WordPress-C
/
WordPress
mirror of https://github.com/WordPress/WordPress.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

Administration: Restore the correct escaping function for base64-encoded SVG icons in the admin menu. 

Add a comment to clarify the `esc_attr()` usage instead of `esc_url()`.

Follow-up to [53050].

Props KProvance, kebbet, w33zy, ocean90, mukesh27.
Fixes #55539.
Built from https://develop.svn.wordpress.org/trunk@53092


git-svn-id: http://core.svn.wordpress.org/trunk@52681 1a063a9b-81f0-0310-95a4-ce76da25c4cd
This commit is contained in:
Sergey Biryukov 2022-04-07 12:54:03 +00:00
parent 0ae89f5171
commit ba864b2792
2 changed files with 4 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
wp-admin/menu-header.php
View File

@ -129,7 +129,8 @@ function _wp_menu_output( $menu, $submenu, $submenu_as_parent = true ) {
$img = '<br />'; $img = '<br />';
} elseif ( 0 === strpos( $item[6], 'data:image/svg+xml;base64,' ) ) { } elseif ( 0 === strpos( $item[6], 'data:image/svg+xml;base64,' ) ) {
$img = '<br />'; $img = '<br />';
$img_style = ' style="background-image:url(\'' . esc_url( $item[6] ) . '\')"'; // The value is base64-encoded data, so esc_attr() is used here instead of esc_url().
$img_style = ' style="background-image:url(\'' . esc_attr( $item[6] ) . '\')"';
$img_class = ' svg'; $img_class = ' svg';
} elseif ( 0 === strpos( $item[6], 'dashicons-' ) ) { } elseif ( 0 === strpos( $item[6], 'dashicons-' ) ) {
$img = '<br />'; $img = '<br />';

2
wp-includes/version.php
View File

@ -16,7 +16,7 @@
* *
* @global string $wp_version * @global string $wp_version
*/ */
$wp_version = '6.0-alpha-53091'; $wp_version = '6.0-alpha-53092';
/** /**
* Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema. * Holds the WordPress DB revision, increments when changes are made to the WordPress DB schema.