From 2a42fc2e734e08721340bfa8fde36abd3fb971f5 Mon Sep 17 00:00:00 2001 From: Gary Pendergast Date: Mon, 20 Apr 2015 13:39:14 +0000 Subject: [PATCH] Ensure post titles are correctly escaped on the Dashboard. Merge of [32175] to the 3.9 branch. Props helen, ocean90, dd32, pento. Built from https://develop.svn.wordpress.org/branches/3.9@32204 git-svn-id: http://core.svn.wordpress.org/branches/3.9@32177 1a063a9b-81f0-0310-95a4-ce76da25c4cd --- wp-admin/includes/class-wp-comments-list-table.php | 4 ++-- wp-admin/includes/dashboard.php | 2 +- wp-admin/includes/template.php | 2 +- wp-admin/js/nav-menu.js | 6 +++--- wp-admin/js/nav-menu.min.js | 2 +- 5 files changed, 8 insertions(+), 8 deletions(-) diff --git a/wp-admin/includes/class-wp-comments-list-table.php b/wp-admin/includes/class-wp-comments-list-table.php index c489efee7b..32943335bf 100644 --- a/wp-admin/includes/class-wp-comments-list-table.php +++ b/wp-admin/includes/class-wp-comments-list-table.php @@ -537,9 +537,9 @@ class WP_Comments_List_Table extends WP_List_Table { if ( current_user_can( 'edit_post', $post->ID ) ) { $post_link = ""; - $post_link .= get_the_title( $post->ID ) . ''; + $post_link .= esc_html( get_the_title( $post->ID ) ) . ''; } else { - $post_link = get_the_title( $post->ID ); + $post_link = esc_html( get_the_title( $post->ID ) ); } echo '