Sergey Biryukov ac5e918526 Escape the output in wp_ajax_upload_attachment(). ...

Merges [45936] to the 4.7 branch.
Props whyisjake, sstoqnov.
Built from https://develop.svn.wordpress.org/branches/4.7@45947


git-svn-id: http://core.svn.wordpress.org/branches/4.7@45758 1a063a9b-81f0-0310-95a4-ce76da25c4cd

2019-09-04 16:35:47 +00:00

..

css

…

images

…

includes

Escape the output in wp_ajax_upload_attachment().

2019-09-04 16:35:47 +00:00

js

…

maint

…

network

…

user

…

about.php

…

admin-ajax.php

…

admin-footer.php

…

admin-functions.php

…

admin-header.php

…

admin-post.php

…

admin.php

…

async-upload.php

…

comment.php

…

credits.php

…

custom-background.php

…

custom-header.php

…

customize.php

…

edit-comments.php

…

edit-form-advanced.php

I18n: Introduce more translator comments for strings that contain placeholders but don't have an accompanying translator comment.

2016-11-21 02:46:30 +00:00

edit-form-comment.php

…

edit-link-form.php

…

edit-tag-form.php

Taxonomy/Users: Use correct escaping function for URLs.

2017-09-19 21:21:35 +00:00

edit-tags.php

…

edit.php

…

export.php

…

freedoms.php

…

import.php

Accessibility: Remove target=_blank from the help tab links on several admin screens.

2016-10-04 20:27:33 +00:00

index.php

…

install-helper.php

…

install.php

…

link-add.php

…

link-manager.php

…

link-parse-opml.php

…

link.php

…

load-scripts.php

…

load-styles.php

…

media-new.php

…

media-upload.php

Hooks: Standardize naming of dynamic hooks to use interpolation vs concatenation.

2016-08-22 18:25:31 +00:00

media.php

…

menu-header.php

…

menu.php

Customize: Prevent links to customize.php from being generated which have query vars from wp_removable_query_args() present.

2017-03-25 13:35:38 +00:00

moderation.php

…

ms-admin.php

…

ms-delete-site.php

…

ms-edit.php

Don't rely on include_path to include files.

2013-09-25 00:18:11 +00:00

ms-options.php

…

ms-sites.php

…

ms-themes.php

…

ms-upgrade-network.php

…

ms-users.php

…

my-sites.php

Multisite: Replace get_blog_details() in wp-admin/my-sites.php with get_site().

2016-10-19 06:02:29 +00:00

nav-menus.php

…

network.php

…

options-discussion.php

…

options-general.php

…

options-head.php

…

options-media.php

…

options-permalink.php

…

options-reading.php

…

options-writing.php

…

options.php

…

plugin-editor.php

General: Add missing URL-encoding and add extra hardening to plugin and template names when they're displayed in the admin area.

2017-09-19 10:21:48 +00:00

plugin-install.php

…

plugins.php

…

post-new.php

…

post.php

…

press-this.php

…

profile.php

…

revision.php

…

setup-config.php

…

term.php

…

theme-editor.php

…

theme-install.php

…

themes.php

…

tools.php

…

update-core.php

…

update.php

…

upgrade-functions.php

Docs: Use 3-digit, x.x.x-style semantic versioning for _doing_it_wrong(), _deprecated_function(), _deprecated_argument(), and _deprecated_file() throughout core.

2016-07-06 12:40:29 +00:00

upgrade.php

…

upload.php

…

user-edit.php

…

user-new.php

…

users.php

…

widgets.php

…