Changeset 2974:d0d25c20f355

Timestamp:

03/25/15 08:45:57 (10 years ago)

Author:

Dsls

Branch:

2.7

Children:

2975:2833f573a998, 2976:04a121a3fb3c

Message:

Fixed SecPod? 1055, post_title escaped correctly now.

Files:

• admin/post.php (modified) (1 diff)
• plugins/pages/page.php (modified) (2 diffs)

admin/post.php

@@ -447 +447 @@
 
 if ($post_id && $post->post_status == 1) {
-     echo '<p><a class="onblog_link outgoing" href="'.$post->getURL().'" title="'.$post_title.'">'.__('Go to this entry on the site').' <img src="images/outgoing-blue.png" alt="" /></a></p>';
+     echo '<p><a class="onblog_link outgoing" href="'.$post->getURL().'" title="'.html::escapeHTML($post_title).'">'.__('Go to this entry on the site').' <img src="images/outgoing-blue.png" alt="" /></a></p>';
 }
 if ($post_id)

plugins/pages/page.php

@@ -348 +348 @@
                $img_status = '';
      }
-     $edit_entry_title = '“'.$post_title.'”'.' '.$img_status;
+     $edit_entry_title = '“'.html::escapeHTML($post_title).'”'.' '.$img_status;
 } else {
      $edit_entry_title = $page_title;
@@ -383 +383 @@
 
 if ($post_id && $post->post_status == 1) {
-     echo '<p><a class="onblog_link outgoing" href="'.$post->getURL().'" title="'.$post_title.'">'.__('Go to this page on the site').' <img src="images/outgoing-blue.png" alt="" /></a></p>';
+     echo '<p><a class="onblog_link outgoing" href="'.$post->getURL().'" title="'.html::escapeHTML($post_title).'">'.__('Go to this page on the site').' <img src="images/outgoing-blue.png" alt="" /></a></p>';
 }