Grouped backports to the 4.6 branch.

SergeyBiryukov · SergeyBiryukov · commit fc1f0aeaa597 · 2022-08-30T15:47:30.000Z
- Posts, Post Types: Escape output within `the_meta()`. - General: Ensure bookmark query limits are numeric. - Plugins: Escape output in error messages. Merges [53958-53960] to the 4.6 branch. Props tykoted, martinkrcho, xknown, dd32, peterwilsoncc, paulkevan, timothyblynjacobs. git-svn-id: https://develop.svn.wordpress.org/branches/4.6@53977 602fd350-edb4-49c9-b593-d223f7449a82
diff --git a/src/wp-admin/plugins.php b/src/wp-admin/plugins.php
@@ -423,7 +423,7 @@
 			/* translators: 1: plugin file 2: error message */
 			__( 'The plugin %1$s has been <strong>deactivated</strong> due to an error: %2$s' ),
 			'<code>' . esc_html( $plugin_file ) . '</code>',
-			$error->get_error_message() );
+			esc_html( $error->get_error_message() ) );
 		echo '</p></div>';
 	}
 }
@@ -458,7 +458,7 @@
 		delete_transient( 'plugins_delete_result_' . $user_ID );
 
 		if ( is_wp_error($delete_result) ) : ?>
-		<div id="message" class="error notice is-dismissible"><p><?php printf( __('Plugin could not be deleted due to an error: %s'), $delete_result->get_error_message() ); ?></p></div>
+		<div id="message" class="error notice is-dismissible"><p><?php printf( __('Plugin could not be deleted due to an error: %s'), esc_html( $delete_result->get_error_message() ) ); ?></p></div>
 		<?php else : ?>
 		<div id="message" class="updated notice is-dismissible">
 			<p>
diff --git a/src/wp-includes/bookmark.php b/src/wp-includes/bookmark.php
@@ -281,7 +281,7 @@ function get_bookmarks( $args = '' ) {
 	$query .= " $exclusions $inclusions $search";
 	$query .= " ORDER BY $orderby $order";
 	if ( $r['limit'] != -1 ) {
-		$query .= ' LIMIT ' . $r['limit'];
+		$query .= ' LIMIT ' . absint( $r['limit'] );
 	}
 
 	$results = $wpdb->get_results( $query );
diff --git a/src/wp-includes/post-template.php b/src/wp-includes/post-template.php
@@ -975,10 +975,10 @@ function post_custom( $key = '' ) {
  *
  * @since 1.2.0
  *
- * @internal This will probably change at some point...
- *
+ * @deprecated 6.0.2 Use get_post_meta() to retrieve post meta and render manually.
  */
 function the_meta() {
+	_deprecated_function( __FUNCTION__, '6.0.2', 'get_post_meta()' );
 	if ( $keys = get_post_custom_keys() ) {
 		echo "<ul class='post-meta'>\n";
 		foreach ( (array) $keys as $key ) {
@@ -997,7 +997,7 @@ function the_meta() {
 			 * @param string $key   Meta key.
 			 * @param string $value Meta value.
 			 */
-			echo apply_filters( 'the_meta_key', "<li><span class='post-meta-key'>$key:</span> $value</li>\n", $key, $value );
+			echo apply_filters( 'the_meta_key', "<li><span class='post-meta-key'>" . esc_html( $key ) . ":</span>" . esc_html( $value ) . "</li>\n", $key, $value );
 		}
 		echo "</ul>\n";
 	}

Original file line number	Diff line number	Diff line change
`@@ -281,7 +281,7 @@ function get_bookmarks( $args = '' ) {`
`281`	`281`	`$query .= " $exclusions $inclusions $search";`
`282`	`282`	`$query .= " ORDER BY $orderby $order";`
`283`	`283`	`if ( $r['limit'] != -1 ) {`
`284`		`- $query .= ' LIMIT ' . $r['limit'];`
	`284`	`+ $query .= ' LIMIT ' . absint( $r['limit'] );`
`285`	`285`	`}`
`286`	`286`
`287`	`287`	`$results = $wpdb->get_results( $query );`
Original file line number	Diff line number	Diff line change
`@@ -975,10 +975,10 @@ function post_custom( $key = '' ) {`
`975`	`975`	`*`
`976`	`976`	`* @since 1.2.0`
`977`	`977`	`*`
`978`		`- * @internal This will probably change at some point...`
`979`		`- *`
	`978`	`+ * @deprecated 6.0.2 Use get_post_meta() to retrieve post meta and render manually.`
`980`	`979`	`*/`
`981`	`980`	`function the_meta() {`
	`981`	`+ _deprecated_function( __FUNCTION__, '6.0.2', 'get_post_meta()' );`
`982`	`982`	`if ( $keys = get_post_custom_keys() ) {`
`983`	`983`	`echo "<ul class='post-meta'>\n";`
`984`	`984`	`foreach ( (array) $keys as $key ) {`
`@@ -997,7 +997,7 @@ function the_meta() {`
`997`	`997`	`* @param string $key Meta key.`
`998`	`998`	`* @param string $value Meta value.`
`999`	`999`	`*/`
`1000`		`- echo apply_filters( 'the_meta_key', "<li><span class='post-meta-key'>$key:</span> $value</li>\n", $key, $value );`
	`1000`	`+ echo apply_filters( 'the_meta_key', "<li><span class='post-meta-key'>" . esc_html( $key ) . ":</span>" . esc_html( $value ) . "</li>\n", $key, $value );`
`1001`	`1001`	`}`
`1002`	`1002`	`echo "</ul>\n";`
`1003`	`1003`	`}`