From 05710aaa41c73939b4884c49be90eec506f1bae9 Mon Sep 17 00:00:00 2001 From: Gary Pendergast Date: Mon, 20 Apr 2015 07:38:29 +0000 Subject: [PATCH] Ensure post titles are correctly escaped on the Dashboard. Props helen, ocean90, dd32, pento. git-svn-id: https://develop.svn.wordpress.org/trunk@32175 602fd350-edb4-49c9-b593-d223f7449a82 --- src/wp-admin/includes/class-wp-comments-list-table.php | 4 ++-- src/wp-admin/includes/dashboard.php | 2 +- src/wp-admin/includes/template.php | 2 +- src/wp-admin/js/nav-menu.js | 4 ++-- 4 files changed, 6 insertions(+), 6 deletions(-) diff --git a/src/wp-admin/includes/class-wp-comments-list-table.php b/src/wp-admin/includes/class-wp-comments-list-table.php index dfd95a6bf2..863585473b 100644 --- a/src/wp-admin/includes/class-wp-comments-list-table.php +++ b/src/wp-admin/includes/class-wp-comments-list-table.php @@ -561,9 +561,9 @@ class WP_Comments_List_Table extends WP_List_Table { if ( current_user_can( 'edit_post', $post->ID ) ) { $post_link = ""; - $post_link .= get_the_title( $post->ID ) . ''; + $post_link .= esc_html( get_the_title( $post->ID ) ) . ''; } else { - $post_link = get_the_title( $post->ID ); + $post_link = esc_html( get_the_title( $post->ID ) ); } echo '
'; diff --git a/src/wp-admin/includes/dashboard.php b/src/wp-admin/includes/dashboard.php index 1b5acbe50a..7179aa3480 100644 --- a/src/wp-admin/includes/dashboard.php +++ b/src/wp-admin/includes/dashboard.php @@ -520,7 +520,7 @@ function wp_dashboard_recent_drafts( $drafts = false ) { function _wp_dashboard_recent_comments_row( &$comment, $show_date = true ) { $GLOBALS['comment'] =& $comment; - $comment_post_title = strip_tags(get_the_title( $comment->comment_post_ID )); + $comment_post_title = _draft_or_post_title( $comment->comment_post_ID ); if ( current_user_can( 'edit_post', $comment->comment_post_ID ) ) { $comment_post_url = get_edit_post_link( $comment->comment_post_ID ); diff --git a/src/wp-admin/includes/template.php b/src/wp-admin/includes/template.php index 10023c1b06..03ff4e7d9e 100644 --- a/src/wp-admin/includes/template.php +++ b/src/wp-admin/includes/template.php @@ -1556,7 +1556,7 @@ function _draft_or_post_title( $post = 0 ) { $title = get_the_title( $post ); if ( empty( $title ) ) $title = __( '(no title)' ); - return $title; + return esc_html( $title ); } /** diff --git a/src/wp-admin/js/nav-menu.js b/src/wp-admin/js/nav-menu.js index 9f8916a7a7..80578a757d 100644 --- a/src/wp-admin/js/nav-menu.js +++ b/src/wp-admin/js/nav-menu.js @@ -463,14 +463,14 @@ var wpNavMenu; if ( ! isPrimaryMenuItem ) { thisLink = menuItem.find( '.menus-move-left' ), thisLinkText = menus.outFrom.replace( '%s', prevItemNameLeft ); - thisLink.prop( 'title', menus.moveOutFrom.replace( '%s', prevItemNameLeft ) ).html( thisLinkText ).css( 'display', 'inline' ); + thisLink.prop( 'title', menus.moveOutFrom.replace( '%s', prevItemNameLeft ) ).text( thisLinkText ).css( 'display', 'inline' ); } if ( 0 !== position ) { if ( menuItem.find( '.menu-item-data-parent-id' ).val() !== menuItem.prev().find( '.menu-item-data-db-id' ).val() ) { thisLink = menuItem.find( '.menus-move-right' ), thisLinkText = menus.under.replace( '%s', prevItemNameRight ); - thisLink.prop( 'title', menus.moveUnder.replace( '%s', prevItemNameRight ) ).html( thisLinkText ).css( 'display', 'inline' ); + thisLink.prop( 'title', menus.moveUnder.replace( '%s', prevItemNameRight ) ).text( thisLinkText ).css( 'display', 'inline' ); } }