Fixes #13377


git-svn-id: https://develop.svn.wordpress.org/trunk@41399 602fd350-edb4-49c9-b593-d223f7449a82
This commit is contained in:
John Blackbourn
2017-09-19 10:10:35 +00:00
parent 7be5b80976
commit fa4713e898
5 changed files with 33 additions and 31 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
src/wp-admin/includes/template.php
View File

@@ -772,7 +772,7 @@ function page_template_dropdown( $default = '', $post_type = 'page' ) {
ksort( $templates );
foreach ( array_keys( $templates ) as $template ) {
$selected = selected( $default, $templates[ $template ], false );
echo "\n\t<option value='" . $templates[ $template ] . "' $selected>$template</option>";
echo "\n\t<option value='" . esc_attr( $templates[ $template ] ) . "' $selected>" . esc_html( $template ) . "</option>";
}
}