Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Late escape latest comments block #37865

Merged
merged 9 commits into from
Jan 14, 2022
Merged

Late escape latest comments block #37865

Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
524e863
Initial pass
getdave Jan 11, 2022
820c6a5
Escape comment excerpt
getdave Jan 11, 2022
7d00f3c
Escape comment post title
getdave Jan 11, 2022
1a0602e
Escape author name
getdave Jan 11, 2022
3ec6f65
Revert escaping of translations
getdave Jan 13, 2022
d689528
Move Post title escaping at point of output
getdave Jan 13, 2022
07e12d8
Revert escaping of hardcoded inlined string
getdave Jan 13, 2022
20d6c37
Revert escape of comment excerpt
getdave Jan 13, 2022
63dc1c5
Revert escaping get_block_wrapper_attributes
getdave Jan 13, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 5 additions & 5 deletions packages/block-library/src/latest-comments/index.php
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -30,7 +30,7 @@ function wp_latest_comments_draft_or_post_title( $post = 0 ) {
if ( empty( $title ) ) {
$title = __( '(no title)' );
}
return esc_html( $title );
return $title;
}

/**
Expand Down Expand Up @@ -86,14 +86,14 @@ function render_block_core_latest_comments( $attributes = array() ) {

$author_markup = '';
if ( $author_url ) {
$author_markup .= '<a class="wp-block-latest-comments__comment-author" href="' . esc_url( $author_url ) . '">' . get_comment_author( $comment ) . '</a>';
$author_markup .= '<a class="wp-block-latest-comments__comment-author" href="' . esc_url( $author_url ) . '">' . esc_html( get_comment_author( $comment ) ) . '</a>';
} else {
$author_markup .= '<span class="wp-block-latest-comments__comment-author">' . get_comment_author( $comment ) . '</span>';
$author_markup .= '<span class="wp-block-latest-comments__comment-author">' . esc_html( get_comment_author( $comment ) ) . '</span>';
}

// `_draft_or_post_title` calls `esc_html()` so we don't need to wrap that call in
// `esc_html`.
$post_title = '<a class="wp-block-latest-comments__comment-link" href="' . esc_url( get_comment_link( $comment ) ) . '">' . wp_latest_comments_draft_or_post_title( $comment->comment_post_ID ) . '</a>';
$post_title = '<a class="wp-block-latest-comments__comment-link" href="' . esc_url( get_comment_link( $comment ) ) . '">' . esc_html( wp_latest_comments_draft_or_post_title( $comment->comment_post_ID ) ) . '</a>';

$list_items_markup .= sprintf(
/* translators: 1: author name (inside <a> or <span> tag, based on if they have a URL), 2: post title related to this comment */
Expand All @@ -106,7 +106,7 @@ function render_block_core_latest_comments( $attributes = array() ) {
$list_items_markup .= sprintf(
'<time datetime="%1$s" class="wp-block-latest-comments__comment-date">%2$s</time>',
esc_attr( get_comment_date( 'c', $comment ) ),
date_i18n( get_option( 'date_format' ), get_comment_date( 'U', $comment ) )
esc_html( date_i18n( get_option( 'date_format' ), get_comment_date( 'U', $comment ) ) )
);
}
$list_items_markup .= '</footer>';
Expand Down