codesmith32

Hey devs, just wanted to say thanks for starting to fix this issue! I saw in v2.8 that someone went through and resolved most of the issues with class-job-single-view.php.

With that said, I realized this issue was more widespread than just class-job-single-view.php. It also applies to include/class-job-add-edit.php which I didn’t see any changes for yet (I should’ve mentioned it sooner). I found that specifically if we add an & to the position title, after saving, it re-renders triple-escaped, meaning we get &. If we save again, this then actually applies to the position page, and it worsens each time.

Again, I fixed this in my copy, but it doesn’t look like your code has fixed this yet. So, I’ll update and then apply my fix for this file, and see how it goes. EDIT: Worked fine after I applied my patch.

______________________________________________________________________________________

In general, though, to properly escape in WP plugins, you should follow these rules:

• Never escape anywhere except in the html directly. This ensures that double escaping never occurs, and also that lack of escaping never happens (which is in fact still true in some small places in the plugin). Your html strings therefore should be made up exclusively of:
  • quoted literals,
  • esc_attr calls, and
  • esc_html calls.
  • Only break this rule if it is absolutely necessary to inject strings containing html (which is generally very rare). In this case, it might be worth using a variable name convention to indicate a var that represents html.

• esc_html should always be used for escaping non-html contents within html (again, just don’t escape a string if it must contain html).
  • e.g., '<option ...>' . esc_html(...) . '</option>'
• esc_attr should be used for escaping within attributes.
  • e.g., '<input value="' . esc_attr(...) . '">.

______________________________________________________________________________________

There’s also a minor bug in admin/script.js that occurs when I use text mode instead of tinymce (which I always do). On line 839 (or so?) we have tinymce.get(editor_id).getContent() but tinymce.get(editor_id) returns null if I’m in text mode. It seems to work fine if I just break it up and only continue if the editor exists.

______________________________________________________________________________________

I would be more than willing to contribute, but I use github pretty much exclusively. I don’t see a github repo – just an SVN repo, and I’m not familiar with connecting github to an SVN repo..

Thanks again!

• This reply was modified 4 months, 1 week ago by codesmith32.
• This reply was modified 4 months, 1 week ago by codesmith32.
• This reply was modified 4 months, 1 week ago by codesmith32.

Hey @rodicaelena,

I believe it is fixed now. I was helping a client when I discovered it, and I think I recall they said it was working since the update.

Thank you!