mirror_php/wordpress
1
0
Fork 0
mirror of git://develop.git.wordpress.org/ synced 2025-01-19 05:38:07 +01:00
Code Issues Actions 10 Packages Projects Releases Wiki Activity

Administration: Restore the correct escaping function for base64-encoded SVG icons in the admin menu.

Browse Source 
Add a comment to clarify the `esc_attr()` usage instead of `esc_url()`.

Follow-up to [53050].

Props KProvance, kebbet, w33zy, ocean90, mukesh27.
Fixes #55539.

git-svn-id: https://develop.svn.wordpress.org/trunk@53092 602fd350-edb4-49c9-b593-d223f7449a82
This commit is contained in:
Sergey Biryukov 2022-04-07 12:52:32 +00:00
parent 9a7a11a74f
commit e34d775476
1 changed files with 3 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
src/wp-admin/menu-header.php
View File

@ -128,8 +128,9 @@ function _wp_menu_output( $menu, $submenu, $submenu_as_parent = true ) {
if ( 'none' === $item[6] || 'div' === $item[6] ) {
$img = '<br />';
} elseif ( 0 === strpos( $item[6], 'data:image/svg+xml;base64,' ) ) {
$img = '<br />';
$img_style = ' style="background-image:url(\'' . esc_url( $item[6] ) . '\')"';
$img = '<br />';
// The value is base64-encoded data, so esc_attr() is used here instead of esc_url().
$img_style = ' style="background-image:url(\'' . esc_attr( $item[6] ) . '\')"';
$img_class = ' svg';
} elseif ( 0 === strpos( $item[6], 'dashicons-' ) ) {
$img = '<br />';