Upstream/WordPress
1
0
Fork 0
mirror of https://github.com/WordPress/WordPress.git synced 2024-12-22 17:18:32 +01:00
Code Issues Projects Releases Wiki Activity

Coding Standards: Escape the whole attribute in wp-admin/export.php.

Browse Source 
It is best to always escape the complete value of an attribute, not a partial value, as otherwise the escaping could be (partially) undone when the values are joined together.

While the hardcoded hyphen in this case don't necessarily create that risk, it may change to a value which could be problematic, so making it a habit to escape the value in one go is best practice.

Escaping the complete value also means that a single `esc_attr()` call can be used instead of two.

Follow-up to [14444], [16652], [55616], [56632].

See #58831.
Built from https://develop.svn.wordpress.org/trunk@56633


git-svn-id: http://core.svn.wordpress.org/trunk@56145 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This commit is contained in:
Sergey Biryukov 2023-09-20 09:47:18 +00:00
parent 5cce7674ca
commit b57af57210
2 changed files with 7 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
wp-admin/export.php
View File

@ -160,7 +160,12 @@ function export_date_options( $post_type = 'post' ) {
}
$month = zeroise( $date->month, 2 );
echo '<option value="' . esc_attr( $date->year ) . '-' . esc_attr( $month ) . '">' . $wp_locale->get_month( $month ) . ' ' . $date->year . '</option>';
printf(
'<option value="%1$s">%2$s</option>',
esc_attr( $date->year . '-' . $month ),
$wp_locale->get_month( $month ) . ' ' . $date->year
);
}
}
?>

2
wp-includes/version.php
View File

@ -16,7 +16,7 @@
*
* @global string $wp_version
*/
$wp_version = '6.4-alpha-56632';
$wp_version = '6.4-alpha-56633';
/**
* Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.