sergiotarxz
/
Wordpress
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Coding standards: Modify escaping functions to avoid potential false positives. 

Props xknown, zieladam, peterwilsoncc.
Merges [49375] to trunk.

git-svn-id: https://develop.svn.wordpress.org/trunk@49384 602fd350-edb4-49c9-b593-d223f7449a82
This commit is contained in:
Jonathan Desrosiers 2020-10-29 18:00:58 +00:00
parent 4cbb155815
commit 5bc27786d1
7 changed files with 18 additions and 18 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

12
src/wp-admin/admin-header.php
View File

@ -82,12 +82,12 @@ $admin_body_class = preg_replace( '/[^a-z0-9_-]+/i', '-', $hook_suffix );
?>
<script type="text/javascript">
addLoadEvent = function(func){if(typeof jQuery!=='undefined')jQuery(document).ready(func);else if(typeof wpOnload!=='function'){wpOnload=func;}else{var oldonload=wpOnload;wpOnload=function(){oldonload();func();}}};
var ajaxurl = '<?php echo admin_url( 'admin-ajax.php', 'relative' ); ?>',
pagenow = '<?php echo $current_screen->id; ?>',
typenow = '<?php echo $current_screen->post_type; ?>',
adminpage = '<?php echo $admin_body_class; ?>',
thousandsSeparator = '<?php echo addslashes( $wp_locale->number_format['thousands_sep'] ); ?>',
decimalPoint = '<?php echo addslashes( $wp_locale->number_format['decimal_point'] ); ?>',
var ajaxurl = '<?php echo esc_js( admin_url( 'admin-ajax.php', 'relative' ) ); ?>',
pagenow = '<?php echo esc_js( $current_screen->id ); ?>',
typenow = '<?php echo esc_js( $current_screen->post_type ); ?>',
adminpage = '<?php echo esc_js( $admin_body_class ); ?>',
thousandsSeparator = '<?php echo esc_js( $wp_locale->number_format['thousands_sep'] ); ?>',
decimalPoint = '<?php echo esc_js( $wp_locale->number_format['decimal_point'] ); ?>',
isRtl = <?php echo (int) is_rtl(); ?>;
</script>
<?php

2
src/wp-admin/includes/class-custom-image-header.php
View File

@ -343,7 +343,7 @@ class Custom_Image_Header {
?>
<script type="text/javascript">
(function($){
var default_color = '<?php echo $default_color; ?>',
var default_color = '<?php echo esc_js( $default_color ); ?>',
header_text_fields;
function pickColor(color) {

2
src/wp-admin/includes/media.php
View File

@ -532,7 +532,7 @@ function wp_iframe( $content_func, ...$args ) {
?>
<script type="text/javascript">
addLoadEvent = function(func){if(typeof jQuery!="undefined")jQuery(document).ready(func);else if(typeof wpOnload!='function'){wpOnload=func;}else{var oldonload=wpOnload;wpOnload=function(){oldonload();func();}}};
var ajaxurl = '<?php echo admin_url( 'admin-ajax.php', 'relative' ); ?>', pagenow = 'media-upload-popup', adminpage = 'media-upload-popup',
var ajaxurl = '<?php echo esc_js( admin_url( 'admin-ajax.php', 'relative' ) ); ?>', pagenow = 'media-upload-popup', adminpage = 'media-upload-popup',
isRtl = <?php echo (int) is_rtl(); ?>;
</script>
<?php

2
src/wp-admin/includes/ms.php
View File

@ -842,7 +842,7 @@ function can_edit_network( $network_id ) {
function _thickbox_path_admin_subfolder() {
?>
<script type="text/javascript">
var tb_pathToImage = "<?php echo includes_url( 'js/thickbox/loadingAnimation.gif', 'relative' ); ?>";
var tb_pathToImage = "<?php echo esc_js( includes_url( 'js/thickbox/loadingAnimation.gif', 'relative' ) ); ?>";
</script>
<?php
}

12
src/wp-admin/includes/template.php
View File

@ -2027,12 +2027,12 @@ function iframe_header( $title = '', $deprecated = false ) {
<script type="text/javascript">
addLoadEvent = function(func){if(typeof jQuery!="undefined")jQuery(document).ready(func);else if(typeof wpOnload!='function'){wpOnload=func;}else{var oldonload=wpOnload;wpOnload=function(){oldonload();func();}}};
function tb_close(){var win=window.dialogArguments||opener||parent||top;win.tb_remove();}
var ajaxurl = '<?php echo admin_url( 'admin-ajax.php', 'relative' ); ?>',
pagenow = '<?php echo $current_screen->id; ?>',
typenow = '<?php echo $current_screen->post_type; ?>',
adminpage = '<?php echo $admin_body_class; ?>',
thousandsSeparator = '<?php echo addslashes( $wp_locale->number_format['thousands_sep'] ); ?>',
decimalPoint = '<?php echo addslashes( $wp_locale->number_format['decimal_point'] ); ?>',
var ajaxurl = '<?php echo esc_js( admin_url( 'admin-ajax.php', 'relative' ) ); ?>',
pagenow = '<?php echo esc_js( $current_screen->id ); ?>',
typenow = '<?php echo esc_js( $current_screen->post_type ); ?>',
adminpage = '<?php echo esc_js( $admin_body_class ); ?>',
thousandsSeparator = '<?php echo esc_js( $wp_locale->number_format['thousands_sep'] ); ?>',
decimalPoint = '<?php echo esc_js( $wp_locale->number_format['decimal_point'] ); ?>',
isRtl = <?php echo (int) is_rtl(); ?>;
</script>
<?php

4
src/wp-admin/media-new.php
View File

@ -77,9 +77,9 @@ if ( get_user_setting( 'uploader' ) || isset( $_GET['browser-uploader'] ) ) {
<?php media_upload_form(); ?>
<script type="text/javascript">
var post_id = <?php echo $post_id; ?>, shortform = 3;
var post_id = <?php echo absint( $post_id ); ?>, shortform = 3;
</script>
<input type="hidden" name="post_id" id="post_id" value="<?php echo $post_id; ?>" />
<input type="hidden" name="post_id" id="post_id" value="<?php echo absint( $post_id ); ?>" />
<?php wp_nonce_field( 'media-form' ); ?>
<div id="media-items" class="hide-if-no-js"></div>
</form>

2
src/wp-admin/network/site-users.php
View File

@ -220,7 +220,7 @@ if ( ! wp_is_large_network( 'users' ) && apply_filters( 'show_network_site_users
require_once ABSPATH . 'wp-admin/admin-header.php'; ?>
<script type="text/javascript">
var current_site_id = <?php echo $id; ?>;
var current_site_id = <?php echo absint( $id ); ?>;
</script>