Skip to content

Commit 70af67f

Browse files
dd32dd32
committed
Escape/texturize Admin menu titles. Fixes page titles such as "Foo & Bar" not being entity encoded. Also includes some basic whitespace/standards cleanup to a related function. Fixes WordPress#12039
git-svn-id: https://develop.svn.wordpress.org/trunk@14127 602fd350-edb4-49c9-b593-d223f7449a82
1 parent 2d50f72 commit 70af67f

3 files changed

Lines changed: 15 additions & 13 deletions

File tree

‎wp-admin/includes/plugin.php‎

Lines changed: 6 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -818,22 +818,20 @@ function add_menu_page( $page_title, $menu_title, $capability, $menu_slug, $func
818818

819819
$hookname = get_plugin_page_hookname( $menu_slug, '' );
820820

821-
if (!empty ( $function ) && !empty ( $hookname ) && current_user_can( $capability ) )
821+
if ( !empty( $function ) && !empty( $hookname ) && current_user_can( $capability ) )
822822
add_action( $hookname, $function );
823823

824-
if ( empty($icon_url) ) {
824+
if ( empty($icon_url) )
825825
$icon_url = esc_url( admin_url( 'images/generic.png' ) );
826-
} elseif ( is_ssl() && 0 === strpos($icon_url, 'http://') ) {
826+
elseif ( is_ssl() && 0 === strpos($icon_url, 'http://') )
827827
$icon_url = 'https://' . substr($icon_url, 7);
828-
}
829828

830-
$new_menu = array ( $menu_title, $capability, $menu_slug, $page_title, 'menu-top ' . $hookname, $hookname, $icon_url );
829+
$new_menu = array( $menu_title, $capability, $menu_slug, $page_title, 'menu-top ' . $hookname, $hookname, $icon_url );
831830

832-
if ( NULL === $position ) {
831+
if ( null === $position )
833832
$menu[] = $new_menu;
834-
} else {
833+
else
835834
$menu[$position] = $new_menu;
836-
}
837835

838836
$_registered_pages[$hookname] = true;
839837

‎wp-admin/menu-header.php‎

Lines changed: 8 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -69,6 +69,8 @@ function _wp_menu_output( $menu, $submenu, $submenu_as_parent = true ) {
6969
}
7070
$toggle = '<div class="wp-menu-toggle"><br /></div>';
7171

72+
$title = wptexturize($item[0]);
73+
7274
echo "\n\t<li$class$id>";
7375

7476
if ( false !== strpos($class, 'wp-menu-separator') ) {
@@ -81,9 +83,9 @@ function _wp_menu_output( $menu, $submenu, $submenu_as_parent = true ) {
8183
$menu_file = substr($menu_file, 0, $pos);
8284
if ( ( ('index.php' != $submenu[$item[2]][0][2]) && file_exists(WP_PLUGIN_DIR . "/$menu_file") ) || !empty($menu_hook)) {
8385
$admin_is_parent = true;
84-
echo "<div class='wp-menu-image'><a href='admin.php?page={$submenu[$item[2]][0][2]}'>$img</a></div>$toggle<a href='admin.php?page={$submenu[$item[2]][0][2]}'$class$tabindex>{$item[0]}</a>";
86+
echo "<div class='wp-menu-image'><a href='admin.php?page={$submenu[$item[2]][0][2]}'>$img</a></div>$toggle<a href='admin.php?page={$submenu[$item[2]][0][2]}'$class$tabindex>$title</a>";
8587
} else {
86-
echo "\n\t<div class='wp-menu-image'><a href='{$submenu[$item[2]][0][2]}'>$img</a></div>$toggle<a href='{$submenu[$item[2]][0][2]}'$class$tabindex>{$item[0]}</a>";
88+
echo "\n\t<div class='wp-menu-image'><a href='{$submenu[$item[2]][0][2]}'>$img</a></div>$toggle<a href='{$submenu[$item[2]][0][2]}'$class$tabindex>$title</a>";
8789
}
8890
} else if ( current_user_can($item[1]) ) {
8991
$menu_hook = get_plugin_page_hook($item[2], 'admin.php');
@@ -138,16 +140,18 @@ function _wp_menu_output( $menu, $submenu, $submenu_as_parent = true ) {
138140
if ( false !== $pos = strpos($sub_file, '?') )
139141
$sub_file = substr($sub_file, 0, $pos);
140142

143+
$title = wptexturize($sub_item[0]);
144+
141145
if ( ( ('index.php' != $sub_item[2]) && file_exists(WP_PLUGIN_DIR . "/$sub_file") ) || ! empty($menu_hook) ) {
142146
// If admin.php is the current page or if the parent exists as a file in the plugins or admin dir
143147
if ( (!$admin_is_parent && file_exists(WP_PLUGIN_DIR . "/$menu_file") && !is_dir(WP_PLUGIN_DIR . "/{$item[2]}")) || file_exists($menu_file) )
144148
$sub_item_url = add_query_arg( array('page' => $sub_item[2]), $item[2] );
145149
else
146150
$sub_item_url = add_query_arg( array('page' => $sub_item[2]), 'admin.php' );
147151
$sub_item_url = esc_url($sub_item_url);
148-
echo "<li$class><a href='$sub_item_url'$class$tabindex>{$sub_item[0]}</a></li>";
152+
echo "<li$class><a href='$sub_item_url'$class$tabindex>$title</a></li>";
149153
} else {
150-
echo "<li$class><a href='{$sub_item[2]}'$class$tabindex>{$sub_item[0]}</a></li>";
154+
echo "<li$class><a href='{$sub_item[2]}'$class$tabindex>$title</a></li>";
151155
}
152156
}
153157
echo "</ul></div>";

‎wp-admin/menu.php‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -179,7 +179,7 @@ function _add_themes_utility_last() {
179179

180180
if ( current_user_can('edit_users') ) {
181181
$_wp_real_parent_file['profile.php'] = 'users.php'; // Back-compat for plugins adding submenus to profile.php.
182-
$submenu['users.php'][5] = array(__('Authors &amp; Users'), 'edit_users', 'users.php');
182+
$submenu['users.php'][5] = array(__('Authors & Users'), 'edit_users', 'users.php');
183183
$submenu['users.php'][10] = array(_x('Add New', 'user'), 'create_users', 'user-new.php');
184184

185185
$submenu['users.php'][15] = array(__('Your Profile'), 'read', 'profile.php');

0 commit comments

Comments
 (0)