From 45fa3ed5a377121d0640db5214554d5b88cac0b8 Mon Sep 17 00:00:00 2001 From: Andrew Ozz Date: Sat, 11 Jul 2009 04:18:26 +0000 Subject: [PATCH] Properly escape the title in the feed widget, props nbachiyski, fixes #10378 for trunk git-svn-id: https://develop.svn.wordpress.org/trunk@11707 602fd350-edb4-49c9-b593-d223f7449a82 --- wp-includes/default-widgets.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/wp-includes/default-widgets.php b/wp-includes/default-widgets.php index bbefd3b4e1..54d1d4012d 100644 --- a/wp-includes/default-widgets.php +++ b/wp-includes/default-widgets.php @@ -712,7 +712,7 @@ class WP_Widget_RSS extends WP_Widget { if ( ! is_wp_error($rss) ) { $desc = esc_attr(strip_tags(@html_entity_decode($rss->get_description(), ENT_QUOTES, get_option('blog_charset')))); if ( empty($title) ) - $title = htmlentities(strip_tags($rss->get_title())); + $title = esc_html(strip_tags($rss->get_title())); $link = esc_url(strip_tags($rss->get_permalink())); while ( stristr($link, 'http') != $link ) $link = substr($link, 1);