vhad/wordpress-develop
1
0
Fork 0
mirror of https://github.com/gosticks/wordpress-develop.git synced 2026-03-24 07:14:28 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

General: Add missing URL-encoding and add extra hardening to plugin and template names when they're displayed in the admin area.

Browse Source 
Props kawauso, Mte90 for initial patches

Fixes #13377


git-svn-id: https://develop.svn.wordpress.org/trunk@41399 602fd350-edb4-49c9-b593-d223f7449a82
This commit is contained in:
John Blackbourn
2017-09-19 10:10:35 +00:00
parent 7be5b80976
commit fa4713e898
5 changed files with 33 additions and 31 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
src/wp-admin/theme-editor.php
View File

@@ -132,7 +132,7 @@ if ( empty( $file ) ) {
$relative_file = 'style.css';
$file = $allowed_files['style.css'];
} else {
$relative_file = $file;
$relative_file = wp_unslash( $file );
$file = $theme->get_stylesheet_directory() . '/' . $relative_file;
}
@@ -195,10 +195,12 @@ default:
<div id="message" class="updated notice is-dismissible"><p><?php _e( 'File edited successfully.' ) ?></p></div>
<?php endif;
$description = get_file_description( $relative_file );
$file_description = get_file_description( $relative_file );
$file_show = array_search( $file, array_filter( $allowed_files ) );
if ( $description != $file_show )
$description .= ' <span>(' . $file_show . ')</span>';
$description = esc_html( $file_description );
if ( $file_description != $file_show ) {
$description .= ' <span>(' . esc_html( $file_show ) . ')</span>';
}
?>
<div class="wrap">
<h1><?php echo esc_html( $title ); ?></h1>
@@ -269,9 +271,9 @@ if ( $allowed_files ) :
echo "\t<ul>\n";
}
$file_description = get_file_description( $filename );
$file_description = esc_html( get_file_description( $filename ) );
if ( $filename !== basename( $absolute_filename ) || $file_description !== $filename ) {
$file_description .= '<br /><span class="nonessential">(' . $filename . ')</span>';
$file_description .= '<br /><span class="nonessential">(' . esc_html( $filename ) . ')</span>';
}
if ( $absolute_filename === $file ) {