Ticket #6898 (closed defect: fixed)

Opened 5 months ago

Last modified 2 months ago

Bad quote escaping in media uploader?

Reported by: Otto42 Assigned to: anonymous
Priority: normal Milestone: 2.6
Component: General Version: 2.5.1
Severity: normal Keywords:
Cc:

Description

Report and fix here: http://wordpress.org/support/topic/164563/page/2?replies=50#post-737670

Other people report the same issue and that the fix works too.

Short version: wp-admin/includes/media.php, line 57 

$html = "<a href='".attribute_escape($url)."'$rel>$html</a>";

Should be this: 

$html = "<a href=\"".attribute_escape($url)."\"$rel>$html</a>";

Because the single quote there can hork up some javascript code that it gets inserted into.

Change History

05/02/08 17:25:56 changed by ryan

  • status changed from new to closed.
  • resolution set to fixed.

(In [7874]) Fix send_to_editor escaping. Props Glotzfisch. fixes #6898 for trunk

05/02/08 17:26:35 changed by ryan

(In [7875]) Fix send_to_editor escaping. Props Glotzfisch. fixes #6898 for 2.5

05/02/08 17:26:48 changed by ryan

  • milestone changed from 2.6 to 2.5.2.

07/15/08 16:24:07 changed by ryan

  • milestone changed from 2.5.2 to 2.9.

Milestone 2.5.2 deleted

07/30/08 20:33:31 changed by westi

  • milestone changed from 2.9 to 2.6.