From ba864b27928cbd9712deabea2e2a7ddf6a120ff3 Mon Sep 17 00:00:00 2001 From: Sergey Biryukov Date: Thu, 7 Apr 2022 12:54:03 +0000 Subject: [PATCH] Administration: Restore the correct escaping function for base64-encoded SVG icons in the admin menu. Add a comment to clarify the `esc_attr()` usage instead of `esc_url()`. Follow-up to [53050]. Props KProvance, kebbet, w33zy, ocean90, mukesh27. Fixes #55539. Built from https://develop.svn.wordpress.org/trunk@53092 git-svn-id: http://core.svn.wordpress.org/trunk@52681 1a063a9b-81f0-0310-95a4-ce76da25c4cd --- wp-admin/menu-header.php | 5 +++-- wp-includes/version.php | 2 +- 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/wp-admin/menu-header.php b/wp-admin/menu-header.php index 691aa9547e..ee90d23152 100644 --- a/wp-admin/menu-header.php +++ b/wp-admin/menu-header.php @@ -128,8 +128,9 @@ function _wp_menu_output( $menu, $submenu, $submenu_as_parent = true ) { if ( 'none' === $item[6] || 'div' === $item[6] ) { $img = '
'; } elseif ( 0 === strpos( $item[6], 'data:image/svg+xml;base64,' ) ) { - $img = '
'; - $img_style = ' style="background-image:url(\'' . esc_url( $item[6] ) . '\')"'; + $img = '
'; + // The value is base64-encoded data, so esc_attr() is used here instead of esc_url(). + $img_style = ' style="background-image:url(\'' . esc_attr( $item[6] ) . '\')"'; $img_class = ' svg'; } elseif ( 0 === strpos( $item[6], 'dashicons-' ) ) { $img = '
'; diff --git a/wp-includes/version.php b/wp-includes/version.php index 60e1a5734a..3b3626eaaf 100644 --- a/wp-includes/version.php +++ b/wp-includes/version.php @@ -16,7 +16,7 @@ * * @global string $wp_version */ -$wp_version = '6.0-alpha-53091'; +$wp_version = '6.0-alpha-53092'; /** * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.