From e3f1f8fed198e1f1b11badf3b8a428a806faff9f Mon Sep 17 00:00:00 2001 From: Gary Pendergast Date: Mon, 20 Apr 2015 07:39:25 +0000 Subject: [PATCH] Ensure post titles are correctly escaped on the Dashboard. Props helen, ocean90, dd32, pento. Built from https://develop.svn.wordpress.org/trunk@32175 git-svn-id: http://core.svn.wordpress.org/trunk@32150 1a063a9b-81f0-0310-95a4-ce76da25c4cd --- wp-admin/includes/class-wp-comments-list-table.php | 4 ++-- wp-admin/includes/dashboard.php | 2 +- wp-admin/includes/template.php | 2 +- wp-admin/js/nav-menu.js | 4 ++-- wp-admin/js/nav-menu.min.js | 2 +- wp-includes/version.php | 2 +- 6 files changed, 8 insertions(+), 8 deletions(-) diff --git a/wp-admin/includes/class-wp-comments-list-table.php b/wp-admin/includes/class-wp-comments-list-table.php index dfd95a6bf2..863585473b 100644 --- a/wp-admin/includes/class-wp-comments-list-table.php +++ b/wp-admin/includes/class-wp-comments-list-table.php @@ -561,9 +561,9 @@ class WP_Comments_List_Table extends WP_List_Table { if ( current_user_can( 'edit_post', $post->ID ) ) { $post_link = ""; - $post_link .= get_the_title( $post->ID ) . ''; + $post_link .= esc_html( get_the_title( $post->ID ) ) . ''; } else { - $post_link = get_the_title( $post->ID ); + $post_link = esc_html( get_the_title( $post->ID ) ); } echo '