sergiotarxz/Wordpress
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Themes: Add additional later escaping to post_class() and body_class() functions.

Browse Source 
Additionally, this adds a few tests to test output.

Fixes #20009.

Props mfields, scribu, azaozz, obenland, dd32, nacin, jrf, jdgrimes, garyj, whyisjake. 
 


git-svn-id: https://develop.svn.wordpress.org/trunk@48060 602fd350-edb4-49c9-b593-d223f7449a82
This commit is contained in:
Jake Spurlock 2020-06-16 16:55:45 +00:00
parent 50ece6d31c
commit d17a57a945
3 changed files with 60 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
src/wp-includes/post-template.php
View File

@ -454,7 +454,7 @@ function has_excerpt( $post = 0 ) {
*/
function post_class( $class = '', $post_id = null ) {
// Separates classes with a single space, collates classes for post DIV.
echo 'class="' . join( ' ', get_post_class( $class, $post_id ) ) . '"';
echo 'class="' . esc_attr( join( ' ', get_post_class( $class, $post_id ) ) ) . '"';
}
/**
@ -590,7 +590,7 @@ function get_post_class( $class = '', $post_id = null ) {
*/
function body_class( $class = '' ) {
// Separates class names with a single space, collates class names for body element.
echo 'class="' . join( ' ', get_body_class( $class ) ) . '"';
echo 'class="' . esc_attr( join( ' ', get_body_class( $class ) ) ) . '"';
}
/**

29
tests/phpunit/tests/post/bodyClass.php Normal file
View File

@ -0,0 +1,29 @@
<?php
/**
* @group post
* @covers ::body_class
*/
class Tests_Post_BodyClass extends WP_UnitTestCase {
protected $post_id;
public function setUp() {
parent::setUp();
$this->post_id = self::factory()->post->create();
}
public function test_body_class() {
$expected = 'class="' . join( ' ', get_body_class( '', $this->post_id ) ) . '"';
$this->expectOutputString( $expected );
body_class( '', $this->post_id );
}
public function test_body_class_extra_esc_attr() {
$classes = get_body_class( '', $this->post_id );
$escaped_again = array_map( 'esc_attr', $classes );
$escaped_another_time = 'class="' . esc_attr( join( ' ', $escaped_again ) ) . '"';
$this->expectOutputString( $escaped_another_time );
body_class( '', $this->post_id );
}
}

29
tests/phpunit/tests/post/postClass.php Normal file
View File

@ -0,0 +1,29 @@
<?php
/**
* @group post
* @covers ::post_class
*/
class Tests_Post_PostClass extends WP_UnitTestCase {
protected $post_id;
public function setUp() {
parent::setUp();
$this->post_id = self::factory()->post->create();
}
public function test_post_class() {
$expected = 'class="' . join( ' ', get_post_class( '', $this->post_id ) ) . '"';
$this->expectOutputString( $expected );
post_class( '', $this->post_id );
}
public function test_post_class_extra_esc_attr() {
$classes = get_post_class( '', $this->post_id );
$escaped_again = array_map( 'esc_attr', $classes );
$escaped_another_time = 'class="' . esc_attr( join( ' ', $escaped_again ) ) . '"';
$this->expectOutputString( $escaped_another_time );
post_class( '', $this->post_id );
}
}