[wp-trac] [WordPress Trac] #22327: Settings API output is not escaped

[WordPress Trac]

#22327: Settings API output is not escaped
-----------------------------+----------------------------
 Reporter:  johnjamesjacoby  |       Type:  defect (bug)
   Status:  new              |   Priority:  normal
Milestone:  Awaiting Review  |  Component:  Administration
  Version:                   |   Severity:  normal
 Keywords:  has-patch        |
-----------------------------+----------------------------
 '''Problem'''

 The output from do_settings_sections() and do_settings_fields() is not
 escaped while looping through the $wp_settings_fields global.

 ----

 '''Unescaped Variables'''

 * $section['title']
 * $field['args']['label_for']
 * $field['title']

 ----

 '''Solutions'''

 * Escape everything. We shouldn't expect anyone that's using
 add_settings_section() and add_settings_field() to pass already escaped
 output. Note that core does not escape it's own usage here.
 * Escape nothing, and expect escaped input. This would require developer
 education to escape all of the things.

 ----

 '''Patch Attached'''

 Attached patch escapes all variable screen output.

-- 
Ticket URL: <http://core.trac.wordpress.org/ticket/22327>
WordPress Trac <http://core.trac.wordpress.org/>
WordPress blogging software